oxmc
a86ad3298e
This checkout is PawletOS's fork (git.oxmc.me/PawletOS/profiled), so its own identity should read PawletOS, not VesperOS: binary/package name, AIDL package+interface (me.oxmc.vesperos.profile -> os.pawlet.profiled), D-Bus service/object/error names, C++ namespace (vesperos::profile -> pawletos::profile), sepolicy types, data paths (/data/system/vesperos -> /data/system/pawletos, /etc/vesperprofiled -> /etc/pawletprofiled), the vendored OpenSSL static-lib module names, and the ZTE protocol string. Also drops generated build output (obj-x86_64-linux-gnu/, debian/.debhelper, debian staging dir, debhelper log/substvars files) that had been committed by mistake, and adds a .gitignore so they don't come back. The stock/upstream vesperprofiled at git.oxmc.me/VesperOS/vesperprofiled is untouched -- this commit only goes to the pawletos remote.
131 lines
5.5 KiB
Plaintext
131 lines
5.5 KiB
Plaintext
# /etc/apparmor.d/pawletprofiled
|
|
# AppArmor MAC profile for the pawletprofiled daemon.
|
|
# Installed by the pawletprofiled Debian package.
|
|
|
|
#include <tunables/global>
|
|
|
|
/usr/sbin/pawletprofiled {
|
|
#include <abstractions/base>
|
|
#include <abstractions/nameservice>
|
|
|
|
# D-Bus (system bus access)
|
|
#include <abstractions/dbus-strict>
|
|
|
|
# Own binary
|
|
/usr/sbin/pawletprofiled mr,
|
|
|
|
# ── Profile store ─────────────────────────────────────────────────────────
|
|
/var/lib/pawletprofiled/ rw,
|
|
/var/lib/pawletprofiled/** rw,
|
|
|
|
# ── Config directories (profile drop-ins written here) ───────────────────
|
|
/etc/pawletprofiled/ rw,
|
|
/etc/pawletprofiled/** rw,
|
|
/etc/NetworkManager/conf.d/ rw,
|
|
/etc/NetworkManager/conf.d/** rw,
|
|
/etc/NetworkManager/system-connections/ rw,
|
|
/etc/NetworkManager/system-connections/** rw,
|
|
/etc/apt/apt.conf.d/ rw,
|
|
/etc/apt/apt.conf.d/** rw,
|
|
/etc/cloud/cloud.cfg.d/ rw,
|
|
/etc/cloud/cloud.cfg.d/** rw,
|
|
/etc/systemd/timesyncd.conf.d/ rw,
|
|
/etc/systemd/timesyncd.conf.d/** rw,
|
|
/etc/systemd/resolved.conf.d/ rw,
|
|
/etc/systemd/resolved.conf.d/** rw,
|
|
/etc/security/pwquality.conf.d/ rw,
|
|
/etc/security/pwquality.conf.d/** rw,
|
|
/etc/security/faillock.conf.d/ rw,
|
|
/etc/security/faillock.conf.d/** rw,
|
|
/etc/nftables.d/ rw,
|
|
/etc/nftables.d/** rw,
|
|
/etc/ldap/ rw,
|
|
/etc/ldap/** rw,
|
|
/etc/nslcd.conf rw,
|
|
/etc/profile.d/ rw,
|
|
/etc/profile.d/** rw,
|
|
/etc/dconf/db/local.d/ rw,
|
|
/etc/dconf/db/local.d/** rw,
|
|
/etc/ssl/private/pawletos/ rw,
|
|
/etc/ssl/private/pawletos/** rw,
|
|
/usr/local/share/ca-certificates/pawletos/ rw,
|
|
/usr/local/share/ca-certificates/pawletos/** rw,
|
|
/var/lib/gnome-initial-setup/ rw,
|
|
/var/lib/gnome-initial-setup/** rw,
|
|
|
|
# ── Schema (read only — owned by pawletprofiled-config-schema) ────────────
|
|
/usr/share/pawletprofiled/schema/ r,
|
|
/usr/share/pawletprofiled/schema/* r,
|
|
|
|
# ── TLS / certificate paths (explicit — no abstractions/openssl on Debian) ─
|
|
/etc/ssl/certs/ r,
|
|
/etc/ssl/certs/** r,
|
|
/etc/ssl/openssl.cnf r,
|
|
/usr/lib/ssl/openssl.cnf r,
|
|
/usr/share/ca-certificates/ r,
|
|
/usr/share/ca-certificates/** r,
|
|
/etc/pawletprofiled/profile_ca.pem r,
|
|
|
|
# ── D-Bus service registration ────────────────────────────────────────────
|
|
dbus (send, receive, bind)
|
|
bus=system
|
|
name="os.pawlet.ProfiledService",
|
|
dbus (send)
|
|
bus=system
|
|
interface="org.freedesktop.DBus"
|
|
member="RequestName",
|
|
dbus (send)
|
|
bus=system
|
|
interface="org.freedesktop.NetworkManager",
|
|
dbus (receive)
|
|
bus=system
|
|
interface="org.freedesktop.NetworkManager",
|
|
|
|
# ── Executables called by payload handlers ────────────────────────────────
|
|
/usr/sbin/update-ca-certificates Px,
|
|
/usr/bin/dconf Px,
|
|
/usr/bin/gsettings Px,
|
|
/sbin/nft Px,
|
|
/usr/sbin/nslcd Px,
|
|
/usr/bin/pk12util Px,
|
|
/bin/systemctl Px,
|
|
/usr/bin/cloud-init Px,
|
|
# nmcli is no longer used (WiFi/Ethernet use keyfiles directly),
|
|
# but keep read access for diagnostics
|
|
/usr/bin/nmcli ix,
|
|
|
|
# ── Network (ZTE HTTPS lookups via libcurl) ───────────────────────────────
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network inet dgram, # DNS resolution
|
|
|
|
# ── /proc and system info ─────────────────────────────────────────────────
|
|
@{PROC}/@{pid}/status r,
|
|
@{PROC}/sys/kernel/hostname r,
|
|
/sys/class/dmi/id/ r,
|
|
/sys/class/dmi/id/* r,
|
|
/sys/class/net/ r,
|
|
/sys/class/net/** r,
|
|
/sys/firmware/efi/ r,
|
|
/sys/firmware/efi/** r,
|
|
/sys/class/tpm/ r,
|
|
/etc/machine-id r,
|
|
/var/lib/dbus/machine-id r,
|
|
|
|
# ── Logging ───────────────────────────────────────────────────────────────
|
|
/run/systemd/journal/socket w,
|
|
/run/systemd/notify w,
|
|
/dev/log w,
|
|
|
|
# ── Lock file (ZTE enrollment serialisation) ──────────────────────────────
|
|
/run/pawletprofiled/ rw,
|
|
/run/pawletprofiled/** rw,
|
|
|
|
# ── Deny sensitive paths ──────────────────────────────────────────────────
|
|
deny /home/** rw,
|
|
deny /root/** rw,
|
|
deny /boot/** rw,
|
|
deny network raw,
|
|
deny network packet,
|
|
}
|