logo

apparmor.d

Unnamed repository; edit this file 'description' to name the repository. git clone https://hacktivis.me/git/apparmor.d.git

lsb_release (1379B)

    

  1. # Note: This profile does not specify an attachment path because it is
  2. # intended to be used only via "Px -> lsb_release" exec transitions from
  3. # other profiles. We want to confine the lsb_release(1) utility when it
  4. # is invoked from other confined applications, but not when it is used
  5. # in regular (unconfined) shell scripts or run directly by the user.
  7. abi <abi/3.0>,
  9. include <tunables/global>
  11. # Do not attach to /usr/bin/lsb_release by default
  12. profile lsb_release {
  13.   include <abstractions/base>
  14.   include <abstractions/python>
  16.   owner @{PROC}/@{pid}/fd/ r,
  18.   /dev/tty rw,
  20.   /usr/bin/lsb_release r,
  21.   /usr/bin/python3.{1,}[0-9] mr,
  23.   /etc/debian_version r,
  24.   /etc/default/apport r,
  25.   /etc/dpkg/origins/** r,
  26.   /etc/lsb-release r,
  27.   /etc/lsb-release.d/ r,
  29.   /{usr/,}bin/bash ixr,
  30.   /{usr/,}bin/dash ixr,
  31.   /usr/bin/basename ixr,
  32.   /usr/bin/dpkg-query ixr,
  33.   /usr/bin/cat ixr,
  34.   /usr/bin/cut ixr,
  35.   /usr/bin/getopt ixr,
  36.   /usr/bin/sed ixr,
  37.   /usr/bin/tr ixr,
  39.   # TODO - many more permissions needed for this to work
  40.   deny /usr/bin/apt-cache x,
  42.   /usr/bin/ r,
  43.   /usr/include/python*/pyconfig.h r,
  44.   /usr/share/distro-info/** r,
  45.   /usr/share/dpkg/** r,
  46.   /usr/share/terminfo/** r,
  47.   /var/lib/dpkg/** r,
  49.   # file_inherit
  50.   deny /tmp/gtalkplugin.log w,
  52.   # Site-specific additions and overrides. See local/README for details.
  53.   include if exists <local/lsb_release>
  54. }