mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-03-04 06:34:43 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
apparmor.d/apparmor.d/profiles-m-r/run-parts
Alexandre Pujol 8a381b2f6b
feat(profile): various update for ubuntu.
2025-02-23 18:13:16 +01:00

265 lines
8.8 KiB
Text
Raw Blame History

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
# TODO: Rewrite this profile. Most of the rule should be confined directly by the calling profile
# Possible confinement depending of profile architecture:
# - As rix,
# - As rCx -> run-parts,
# - As rPx -> foo-run-parts,
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/run-parts
profile run-parts @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability mknod,
@{exec_path} mrix,
@{sh_path} rix,
@{bin}/anacron rix,
@{bin}/cat rix,
@{bin}/date rix,
@{bin}/nice rix,
@{bin}/snapper rix,
/usr/share/update-notifier/notify-reboot-required rPx,
/usr/share/update-notifier/notify-updates-outdated rPx,
/etc/ r,
/etc/anacrontab r,
/etc/conf.d/snapper{,**} r,
/etc/default/* r,
/etc/profile.d/{,**} r,
/etc/snapper/configs/root r,
# Crontab
/etc/cron.{hourly,daily,weekly,monthly}/ r,
/etc/cron.{hourly,daily,weekly,monthly}/0anacron rix,
/etc/cron.{hourly,daily,weekly,monthly}/apport rPx,
/etc/cron.{hourly,daily,weekly,monthly}/apt-compat rPx,
/etc/cron.{hourly,daily,weekly,monthly}/apt-listbugs rPx,
/etc/cron.{hourly,daily,weekly,monthly}/apt-show-versions rPx,
/etc/cron.{hourly,daily,weekly,monthly}/apt-xapian-index rPx,
/etc/cron.{hourly,daily,weekly,monthly}/aptitude rPx,
/etc/cron.{hourly,daily,weekly,monthly}/bsdmainutils rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/checksecurity rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/debsums rPx,
/etc/cron.{hourly,daily,weekly,monthly}/debtags rPx,
/etc/cron.{hourly,daily,weekly,monthly}/dlocate rPx,
/etc/cron.{hourly,daily,weekly,monthly}/dpkg rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/etckeeper rPx,
/etc/cron.{hourly,daily,weekly,monthly}/exim4-base rPx,
/etc/cron.{hourly,daily,weekly,monthly}/logrotate rPx,
/etc/cron.{hourly,daily,weekly,monthly}/man-db rPx,
/etc/cron.{hourly,daily,weekly,monthly}/mlocate rPx,
/etc/cron.{hourly,daily,weekly,monthly}/passwd rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/plocate rPx,
/etc/cron.{hourly,daily,weekly,monthly}/popularity-contest rPx,
/etc/cron.{hourly,daily,weekly,monthly}/snapper rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/spamassassin rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/sysstat rPx,
/etc/cron.{hourly,daily,weekly,monthly}/tor rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/vrms rPUx,
/var/spool/anacron/cron.{hourly,daily,weekly,monthly} rw,
# Network
/etc/network/if-down.d/ r,
/etc/network/if-down.d/openvpn rPUx,
/etc/network/if-down.d/resolvconf rPUx,
/etc/network/if-down.d/wpasupplicant rPUx,
/etc/hostapd/ifupdown.sh rPUx,
/etc/macchanger/ifupdown.sh rPUx,
/etc/wpa_supplicant/ifupdown.sh rPUx,
/etc/network/if-post-down.d/ r,
/etc/network/if-post-down.d/bridge rPUx,
/etc/network/if-post-down.d/chrony rPUx,
/etc/network/if-post-down.d/hostapd rPUx,
/etc/network/if-post-down.d/ifenslave rPUx,
/etc/network/if-post-down.d/macchanger rPUx,
/etc/network/if-post-down.d/wireless-tools rPUx,
/etc/network/if-post-down.d/wpasupplicant rPUx,
/etc/network/if-pre-up.d/ r,
/etc/network/if-pre-up.d/bridge rPUx,
/etc/network/if-pre-up.d/ethtool rPUx,
/etc/network/if-pre-up.d/hostapd rPUx,
/etc/network/if-pre-up.d/ifenslave rPUx,
/etc/network/if-pre-up.d/macchanger rPUx,
/etc/network/if-pre-up.d/random-secret rPUx,
/etc/network/if-pre-up.d/wireless-tools rPUx,
/etc/network/if-pre-up.d/wpasupplicant rPUx,
