mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-30 14:55:15 +01:00
54 lines
1.3 KiB
Text
54 lines
1.3 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}bin/unmkinitramfs
|
|
profile unmkinitramfs @{exec_path} {
|
|
include <abstractions/base>
|
|
|
|
# To avoid the following error:
|
|
# cpio: etc/console-setup/null: Cannot mknod: Operation not permitted
|
|
capability mknod,
|
|
|
|
@{exec_path} r,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
|
|
/{usr/,}bin/cat rix,
|
|
/{usr/,}bin/xzcat rix,
|
|
/{usr/,}bin/lz4cat rix,
|
|
/{usr/,}bin/mkdir rix,
|
|
/{usr/,}bin/mktemp rix,
|
|
/{usr/,}bin/rm rix,
|
|
/{usr/,}bin/dd rix,
|
|
/{usr/,}bin/{,e}grep rix,
|
|
/{usr/,}bin/getopt rix,
|
|
|
|
/{usr/,}bin/cpio rix,
|
|
/{usr/,}bin/gzip rix,
|
|
/{usr/,}bin/bzip2 rix,
|
|
/{usr/,}bin/lzma rix,
|
|
/{usr/,}bin/lzop rix,
|
|
/{usr/,}bin/xz rix,
|
|
/{usr/,}bin/zstd rix,
|
|
|
|
/boot/ r,
|
|
owner /boot/initrd.img-* r,
|
|
/tmp/ r,
|
|
owner /tmp/initrd.img-* r,
|
|
/mnt/ r,
|
|
owner /mnt/initrd.img-* r,
|
|
/mnt/boot/ r,
|
|
owner /mnt/boot/initrd.img-* r,
|
|
|
|
# To extract the content of the initrd image
|
|
owner /tmp/** rwl -> /tmp/**,
|
|
|
|
/var/tmp/ r,
|
|
owner /var/tmp/unmkinitramfs_* rw,
|
|
|
|
include if exists <local/unmkinitramfs>
|
|
}
|