docker-apparmor-profile 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152
  1. # systemctl-mqtt - MQTT client triggering shutdown on systemd-based systems
  2. #
  3. # Copyright (C) 2020 Fabian Peter Hammerle <fabian@hammerle.me>
  4. #
  5. # This program is free software: you can redistribute it and/or modify
  6. # it under the terms of the GNU General Public License as published by
  7. # the Free Software Foundation, either version 3 of the License, or
  8. # any later version.
  9. #
  10. # This program is distributed in the hope that it will be useful,
  11. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. # GNU General Public License for more details.
  14. #
  15. # You should have received a copy of the GNU General Public License
  16. # along with this program. If not, see <https://www.gnu.org/licenses/>.
  17. #include <tunables/global>
  18. profile systemctl-mqtt flags=(attach_disconnected) {
  19. #include <abstractions/base>
  20. network inet,
  21. # https://jlk.fjfi.cvut.cz/arch/manpages/man/apparmor.d.5#Access_Modes
  22. /systemctl-mqtt/ r,
  23. /systemctl-mqtt/** r,
  24. /systemctl-mqtt/.venv/lib/python3.8/site-packages/_dbus_bindings.so m,
  25. # https://presentations.nordisch.org/apparmor/#/25
  26. /systemctl-mqtt/.venv/bin/systemctl-mqtt rix,
  27. /etc/** r,
  28. /usr/lib/** rm,
  29. /var/** r,
  30. deny /bin/** rwklx,
  31. deny @{PROC}/** rwklx,
  32. deny /sys/** rwklx,
  33. # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorDBus
  34. #include <abstractions/dbus-strict>
  35. dbus (send, receive)
  36. bus=system
  37. path=/org/freedesktop/login1
  38. interface=org.freedesktop.DBus.Introspectable
  39. member=Introspect
  40. peer=(label=unconfined),
  41. dbus (send)
  42. bus=system
  43. path=/org/freedesktop/login1
  44. interface=org.freedesktop.login1.Manager
  45. member=ScheduleShutdown
  46. peer=(label=unconfined),
  47. }