mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

allow more binaries and capabilities

Browse source
This commit is contained in:
Octavio Galland 2024-12-10 10:57:45 -03:00
parent 5271d6a74a
commit 29637f19c9
1 changed files with 10 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
profiles/apparmor.d/tar
View file

@ -14,21 +14,20 @@ include <tunables/global>
profile tar /usr/bin/tar { profile tar /usr/bin/tar {
include <abstractions/base> include <abstractions/base>
file rw /**, file rwl /**,
/usr/bin/{bzip2,gzip,lzip,lzop,xz,zstd} PUx, # tar can be made to filter archives through an arbitrary program,
# restrict it to any binary from "safe" locations
/{bin,opt,snap,usr}/** PUx,
# Sometimes tar does not invoke bzip2/gzip/etc directly, but rather by # used to extract user files as root
# executing, for instance, `/bin/sh -c bzip2`. Since we don't know what capability chown,
# shell the user might be running (and hence, where /bin/sh might be
# pointing to in case it's a symlink), let tar execute the link,
# but we only let the child process execute one of the "safe" binaries.
/bin/sh Cxl -> shell,
profile shell { # used to compress user files as root
/usr/bin/{bzip2,gzip,lzip,lzop,xz,zstd} PUx, capability dac_override,
} capability dac_read_search,
# Site-specific additions and overrides. See local/README for details. # Site-specific additions and overrides. See local/README for details.
include if exists <local/tar> include if exists <local/tar>
} }