mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

merge from trunk

Browse source
This commit is contained in:
Jamie Strandboge 2012-01-11 09:48:22 +01:00
commit 3c2684b674
4 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
profiles/apparmor.d/abstractions/enchant
View file

@ -52,5 +52,5 @@
/usr/share/java/zemberek-tr-[0-9]*.jar r,
# per-user dictionaries
owner @{HOME}/.config/enchant/ r,
owner @{HOME}/.config/enchant/ rw,
owner @{HOME}/.config/enchant/* rwk,

1
profiles/apparmor.d/abstractions/private-files
View file

@ -16,6 +16,7 @@
audit deny @{HOME}/bin/** wl,
audit deny @{HOME}/.config/autostart/** wl,
audit deny @{HOME}/.kde/Autostart/** wl,
audit deny @{HOME}/.kde/env/** wl,
audit deny @{HOME}/.pki/nssdb/*.so{,.[0-9]*} wl,
# don't allow reading/updating of run control files

1
profiles/apparmor.d/sbin.syslog-ng
View file

@ -23,6 +23,7 @@
capability chown,
capability dac_override,
capability dac_read_search,
capability fsetid,
capability fowner,
capability sys_tty_config,

6
utils/Immunix/AppArmor.pm
View file

@ -770,12 +770,18 @@ sub create_new_profile($) {
my $hashbang = head($fqdbin);
if ($hashbang && $hashbang =~ /^#!\s*(\S+)/) {
my $interpreter = get_full_path($1);
$profile->{$fqdbin}{allow}{path}->{$fqdbin}{mode} |= str_to_mode("r");
$profile->{$fqdbin}{allow}{path}->{$fqdbin}{mode} |= 0;
$profile->{$fqdbin}{allow}{path}->{$interpreter}{mode} |= str_to_mode("ix");
$profile->{$fqdbin}{allow}{path}->{$interpreter}{audit} |= 0;
if ($interpreter =~ /perl/) {
$profile->{$fqdbin}{include}->{"abstractions/perl"} = 1;
} elsif ($interpreter =~ m/\/bin\/(bash|sh)/) {
$profile->{$fqdbin}{include}->{"abstractions/bash"} = 1;
} elsif ($interpreter =~ m/python/) {
$profile->{$fqdbin}{include}->{"abstractions/python"} = 1;
} elsif ($interpreter =~ m/ruby/) {
$profile->{$fqdbin}{include}->{"abstractions/ruby"} = 1;
}
handle_binfmt($profile->{$fqdbin}, $interpreter);
} else {