Skip to content
This repository has been archived by the owner on Jan 15, 2024. It is now read-only.

Deny write access to hard drives #37

Merged
merged 2 commits into from Feb 9, 2020
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 4 additions & 0 deletions etc/apparmor.d/abstractions/dangerous-files
Expand Up @@ -132,3 +132,7 @@
audit deny /var/lib/hardened-kernel/** rw,
audit deny /usr/share/hardened-kernel/ rw,
audit deny /usr/share/hardened-kernel/** rw,

## Deny write access to hard drives. Otherwise, an attacker can write to
## e.g. /dev/sda to bypass restrictions.
audit deny /dev/sd* rw,
2 changes: 1 addition & 1 deletion etc/apparmor.d/abstractions/init-systemd
Expand Up @@ -228,7 +228,7 @@
/dev/kvm rw,
owner /dev/sr0 rwk,
/dev/log rw,
owner /dev/sd* rwmk,
owner /dev/sd* r,
owner /dev/kmsg rw,
owner /dev/fb0 rw,
owner /dev/vga_arbiter rw,
Expand Down