Merge pull request #37 from madaidan/drives

Deny write access to hard drives
Kicksecure · Feb 9, 2020 · 8a23d27 · 8a23d27
2 parents 63fdd03 + 46a6e90
commit 8a23d27
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/etc/apparmor.d/abstractions/dangerous-files b/etc/apparmor.d/abstractions/dangerous-files
@@ -132,3 +132,7 @@
   audit deny /var/lib/hardened-kernel/** rw,
   audit deny /usr/share/hardened-kernel/ rw,
   audit deny /usr/share/hardened-kernel/** rw,
+
+  ## Deny write access to hard drives. Otherwise, an attacker can write to
+  ## e.g. /dev/sda to bypass restrictions.
+  audit deny /dev/sd* rw,
diff --git a/etc/apparmor.d/abstractions/init-systemd b/etc/apparmor.d/abstractions/init-systemd
@@ -228,7 +228,7 @@
   /dev/kvm rw,
   owner /dev/sr0 rwk,
   /dev/log rw,
-  owner /dev/sd* rwmk,
+  owner /dev/sd* r,
   owner /dev/kmsg rw,
   owner /dev/fb0 rw,
   owner /dev/vga_arbiter rw,