mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
9890acd0c5
We should be using apparmor controlled domains for these files.
Rename the template file from
com.ubuntu.pkexec.aa-notify.policy
to
net.apparmor.pkexec.aa-notify.policy
And update the template file and the install file so that the files
that are generated use net.apparmor instead of com.ubuntu
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit a410f347a3)
Signed-off-by: John Johansen <john.johansen@canonical.com>
30 lines
1.4 KiB
XML
30 lines
1.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE policyconfig PUBLIC
|
|
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
|
|
<policyconfig>
|
|
|
|
<action id="net.apparmor.pkexec.aa-notify.modify_profile">
|
|
<description>AppArmor: modifying security profile</description>
|
|
<message>To modify an AppArmor security profile, you need to authenticate.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>auth_admin</allow_active>
|
|
</defaults>
|
|
<annotate key="org.freedesktop.policykit.exec.path">{LIB_PATH}apparmor/update_profile.py</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.argv1">add_rule</annotate>
|
|
</action>
|
|
<action id="net.apparmor.pkexec.aa-notify.create_userns">
|
|
<description>AppArmor: adding userns profile</description>
|
|
<message>To allow a program to use unprivileged user namespaces, you need to authenticate.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>auth_admin</allow_active>
|
|
</defaults>
|
|
<annotate key="org.freedesktop.policykit.exec.path">{LIB_PATH}apparmor/update_profile.py</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.argv1">create_userns</annotate>
|
|
</action>
|
|
|
|
</policyconfig>
|