You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
51 lines
1.3 KiB
Plaintext
51 lines
1.3 KiB
Plaintext
2 years ago
|
# Note: This profile does not specify an attachment path because it is
|
||
|
|
# intended to be used only via "Px -> lsb_release" exec transitions from
|
||
|
|
# other profiles. We want to confine the lsb_release(1) utility when it
|
||
|
|
# is invoked from other confined applications, but not when it is used
|
||
|
|
# in regular (unconfined) shell scripts or run directly by the user.
|
||
|
|
|
||
|
|
#include <tunables/global>
|
||
|
|
|
||
|
|
# Do not attach to /usr/bin/lsb_release by default
|
||
|
|
profile lsb_release {
|
||
|
|
#include <abstractions/base>
|
||
|
|
#include <abstractions/python>
|
||
|
|
|
||
|
|
owner @{PROC}/@{pid}/fd/ r,
|
||
|
|
|
||
|
|
/dev/tty rw,
|
||
|
|
|
||
|
|
/usr/bin/lsb_release r,
|
||
|
|
/usr/bin/python3.[0-9] mr,
|
||
|
|
|
||
|
|
/etc/debian_version r,
|
||
|
|
/etc/default/apport r,
|
||
|
|
/etc/dpkg/origins/** r,
|
||
|
|
/etc/lsb-release r,
|
||
|
|
/etc/lsb-release.d/ r,
|
||
|
|
|
||
|
|
/{usr/,}bin/bash ixr,
|
||
|
|
/{usr/,}bin/dash ixr,
|
||
|
|
/usr/bin/basename ixr,
|
||
|
|
/usr/bin/dpkg-query ixr,
|
||
|
|
/usr/bin/getopt ixr,
|
||
|
|
/usr/bin/sed ixr,
|
||
|
|
/usr/bin/tr ixr,
|
||
|
|
|
||
|
|
# TODO - many more permissions needed for this to work
|
||
|
|
deny /usr/bin/apt-cache x,
|
||
|
|
|
||
|
|
/usr/bin/ r,
|
||
|
|
/usr/include/python*/pyconfig.h r,
|
||
|
|
/usr/share/distro-info/** r,
|
||
|
|
/usr/share/dpkg/** r,
|
||
|
|
/usr/share/terminfo/** r,
|
||
|
|
/var/lib/dpkg/** r,
|
||
|
|
|
||
|
|
# file_inherit
|
||
|
|
deny /tmp/gtalkplugin.log w,
|
||
|
|
|
||
|
|
# Site-specific additions and overrides. See local/README for details.
|
||
|
|
#include <local/lsb_release>
|
||
|
|
}
|