apparmor.d/apparmor.d/profiles-g-l/hw-probe

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = /{usr/,}bin/hw-probe
profile hw-probe @{exec_path} {
  include <abstractions/base>
  include <abstractions/perl>

  capability sys_admin,

  network inet dgram,
  network inet6 dgram,

  @{exec_path} r,
  /{usr/,}bin/perl r,

  /{usr/,}bin/pwd         rix,
  /{usr/,}bin/{,e}grep    rix,
  /{usr/,}bin/{,ba,da}sh  rix,
  /{usr/,}bin/{m,g,}awk   rix,
  /{usr/,}bin/sleep       rix,
  /{usr/,}bin/md5sum      rix,
  /{usr/,}bin/uname       rix,

  /{usr/,}bin/dd          rix,
  /{usr/,}bin/tar         rix,

  /{usr/,}bin/efivar      rix,
  /{usr/,}bin/efibootmgr  rix,

  /{usr/,}bin/lsb_release rPx -> lsb_release,
  /{usr/,}bin/dpkg        rPx -> child-dpkg,

  /{usr/,}{s,}bin/dkms    rPx,
  /{usr/,}{s,}bin/fdisk   rPx,
  /{usr/,}bin/upower      rPx,
  /{usr/,}{s,}bin/hdparm  rPx,
  /{usr/,}{s,}bin/smartctl rPx,
  /{usr/,}bin/sensors     rPx,
  /{usr/,}bin/lsblk       rPx,
  /{usr/,}bin/dmesg       rPx,
  /{usr/,}bin/hciconfig   rPx,
  /{usr/,}bin/uptime      rPx,
  /{usr/,}{s,}bin/rfkill  rPx,
  /{usr/,}{s,}bin/biosdecode rPx,
  /{usr/,}{s,}bin/dmidecode  rPx,
  /{usr/,}bin/edid-decode rPx,
  /{usr/,}bin/cpupower    rPx,
  /{usr/,}bin/acpi        rPx,
  /{usr/,}bin/lspci       rPx,
  /{usr/,}bin/lscpu       rPx,
  /{usr/,}bin/lsusb       rPx,
  /{usr/,}bin/usb-devices rPx,
  /{usr/,}{s,}bin/hwinfo  rPx,
  /{usr/,}bin/glxinfo     rPx,
  /{usr/,}{s,}bin/i2cdetect  rPx,
  /{usr/,}bin/glxgears    rPx,
  /{usr/,}{s,}bin/memtester rPx,
  /{usr/,}bin/xrandr      rPx,
  /{usr/,}bin/inxi        rPx,
  /{usr/,}bin/aplay       rPx,
  /{usr/,}bin/amixer      rPx,
  /{usr/,}bin/xdpyinfo    rPx,
  /{usr/,}bin/df          rPx,
  /{usr/,}bin/cpuid       rPx,
  /{usr/,}bin/xinput      rPx,

  /{usr/,}bin/systemctl   rPx -> child-systemctl,

  /{usr/,}bin/find            rCx -> find,
  /{usr/,}bin/journalctl      rCx -> journalctl,
  /{usr/,}bin/systemd-analyze rCx -> systemd-analyze,
  /{usr/,}bin/killall         rCx -> killall,
  /{usr/,}bin/udevadm         rCx -> udevadm,
  /{usr/,}bin/kmod            rCx -> kmod,
  /{usr/,}{s,}bin/iw          rCx -> netconfig,
  /{usr/,}{s,}bin/ifconfig    rCx -> netconfig,
  /{usr/,}{s,}bin/iwconfig    rCx -> netconfig,
  /{usr/,}{s,}bin/ethtool     rCx -> netconfig,
  /{usr/,}bin/curl            rCx -> curl,

  owner /root/HW_PROBE/{,**} rw,

  owner /tmp/*/ rw,
  owner /tmp/*/cpu_perf rw,

  /var/log/Xorg.[0-9].log{,.old} r,
  /etc/X11/xorg.conf.d/{,*.conf} r,
  /usr/share/X11/xorg.conf.d/{,*.conf} r,

