131 lines
5.5 KiB
Plaintext
131 lines
5.5 KiB
Plaintext
# /etc/apparmor.d/vesperprofiled
|
|
# AppArmor MAC profile for the vesperprofiled daemon.
|
|
# Installed by the vesperprofiled Debian package.
|
|
|
|
#include <tunables/global>
|
|
|
|
/usr/sbin/vesperprofiled {
|
|
#include <abstractions/base>
|
|
#include <abstractions/nameservice>
|
|
|
|
# D-Bus (system bus access)
|
|
#include <abstractions/dbus-strict>
|
|
|
|
# Own binary
|
|
/usr/sbin/vesperprofiled mr,
|
|
|
|
# ── Profile store ─────────────────────────────────────────────────────────
|
|
/var/lib/vesperprofiled/ rw,
|
|
/var/lib/vesperprofiled/** rw,
|
|
|
|
# ── Config directories (profile drop-ins written here) ───────────────────
|
|
/etc/vesperprofiled/ rw,
|
|
/etc/vesperprofiled/** rw,
|
|
/etc/NetworkManager/conf.d/ rw,
|
|
/etc/NetworkManager/conf.d/** rw,
|
|
/etc/NetworkManager/system-connections/ rw,
|
|
/etc/NetworkManager/system-connections/** rw,
|
|
/etc/apt/apt.conf.d/ rw,
|
|
/etc/apt/apt.conf.d/** rw,
|
|
/etc/cloud/cloud.cfg.d/ rw,
|
|
/etc/cloud/cloud.cfg.d/** rw,
|
|
/etc/systemd/timesyncd.conf.d/ rw,
|
|
/etc/systemd/timesyncd.conf.d/** rw,
|
|
/etc/systemd/resolved.conf.d/ rw,
|
|
/etc/systemd/resolved.conf.d/** rw,
|
|
/etc/security/pwquality.conf.d/ rw,
|
|
/etc/security/pwquality.conf.d/** rw,
|
|
/etc/security/faillock.conf.d/ rw,
|
|
/etc/security/faillock.conf.d/** rw,
|
|
/etc/nftables.d/ rw,
|
|
/etc/nftables.d/** rw,
|
|
/etc/ldap/ rw,
|
|
/etc/ldap/** rw,
|
|
/etc/nslcd.conf rw,
|
|
/etc/profile.d/ rw,
|
|
/etc/profile.d/** rw,
|
|
/etc/dconf/db/local.d/ rw,
|
|
/etc/dconf/db/local.d/** rw,
|
|
/etc/ssl/private/vesperos/ rw,
|
|
/etc/ssl/private/vesperos/** rw,
|
|
/usr/local/share/ca-certificates/vesperos/ rw,
|
|
/usr/local/share/ca-certificates/vesperos/** rw,
|
|
/var/lib/gnome-initial-setup/ rw,
|
|
/var/lib/gnome-initial-setup/** rw,
|
|
|
|
# ── Schema (read only — owned by vesperprofiled-config-schema) ────────────
|
|
/usr/share/vesperprofiled/schema/ r,
|
|
/usr/share/vesperprofiled/schema/* r,
|
|
|
|
# ── TLS / certificate paths (explicit — no abstractions/openssl on Debian) ─
|
|
/etc/ssl/certs/ r,
|
|
/etc/ssl/certs/** r,
|
|
/etc/ssl/openssl.cnf r,
|
|
/usr/lib/ssl/openssl.cnf r,
|
|
/usr/share/ca-certificates/ r,
|
|
/usr/share/ca-certificates/** r,
|
|
/etc/vesperprofiled/profile_ca.pem r,
|
|
|
|
# ── D-Bus service registration ────────────────────────────────────────────
|
|
dbus (send, receive, bind)
|
|
bus=system
|
|
name="me.oxmc.vesperos.ProfileService",
|
|
dbus (send)
|
|
bus=system
|
|
interface="org.freedesktop.DBus"
|
|
member="RequestName",
|
|
dbus (send)
|
|
bus=system
|
|
interface="org.freedesktop.NetworkManager",
|
|
dbus (receive)
|
|
bus=system
|
|
interface="org.freedesktop.NetworkManager",
|
|
|
|
# ── Executables called by payload handlers ────────────────────────────────
|
|
/usr/sbin/update-ca-certificates Px,
|
|
/usr/bin/dconf Px,
|
|
/usr/bin/gsettings Px,
|
|
/sbin/nft Px,
|
|
/usr/sbin/nslcd Px,
|
|
/usr/bin/pk12util Px,
|
|
/bin/systemctl Px,
|
|
/usr/bin/cloud-init Px,
|
|
# nmcli is no longer used (WiFi/Ethernet use keyfiles directly),
|
|
# but keep read access for diagnostics
|
|
/usr/bin/nmcli ix,
|
|
|
|
# ── Network (ZTE HTTPS lookups via libcurl) ───────────────────────────────
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network inet dgram, # DNS resolution
|
|
|
|
# ── /proc and system info ─────────────────────────────────────────────────
|
|
@{PROC}/@{pid}/status r,
|
|
@{PROC}/sys/kernel/hostname r,
|
|
/sys/class/dmi/id/ r,
|
|
/sys/class/dmi/id/* r,
|
|
/sys/class/net/ r,
|
|
/sys/class/net/** r,
|
|
/sys/firmware/efi/ r,
|
|
/sys/firmware/efi/** r,
|
|
/sys/class/tpm/ r,
|
|
/etc/machine-id r,
|
|
/var/lib/dbus/machine-id r,
|
|
|
|
# ── Logging ───────────────────────────────────────────────────────────────
|
|
/run/systemd/journal/socket w,
|
|
/run/systemd/notify w,
|
|
/dev/log w,
|
|
|
|
# ── Lock file (ZTE enrollment serialisation) ──────────────────────────────
|
|
/run/vesperprofiled/ rw,
|
|
/run/vesperprofiled/** rw,
|
|
|
|
# ── Deny sensitive paths ──────────────────────────────────────────────────
|
|
deny /home/** rw,
|
|
deny /root/** rw,
|
|
deny /boot/** rw,
|
|
deny network raw,
|
|
deny network packet,
|
|
}
|