mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 08:58:15 +01:00
58 lines
1.7 KiB
Text
58 lines
1.7 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2018-2021 Mikhail Morfikov
|
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/dnscrypt-proxy
|
|
profile dnscrypt-proxy @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/ssl_certs>
|
|
|
|
capability net_admin,
|
|
capability net_bind_service,
|
|
capability setgid,
|
|
capability setuid,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
@{exec_path} mrix,
|
|
|
|
/etc/dnscrypt-proxy/{,**} r,
|
|
|
|
owner /etc/dnscrypt-proxy/public-resolvers.md rw,
|
|
owner /etc/dnscrypt-proxy/public-resolvers.md.minisig rw,
|
|
owner /etc/dnscrypt-proxy/relays.md rw,
|
|
owner /etc/dnscrypt-proxy/relays.md.minisig rw,
|
|
owner /etc/dnscrypt-proxy/sf-*.tmp rw,
|
|
|
|
/var/cache/private/dnscrypt-proxy/{,**} r,
|
|
/var/cache/private/dnscrypt-proxy/public-resolvers.md{,.minisig} rw,
|
|
/var/cache/private/dnscrypt-proxy/sf-*.tmp rw,
|
|
|
|
/var/log/dnscrypt-proxy/ r,
|
|
/var/log/dnscrypt-proxy/*.log w,
|
|
/var/log/private/dnscrypt-proxy/ rw,
|
|
/var/log/private/dnscrypt-proxy/*.log w,
|
|
|
|
owner /var/cache/dnscrypt-proxy/public-resolvers.md rw,
|
|
owner /var/cache/dnscrypt-proxy/public-resolvers.md.minisig rw,
|
|
owner /var/cache/dnscrypt-proxy/relays.md rw,
|
|
owner /var/cache/dnscrypt-proxy/relays.md.minisig rw,
|
|
owner /var/cache/dnscrypt-proxy/sf-*.tmp rw,
|
|
|
|
@{PROC}/sys/kernel/hostname r,
|
|
@{PROC}/sys/net/core/somaxconn r,
|
|
|
|
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
|
|
|
|
include if exists <local/dnscrypt-proxy>
|
|
}
|