mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 00:14:44 +01:00
policy: update to use 4.0 abi
Begin preparing policy for the 4.0 release. This may result in new denials. This is expected and needed to make sure policy is ready for the 4.0 release. Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
parent
271f0e2366
commit
f1b4da2f64
275 changed files with 365 additions and 274 deletions
|
|
@ -132,7 +132,7 @@ check-parser: test-dependencies local
|
|||
@echo "*** Checking abstractions from ${ABSTRACTIONS_SOURCE} against apparmor_parser"
|
||||
$(Q)for abstraction in ${CHECK_ABSTRACTIONS} ; do \
|
||||
[ -n "${VERBOSE}" ] && echo "Testing $${abstraction}" ; \
|
||||
echo "abi <abi/3.0>, #include <tunables/global> profile test { #include <$${abstraction}> }" \
|
||||
echo "abi <abi/4.0>, #include <tunables/global> profile test { #include <$${abstraction}> }" \
|
||||
| ${PARSER} --config-file=../parser/tst/parser.conf -S -b ${PWD}/apparmor.d -I ${PWD} > /dev/null \
|
||||
|| exit 1; \
|
||||
done
|
||||
|
|
|
|||
91
profiles/apparmor.d/abi/4.0
Normal file
91
profiles/apparmor.d/abi/4.0
Normal file
|
|
@ -0,0 +1,91 @@
|
|||
capability {0xffffff
|
||||
}
|
||||
caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore
|
||||
}
|
||||
}
|
||||
dbus {mask {acquire send receive
|
||||
}
|
||||
}
|
||||
domain {attach_conditions {xattr {yes
|
||||
}
|
||||
}
|
||||
change_hat {yes
|
||||
}
|
||||
change_hatv {yes
|
||||
}
|
||||
change_onexec {yes
|
||||
}
|
||||
change_profile {yes
|
||||
}
|
||||
computed_longest_left {yes
|
||||
}
|
||||
fix_binfmt_elf_mmap {yes
|
||||
}
|
||||
post_nnp_subset {yes
|
||||
}
|
||||
stack {yes
|
||||
}
|
||||
version {1.2
|
||||
}
|
||||
}
|
||||
file {mask {create read write exec append mmap_exec link lock
|
||||
}
|
||||
}
|
||||
ipc {posix_mqueue {create read write open delete setattr getattr
|
||||
}
|
||||
}
|
||||
mount {mask {mount umount pivot_root
|
||||
}
|
||||
}
|
||||
namespaces {mask {userns_create
|
||||
}
|
||||
pivot_root {no
|
||||
}
|
||||
profile {yes
|
||||
}
|
||||
}
|
||||
network {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
|
||||
}
|
||||
af_unix {yes
|
||||
}
|
||||
}
|
||||
network_v8 {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
|
||||
}
|
||||
}
|
||||
policy {outofband {0x000001
|
||||
}
|
||||
permstable32 {allow deny subtree cond kill complain prompt audit quiet hide xindex tag label
