docker-apparmor-profile 2.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667
  1. # systemctl-mqtt - MQTT client triggering & reporting shutdown on systemd-based systems
  2. #
  3. # Copyright (C) 2020 Fabian Peter Hammerle <fabian@hammerle.me>
  4. #
  5. # This program is free software: you can redistribute it and/or modify
  6. # it under the terms of the GNU General Public License as published by
  7. # the Free Software Foundation, either version 3 of the License, or
  8. # any later version.
  9. #
  10. # This program is distributed in the hope that it will be useful,
  11. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. # GNU General Public License for more details.
  14. #
  15. # You should have received a copy of the GNU General Public License
  16. # along with this program. If not, see <https://www.gnu.org/licenses/>.
  17. #include <tunables/global>
  18. profile systemctl-mqtt flags=(attach_disconnected) {
  19. #include <abstractions/base>
  20. network inet,
  21. # https://jlk.fjfi.cvut.cz/arch/manpages/man/apparmor.d.5#Access_Modes
  22. /systemctl-mqtt/ r,
  23. /systemctl-mqtt/** r,
  24. /systemctl-mqtt/.venv/lib/python3.8/site-packages/_dbus_bindings.so m,
  25. /systemctl-mqtt/.venv/lib/python3.8/site-packages/_dbus_glib_bindings.so m,
  26. /systemctl-mqtt/.venv/lib/python3.8/site-packages/gi/_gi.cpython-38-x86_64-linux-gnu.so m,
  27. /systemctl-mqtt/.venv/lib/python3.8/site-packages/gi/_gi_cairo.cpython-38-x86_64-linux-gnu.so m,
  28. # https://presentations.nordisch.org/apparmor/#/25
  29. /systemctl-mqtt/.venv/bin/systemctl-mqtt rix,
  30. /etc/** r,
  31. /usr/lib/** rm,
  32. /var/** r,
  33. deny /bin/** rwklx,
  34. deny @{PROC}/** rwklx,
  35. deny /sys/** rwklx,
  36. # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorDBus
  37. #include <abstractions/dbus-strict>
  38. dbus (send, receive)
  39. bus=system
  40. path=/org/freedesktop/login1
  41. interface=org.freedesktop.DBus.Introspectable
  42. member=Introspect
  43. peer=(label=unconfined),
  44. dbus (send)
  45. bus=system
  46. path=/org/freedesktop/login1
  47. interface=org.freedesktop.login1.Manager
  48. member={Inhibit,ListInhibitors,ScheduleShutdown}
  49. peer=(label=unconfined),
  50. dbus (receive)
  51. bus=system
  52. path=/org/freedesktop/login1
  53. interface=org.freedesktop.login1.Manager
  54. member=PrepareForShutdown
  55. peer=(label=unconfined),
  56. dbus (send)
  57. bus=system
  58. path=/org/freedesktop/login1
  59. interface=org.freedesktop.DBus.Properties
  60. member=Get
  61. peer=(label=unconfined),
  62. }