mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-05 17:01:00 +01:00
d64797e4c3
The AppArmor kernel now checks for both read and write permissions when a process calls connect() on a UNIX domain socket. The patch updates four abstractions that were found to be needing changes after the change in AF_UNIX kernel mediation. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
21 lines
852 B
Text
21 lines
852 B
Text
# vim:syntax=apparmor
|
|
# privacy-violations-strict contains additional rules for sensitive
|
|
# files that you want to explicitly deny access
|
|
|
|
#include <abstractions/private-files>
|
|
|
|
# potentially extremely sensitive files
|
|
audit deny @{HOME}/.gnupg/** mrwkl,
|
|
audit deny @{HOME}/.ssh/** mrwkl,
|
|
audit deny @{HOME}/.gnome2_private/** mrwkl,
|
|
audit deny @{HOME}/.gnome2/keyrings/** mrwkl,
|
|
# don't allow access to any gnome-keyring modules
|
|
audit deny /{,var/}run/user/[0-9]*/keyring** mrwkl,
|
|
audit deny @{HOME}/.mozilla/** mrwkl,
|
|
audit deny @{HOME}/.config/chromium/** mrwkl,
|
|
audit deny @{HOME}/.{,mozilla-}thunderbird/** mrwkl,
|
|
audit deny @{HOME}/.evolution/** mrwkl,
|
|
audit deny @{HOME}/.config/evolution/** mrwkl,
|
|
audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/** mrwkl,
|
|
audit deny @{HOME}/.kde{,4}/share/apps/kwallet/** mrwkl,
|
|
|