mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-05 17:01:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'drg-mods-2' into 'master'

Browse source 
New abstraction: lsb_release (sub-profile).

See merge request apparmor/apparmor!154
This commit is contained in:
intrigeri 2018-08-02 04:12:13 +00:00
commit 47e38944f3
1 changed files with 50 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
profiles/apparmor.d/lsb_release Normal file
View file

@ -0,0 +1,50 @@
# Note: This profile does not specify an attachment path because it is
# intended to be used only via "Px -> lsb_release" exec transitions from
# other profiles. We want to confine the lsb_release(1) utility when it
# is invoked from other confined applications, but not when it is used
# in regular (unconfined) shell scripts or run directly by the user.
#include <tunables/global>
# Do not attach to /usr/bin/lsb_release by default
profile lsb_release {
#include <abstractions/base>
#include <abstractions/python>
owner @{PROC}/@{pid}/fd/ r,
/dev/tty rw,
/usr/bin/lsb_release r,
/usr/bin/python3.[0-9] mr,
/etc/debian_version r,
/etc/default/apport r,
/etc/dpkg/origins/** r,
/etc/lsb-release r,
/etc/lsb-release.d/ r,
/{usr/,}bin/bash ixr,
/{usr/,}bin/dash ixr,
/usr/bin/basename ixr,
/usr/bin/dpkg-query ixr,
/usr/bin/getopt ixr,
/usr/bin/sed ixr,
/usr/bin/tr ixr,
# TODO - many more permissions needed for this to work
deny /usr/bin/apt-cache x,
/usr/bin/ r,
/usr/include/python*/pyconfig.h r,
/usr/share/distro-info/** r,
/usr/share/dpkg/** r,
/usr/share/terminfo/** r,
/var/lib/dpkg/** r,
# file_inherit
deny /tmp/gtalkplugin.log w,
# Site-specific additions and overrides. See local/README for details.
#include <local/lsb_release>
}