mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 00:14:44 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

initial fusermount3 profile

Browse source
This commit is contained in:
Julia Sarris 2025-01-30 09:24:32 -05:00
parent d482aab419
commit 124f8efddc
1 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
profiles/apparmor.d/fusermount3 Normal file
View file

@ -0,0 +1,32 @@
abi <abi/4.0>,
include <tunables/global>
profile /usr/bin/fusermount3 {
include <abstractions/base>
include <abstractions/nameservice>
capability sys_admin,
audit mount,
audit umount,
mount fstype=fuse options=(nosuid) -> /home/*/mounts/,
mount fstype=fuseblk options=(nosuid) -> /home/*/mounts/,
mount fstype=fuse options=(nosuid) -> /run/user/*/mounts/,
mount fstype=fuseblk options=(nosuid) -> /run/user/*/mounts/,
mount fstype=fuse options=(nosuid) -> /mnt/,
mount fstype=fuseblk options=(nosuid) -> /mnt/,
mount fstype=fuse options=(nosuid) -> /media/,
mount fstype=fuseblk options=(nosuid) -> /media/,
/dev/fuse rw,
# Allow reading of fuse configuration files
@{etc_rw}/fuse.conf r,
@{PROC}/@{pid}/mounts r,
# Allow only read and execute permissions for the binary itself
/usr/bin/fusermount3 mr,
include if exists <local/fusermount3>
}