|
||||
}
|
||||
permstable32_version {0x000002
|
||||
}
|
||||
set_load {yes
|
||||
}
|
||||
versions {v5 {yes
|
||||
}
|
||||
v6 {yes
|
||||
}
|
||||
v7 {yes
|
||||
}
|
||||
v8 {yes
|
||||
}
|
||||
v9 {yes
|
||||
}
|
||||
}
|
||||
}
|
||||
ptrace {mask {read trace
|
||||
}
|
||||
}
|
||||
query {label {data {yes
|
||||
}
|
||||
multi_transaction {yes
|
||||
}
|
||||
perms {allow deny audit quiet
|
||||
}
|
||||
}
|
||||
}
|
||||
rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
|
||||
}
|
||||
}
|
||||
signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
|
||||
}
|
||||
}
|
||||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/dri-common>
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
# This file contains basic permissions for Apache and every vHost
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/nameservice>
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/apparmor_api/introspect>
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,6 @@
|
|||
# Make sure to include at least tunables/proc and tunables/kernelvars
|
||||
# when using this abstraction, if not tunables/global.
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
@{PROC}/@{pids}/attr/{apparmor/,}{current,prev,exec} r,
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
#permissions needed for aa_find_mountpoint
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Make sure to include at least tunables/proc and tunables/kernelvars
|
||||
# when using this abstraction, if not tunables/global.
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# permissions needed for aa_is_enabled
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# aspell permissions
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# per-user settings and dictionaries
|
||||
owner @{HOME}/.aspell.*.{pws,prepl} rwk,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
|
||||
/dev/admmidi* rw,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
|
||||
# Some services need to perform authentication of users
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/crypto>
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# user-specific bash files
|
||||
@{HOMEDIRS} r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
|
||||
# there are three common ways to refer to consoles
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
@{etc_ro}/gcrypt/hwf.deny r,
|
||||
@{etc_ro}/gcrypt/random.conf r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# discoverable system configuration for non-local cupsd
|
||||
/etc/cups/client.conf r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This abstraction grants full system bus access. Consider using the
|
||||
# dbus-strict abstraction for fine-grained bus mediation.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This abstraction grants full accessibility bus access. Consider using the
|
||||
# dbus-accessibility-strict abstraction for fine-grained bus mediation.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
dbus send
|
||||
bus=accessibility
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
dbus send
|
||||
bus=system
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This abstraction grants full session bus access. Consider using the
|
||||
# dbus-session-strict abstraction for fine-grained bus mediation.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# unique per-machine identifier
|
||||
/etc/machine-id r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
@{run}/dbus/system_bus_socket rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# permissions for querying dconf settings; granting write access should
|
||||
# be specified in a specific application's profile.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
# ------------------------------------------------------------------
|
||||
# used with dovecot/*
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
capability setgid,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This file contains common DRI-specific rules useful for GUI applications
|
||||
# (needed by libdrm and similar).
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This file contains common DRI-specific rules useful for GUI applications that
|
||||
# needs to enumerate graphic devices (as with drmParsePciDeviceInfo() from
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# abstraction for Enchant spellchecking frontend
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This abstraction is designed to be used in a child profile to limit what
|
||||
# confined application can invoke via exo-open helper.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/fcitx-strict>
|
||||
dbus bus=fcitx,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/dbus-session-strict>
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/usr/share/AbiSuite/fonts/** r,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# system configuration
|
||||
@{system_share_dirs}/applications/{**,} r,
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This abstraction is designed to be used in a child profile to limit what
|
||||
# confined application can invoke via gio helper.
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/base>
|
||||
include <abstractions/fonts>
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# gnupg sub-process running permissions
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# user configurations
|
||||
owner @{HOME}/.gnupg/options r,
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/usr/share/themes/{,**} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This abstraction is designed to be used in a child profile to limit what
|
||||
# confined application can invoke via gvfs-open helper.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/etc/hosts.deny r,
|
||||
/etc/hosts.allow r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# abstraction for ibus input methods
|
||||
owner @{HOME}/.config/ibus/ r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/base>
|
||||
include <abstractions/fonts>
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# Rules for changing KDE settings (for KFileDialog and other).
