mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge add more unconfined profiles

Browse source 
These applications need to use user namespaces, hence it needs an
unconfined profile when user namespaces are restricted from unconfined
like other applications in MR #1123

https://gitlab.com/apparmor/apparmor/-/merge_requests/1123

In addition this serves as a handle to uniquely identify them instead
of unconfined to peers in policy.

Note that unconfined mode should be changed for default_allow when
https://gitlab.com/apparmor/apparmor/-/merge_requests/1109 is merged.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1149
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen 2024-02-07 09:37:08 +00:00
commit ca3afe1691
4 changed files with 48 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
profiles/apparmor.d/devhelp Normal file
View file

@ -0,0 +1,12 @@
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/4.0>,
include <tunables/global>
profile devhelp /usr/bin/devhelp flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/devhelp>
}

12
profiles/apparmor.d/epiphany Normal file
View file

@ -0,0 +1,12 @@
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/4.0>,
include <tunables/global>
profile epiphany /usr/bin/epiphany{,-browser} flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/epiphany>
}

12
profiles/apparmor.d/evolution Normal file
View file

@ -0,0 +1,12 @@
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/4.0>,
include <tunables/global>
profile evolution /usr/bin/evolution flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/evolution>
}

12
profiles/apparmor.d/opam Normal file
View file

@ -0,0 +1,12 @@
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/4.0>,
include <tunables/global>
profile opam /usr/bin/opam flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/opam>
}