diff --git a/profiles/apparmor.d/lsblk b/profiles/apparmor.d/lsblk new file mode 100644 index 000000000..6d803c7fb --- /dev/null +++ b/profiles/apparmor.d/lsblk @@ -0,0 +1,38 @@ +#------------------------------------------------------------------ +# Copyright (C) 2024 Canonical Ltd. +# +# Author: Hlib Korzhynskyy +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +#------------------------------------------------------------------ +# vim: ft=apparmor +# + +abi , +include + +profile lsblk /usr/bin/lsblk { + include + include + include + + @{sys}/block/ r, + @{sys}/class/block/ r, + @{sys}/dev/block/ r, + + @{sys}/devices/pci[0-9]*:[0-9]*/** r, + @{sys}/devices/virtual/** r, + @{sys}/devices/platform/** r, + + /dev/sr[0-9]* rk, + + @{run}/udev/data/** r, + + @{run}/mount/** r, + @{PROC}/swaps r, + owner @{PROC}/@{pid}/mountinfo r, + + include if exists +} diff --git a/tests/profiles/lsblk/task.yaml b/tests/profiles/lsblk/task.yaml new file mode 100644 index 000000000..ca28b48e5 --- /dev/null +++ b/tests/profiles/lsblk/task.yaml @@ -0,0 +1,7 @@ +summary: smoke test for the lsblk profile +execute: | + # The lsblk program seems to work. + lsblk | MATCH vda1 + + # The profile is attached based on the program path. + "$SPREAD_PATH"/tests/bin/actual-profile-of lsblk | MATCH 'lsblk \(enforce\)'