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# User files
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# Rules for writing KDE icon cache
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# User files
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Rules for changing per-application language settings on KDE. Some KDE
|
||||
# applications have "Help -> Switch Application Language..." option, that needs
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This abstraction is designed to be used in a child profile to limit what
|
||||
# confined application can invoke via kde-open5 helper.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# files required by kerberos client programs
|
||||
/usr/lib{,32,64}/krb5/plugins/libkrb5/ r,
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# files required by LDAP clients (e.g. nss_ldap/pam_ldap)
|
||||
/etc/ldap.conf r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/dbus-strict>
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/tmp/.lwidentity/pipe rw,
|
||||
/var/lib/likewise-open/lwidentity_privileged/pipe rw,
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# mdnsd
|
||||
/etc/mdns.allow r,
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# Rules for Mesa implementation of the OpenGL API
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# System files
|
||||
/dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2()
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# mir libraries sometimes do not have a lib prefix
|
||||
# see LP: #1422521
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
unix (connect, receive, send) type=stream peer=(addr="@tmp/.mozc.*"),
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/var/lib/mysql{,d}/mysql{,d}.sock rw,
|
||||
@{run}/mysql{,d}/mysql{,d}.sock rw,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Many programs wish to perform nameservice-like operations, such as
|
||||
# looking up users by name or id, groups by name or id, hosts by name
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# NIS rules
|
||||
/var/yp/binding/* r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# libnss-systemd
|
||||
#
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# nvidia access requirements
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# configuration queries
|
||||
capability ipc_lock,
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# OpenCL access requirements
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# implementation-independent OpenCL access requirements
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# OpenCL access requirements for Intel implementation
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# OpenCL access requirements for Mesa implementation
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# OpenCL access requirements for NVIDIA implementation
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# OpenCL access requirements for POCL implementation
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/opencl-common>
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/etc/ssl/openssl.cnf r,
|
||||
/etc/ssl/openssl-*.cnf r,
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# orbit2 permissions
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# system library
|
||||
/usr/lib/orbit-2.0/*.so mr,
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/etc/pkcs11/ r,
|
||||
/etc/pkcs11/pkcs11.conf r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# a few files typically required for perl scripts
|
||||
/usr/bin/perl rmix,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# shared snippets for config files
|
||||
/etc/php{,5,7,8}/** r,
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
# This file contains basic permissions for php-fpm workers
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# load common libraries and their support files
|
||||
include <abstractions/base>
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
#backwards compatibility include, actual abstraction moved from php5 to php
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/php>
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
# ------------------------------------------------------------------
|
||||
# used with postfix/*
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
|
||||
capability setuid,
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# privacy-violations contains rules for common files that you want to
|
||||
# explicitly deny access
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# privacy violations (don't audit files under $HOME otherwise get a
|
||||
# lot of false positives when reading contents of directories)
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# privacy-violations-strict contains additional rules for sensitive
|
||||
# files that you want to explicitly deny access
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/private-files>
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/python{2.[4-7],3,3.[0-9],3.1[0-9]} r,
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# Common rules for Qt5-based applications
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Additional libraries
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# Allow writing cache for Qt5 "platforminputcontexts" plugins
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# User files
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# Allow writing shared settings for Qt-based applications
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# User files
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# vim:syntax=apparmor
|
||||
# Allow updating recent documents
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# User files
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/ r,
|
||||
/usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/**.rb r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/etc/samba/* r,
|
||||
/usr/lib*/ldb/*.so mr,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
|
||||
# This file contains basic permissions for samba rpcd_xyz services
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# libpam-smbpass/pam_smbpass.so permissions
|
||||
/var/lib/samba/*.[lt]db rwk,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/etc/ca-certificates/{,**} r,
|
||||
/etc/{,libre}ssl/ r,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# private ssl permissions
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# This little snippet should abstract the read/write access to a repository.
|
||||
# it is intended to be included in profiles for svnserve/apache2 and maybe
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# requires <tunables/home>
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/usr/bin/azureus Cxr -> sanitized_helper,
|
||||
/usr/bin/bitstormlite Cxr -> sanitized_helper,
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
/usr/bin/arora Cx -> sanitized_helper,
|
||||
/usr/bin/dillo Cx -> sanitized_helper,
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
# For site-specific adjustments, please see:
|
||||
# /etc/apparmor.d/local/chromium-browser
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/ubuntu-browsers.d/plugins-common>
|
||||
include <abstractions/ubuntu-browsers.d/mailto>
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Java plugin
|
||||
owner @{HOME}/.java/deployment/deployment.properties k,
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/kde>
|
||||
/usr/bin/kde4-config Cx -> sanitized_helper,
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# for mailto:
|
||||
include <abstractions/ubuntu-email>
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <abstractions/X>
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
#
|
||||
# Plugins/helpers
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Openoffice.org
|
||||
/usr/bin/ooffice Cxr -> sanitized_helper,
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Text editors (It's All Text [https://addons.mozilla.org/en-US/firefox/addon/4125])
|
||||
/usr/bin/emacsclient.emacs-snapshot Cxr -> sanitized_helper,
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# Apport
|
||||
/usr/bin/apport-bug Cx -> sanitized_helper,
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
abi <abi/4.0>,
|
||||
|
||||
# firefox-notify
|
||||
include <abstractions/python>
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Reference in a new issue