mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Description: Disallow writing and linking to @{HOME}/.pki/nssdb/ .so files

Browse source 
Bug-Ubuntu: https://launchpad.net/bugs/911847

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
This commit is contained in:
Jamie Strandboge 2012-01-06 10:29:32 -06:00
parent f29c0cc377
commit 0cb4e48344
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
profiles/apparmor.d/abstractions/private-files
View file

@ -1,6 +1,6 @@
# vim:syntax=apparmor # vim:syntax=apparmor
# privacy-violations contains rules for common files that you want to explicity # privacy-violations contains rules for common files that you want to
# deny access # explicitly deny access
# privacy violations (don't audit files under $HOME otherwise get a # privacy violations (don't audit files under $HOME otherwise get a
# lot of false positives when reading contents of directories) # lot of false positives when reading contents of directories)
@ -16,6 +16,7 @@
audit deny @{HOME}/bin/** wl, audit deny @{HOME}/bin/** wl,
audit deny @{HOME}/.config/autostart/** wl, audit deny @{HOME}/.config/autostart/** wl,
audit deny @{HOME}/.kde/Autostart/** wl, audit deny @{HOME}/.kde/Autostart/** wl,
audit deny @{HOME}/.pki/nssdb/*.so{,.[0-9]*} wl,
# don't allow reading/updating of run control files # don't allow reading/updating of run control files
deny @{HOME}/.*rc mrk, deny @{HOME}/.*rc mrk,

2
profiles/apparmor.d/abstractions/private-files-strict
View file

@ -1,6 +1,6 @@
# vim:syntax=apparmor # vim:syntax=apparmor
# privacy-violations-strict contains additional rules for sensitive # privacy-violations-strict contains additional rules for sensitive
# files that you want to explicity deny access # files that you want to explicitly deny access
#include <abstractions/private-files> #include <abstractions/private-files>