  /etc/modprobe.d/{,*.conf} r,

  @{sys}/class/drm/ r,
  @{sys}/class/power_supply/ r,

  @{sys}/devices/virtual/dmi/id/* r,
  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]/*/edid r,
  @{sys}/devices/**/power_supply/*/uevent r,

  @{sys}/firmware/efi/efivars/ r,
  @{sys}/firmware/efi/efivars/* r,

  @{PROC}/scsi/scsi r,
  @{PROC}/ioports r,
  @{PROC}/interrupts r,
  @{PROC}/bus/input/devices r,


  profile find {
    include <abstractions/base>
    include <abstractions/nameservice-strict>

    capability dac_read_search,

    /{usr/,}bin/find mr,

    /dev/{,**} r,

    /root/ r,

  }

  profile journalctl {
    include <abstractions/base>

    /{usr/,}bin/journalctl mr,

    @{run}/log/ rw,
    /{run,var}/log/journal/ rw,
    /{run,var}/log/journal/@{hex}/ rw,
    /{run,var}/log/journal/@{hex}/user-@{hex}.journal* rw,
    /{run,var}/log/journal/@{hex}/system.journal* rw,
    /{run,var}/log/journal/@{hex}/system@@{hex}.journal* rw,

    owner @{PROC}/@{pid}/stat r,

    /var/lib/dbus/machine-id r,
    /etc/machine-id r,

  }

  profile systemd-analyze {
    include <abstractions/base>

    /{usr/,}bin/systemd-analyze mr,

    owner @{PROC}/@{pid}/stat r,

  }

  profile killall {
    include <abstractions/base>

    capability sys_ptrace,

    signal (send) set=(int, term, kill),

    ptrace (read),

    /{usr/,}bin/killall mr,

    # The /proc/ dir is needed to avoid the following error:
    #  /proc: Permission denied
         @{PROC}/ r,
         @{PROC}/@{pids}/stat r,

  }

  profile udevadm {
    include <abstractions/base>

    /{usr/,}bin/udevadm mr,

    /etc/udev/udev.conf r,

    owner @{PROC}/@{pid}/stat r,
          @{PROC}/cmdline r,
          @{PROC}/1/sched r,
          @{PROC}/1/environ r,
          @{PROC}/sys/kernel/osrelease r,

    @{sys}/bus/ r,
    @{sys}/bus/*/devices/ r,
    @{sys}/class/ r,
    @{sys}/class/*/ r,
    @{sys}/devices/**/uevent r,
    @{run}/udev/data/* r,

  }

  profile kmod {
    include <abstractions/base>

    /{usr/,}bin/kmod mr,

    @{PROC}/cmdline r,
    @{PROC}/modules r,

    @{sys}/module/*/ r,
    @{sys}/module/*/{coresize,refcnt} r,
    @{sys}/module/*/holders/ r,

  }

  profile netconfig {
    include <abstractions/base>

    # Not needed
    deny capability net_admin,
    deny capability net_raw,

    network inet dgram,
    network inet6 dgram,
    network ipx dgram,
    network ax25 dgram,
    network appletalk dgram,
    network netlink raw,

    /{usr/,}{s,}bin/iw       mr,
    /{usr/,}{s,}bin/ifconfig mr,
    /{usr/,}{s,}bin/iwconfig mr,
    /{usr/,}{s,}bin/ethtool  mr,

    owner @{PROC}/@{pid}/net/if_inet6 r,
    owner @{PROC}/@{pid}/net/dev r,

  }

  profile curl {
    include <abstractions/base>
    include <abstractions/nameservice-strict>
    include <abstractions/openssl>
    include <abstractions/ssl_certs>

    /{usr/,}bin/curl mr,

  }


  include if exists <local/hw-probe>
}