mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-07 02:35:06 +01:00
f94faf697e
* Read-only root compatibility * remove complain Co-authored-by: nobodysu <nobodysu@users.noreply.github.com>
84 lines
2.1 KiB
Text
84 lines
2.1 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2018-2022 Mikhail Morfikov
|
|
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}{s,}bin/dhclient-script
|
|
profile dhclient-script @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice>
|
|
include <abstractions/openssl>
|
|
include <abstractions/ssl_certs>
|
|
|
|
capability net_admin,
|
|
capability sys_admin,
|
|
audit capability sys_module,
|
|
|
|
@{exec_path} mr,
|
|
|
|
/{usr/,}{s,}bin/ddclient rPx,
|
|
/{usr/,}{s,}bin/sysctl rix,
|
|
/{usr/,}bin/{,ba,da}sh mrix,
|
|
/{usr/,}bin/chmod rix,
|
|
/{usr/,}bin/chown rix,
|
|
/{usr/,}bin/chronyc rPUx,
|
|
/{usr/,}bin/date rix,
|
|
/{usr/,}bin/fold rix,
|
|
/{usr/,}bin/head rix,
|
|
/{usr/,}bin/hostname rix,
|
|
/{usr/,}bin/ip rix,
|
|
/{usr/,}bin/logger rix,
|
|
/{usr/,}bin/mkdir rix,
|
|
/{usr/,}bin/mv rix,
|
|
/{usr/,}bin/paste rix,
|
|
/{usr/,}bin/ping rPx,
|
|
/{usr/,}bin/printenv rix,
|
|
/{usr/,}bin/readlink rix,
|
|
/{usr/,}bin/rm rix,
|
|
/{usr/,}bin/run-parts rCx -> run-parts,
|
|
/{usr/,}bin/sed rix,
|
|
/{usr/,}bin/tr rix,
|
|
/{usr/,}bin/xxd rix,
|
|
/{usr/,}sbin/resolvconf rPx,
|
|
|
|
/etc/default/ddclient r,
|
|
/etc/dhcp/{,**} r,
|
|
/etc/fstab r,
|
|
/etc/iproute2/rt_tables r,
|
|
/etc/iproute2/rt_tables.d/{,*} r,
|
|
@{etc_rw}/resolv.conf rw,
|
|
@{etc_rw}/resolv.conf.dhclient-new.@{pid} rw,
|
|
@{etc_rw}/samba/dhcp.conf{,.new} rw,
|
|
|
|
/var/lib/dhcp/dhclient.leases r,
|
|
/var/lib/samba/dhcp.conf{,.new} rw,
|
|
|
|
owner /tmp/dhclient-script.debug rw,
|
|
owner /tmp/variables.txt w,
|
|
|
|
@{run}/chrony-dhcp/ rw,
|
|
@{run}/systemd/netif/leases/ r,
|
|
|
|
@{sys}/devices/virtual/dmi/id/board_vendor r,
|
|
|
|
owner @{PROC}/@{pid}/loginuid r,
|
|
@{PROC}/sys/net/ipv6/conf/*/stable_secret w,
|
|
|
|
profile run-parts {
|
|
include <abstractions/base>
|
|
|
|
/{usr/,}bin/run-parts mr,
|
|
|
|
/etc/dhcp/dhclient-{enter,exit}-hooks.d/ r,
|
|
|
|
# file_inherit
|
|
owner /var/lib/dhcp/dhclient.leases r,
|
|
|
|
}
|
|
|
|
include if exists <local/dhclient-script>
|
|
}
|