/etc/network/if-up.d/ r,
/etc/network/if-up.d/*resolvconf rPUx,
/etc/network/if-up.d/avahi-autoipd rPUx,
/etc/network/if-up.d/chrony rPUx,
/etc/network/if-up.d/ethtool rPUx,
/etc/network/if-up.d/ifenslave rPUx,
/etc/network/if-up.d/openvpn rPUx,
/etc/network/if-up.d/postfix rPUx,
/etc/network/if-up.d/ubuntu-fan rPx,
/etc/network/if-up.d/wpasupplicant rPUx,
# Motd
/etc/update-motd.d/ r,
/etc/update-motd.d/* rCx -> motd,
# Kernel
/etc/kernel/header_postinst.d/ r,
/etc/kernel/header_postinst.d/dkms rCx -> kernel,
/etc/kernel/postinst.d/ r,
/etc/kernel/postinst.d/apt-auto-removal rCx -> kernel,
/etc/kernel/postinst.d/dkms rCx -> kernel,
/etc/kernel/postinst.d/initramfs-tools rCx -> kernel,
/etc/kernel/postinst.d/unattended-upgrades rCx -> kernel,
/etc/kernel/postinst.d/zz-update-grub rCx -> kernel,
/etc/kernel/postinst.d/zz-shim rCx -> kernel,
/etc/kernel/postinst.d/xx-update-initrd-links rCx -> kernel,
/etc/kernel/postrm.d/ r,
/etc/kernel/postrm.d/initramfs-tools rCx -> kernel,
/etc/kernel/postrm.d/zz-update-grub rCx -> kernel,
/etc/kernel/preinst.d/ r,
/etc/kernel/preinst.d/intel-microcode rCx -> kernel,
/etc/kernel/prerm.d/ r,
/etc/kernel/prerm.d/dkms rCx -> kernel,
/usr/share/finalrd/ r,
/usr/share/finalrd/mdadm.finalrd rPUx,
/usr/share/finalrd/open-iscsi.finalrd rPUx,
/usr/share/landscape/landscape-sysinfo.wrapper rPUx,
/root/ r,
/var/spool/anacron/cron.daily k,
owner @{tmp}/#@{int} rw,
owner @{tmp}/$anacron@{rand6} rw,
owner @{tmp}/file@{rand6} rw,
owner @{sys}/class/power_supply/ r,
/dev/tty@{int} rw,
profile motd {
include <abstractions/base>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,
network netlink raw,
@{sh_path} rix,
@{bin}/{e,}grep rix,
@{bin}/cat rix,
@{bin}/cut rix,
@{bin}/find rix,
@{bin}/head rix,
@{bin}/id rix,
@{bin}/sort rix,
@{bin}/tr rix,
@{bin}/uname rix,
@{bin}/hostname rPx,
@{bin}/snap rPUx,
@{lib}/ubuntu-release-upgrader/release-upgrade-motd rPx,
@{lib}/update-notifier/update-motd-fsck-at-reboot rPx,
@{lib}/update-notifier/update-motd-reboot-required rix,
/usr/share/unattended-upgrades/update-motd-unattended-upgrades rix,
/usr/share/update-notifier/notify-updates-outdated rPx,
/ r,
/etc/default/motd-news r,
/etc/lsb-release r,
/etc/update-motd.d/* r,
/var/cache/motd-news rw,
/var/lib/update-notifier/updates-available r,
/var/lib/ubuntu-advantage/messages/motd-esm-announce r,
@{run}/motd.d/{,*} r,
@{PROC}/@{pids}/mounts r,
/dev/tty@{int} rw,
include if exists <local/run-parts_motd>
}
profile kernel {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_module,
@{sh_path} rix,
@{bin}/{,e}grep rix,
@{bin}/{,m,g}awk rix,
@{bin}/cat rix,
@{bin}/chmod rix,
@{bin}/cut rix,
@{bin}/dirname rix,
@{bin}/kmod rix,
@{bin}/mv rix,
@{bin}/rm rix,
@{bin}/rmdir rix,
@{bin}/sed rix,
@{bin}/sort rix,
@{bin}/touch rix,
@{bin}/tr rix,
@{bin}/uname rix,
@{bin}/which{,.debianutils} rix,
@{bin}/apt-config rPx,
@{bin}/dkms rPx,
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/systemd-detect-virt rPx,
@{bin}/update-alternatives rPx,
@{bin}/update-grub rPUx,
@{bin}/update-initramfs rPx,
@{lib}/dkms/dkms_autoinstaller rPx,
@{lib}/modules/*/updates/ w,
@{lib}/modules/*/updates/dkms/ w,
/etc/kernel/header_postinst.d/* r,
/etc/kernel/{postinst,postrm,preinst,prerm}.d/* r,
# For shell pwd
/ r,
/boot/ r,
/etc/apt/apt.conf.d/ r,
/etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw,
/etc/modprobe.d/ r,
/etc/modprobe.d/*.conf r,
@{run}/reboot-required w,
@{run}/reboot-required.pkgs rw,
@{PROC}/devices r,
@{PROC}/cmdline r,
include if exists <local/run-parts_kernel>
}
include if exists <local/run-parts>
}
# vim:syntax=apparmor
Reference in a new issue View git blame Copy permalink