Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

interfaces: miscellaneous policy updates - 2.35 #5642

Merged
merged 8 commits into from Aug 14, 2018
Merged

interfaces: miscellaneous policy updates - 2.35 #5642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9a19f98
interfaces/hardware-observe: add lsblk
Aug 13, 2018
10c06e2
interfaces/process-control: add kill and pkill
Aug 13, 2018
8122986
interfaces/camera: allow a few more /sys/devices for UVC cameras
Aug 13, 2018
1f13507
interfaces/hardware-observe: allow reads on /sys/power
Aug 13, 2018
c33c510
interfaces/browser-support: also allow reading /run/udev/data/c24[01]
Aug 13, 2018
67405de
interfaces: allow /usr/bin/fold by default
Aug 13, 2018
4a81b96
interfaces: allow base32/base64 in default template
Aug 13, 2018
3d7d5e5
interfaces/network-control: allow write on /etc/hosts
Aug 13, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions interfaces/apparmor/template.go
View file
Open in desktop
Expand Up @@ -106,6 +106,8 @@ var defaultTemplate = `
# Common utilities for shell scripts
/{,usr/}bin/arch ixr,
/{,usr/}bin/{,g,m}awk ixr,
/{,usr/}bin/base32 ixr,
/{,usr/}bin/base64 ixr,
/{,usr/}bin/basename ixr,
/{,usr/}bin/bunzip2 ixr,
/{,usr/}bin/bzcat ixr,
Expand Down Expand Up @@ -135,6 +137,7 @@ var defaultTemplate = `
/{,usr/}bin/find ixr,
/{,usr/}bin/flock ixr,
/{,usr/}bin/fmt ixr,
/{,usr/}bin/fold ixr,
/{,usr/}bin/getconf ixr,
/{,usr/}bin/getent ixr,
/{,usr/}bin/getopt ixr,
Expand Down
2 changes: 1 addition & 1 deletion interfaces/builtin/browser_support.go
View file
Open in desktop
Expand Up @@ -191,7 +191,7 @@ deny /sys/devices/virtual/block/dm-[0-9]*/dm/name r,
/run/udev/data/b252:[0-9]* r,
/run/udev/data/b253:[0-9]* r,
/run/udev/data/b259:[0-9]* r,
/run/udev/data/c24[2-9]:[0-9]* r,
/run/udev/data/c24[0-9]:[0-9]* r,
/run/udev/data/c25[0-4]:[0-9]* r,

/sys/bus/**/devices/ r,
Expand Down
5 changes: 5 additions & 0 deletions interfaces/builtin/camera.go
View file
Open in desktop
Expand Up @@ -35,8 +35,13 @@ const cameraConnectedPlugAppArmor = `

# Allow detection of cameras. Leaks plugged in USB device info
/sys/bus/usb/devices/ r,
/sys/devices/pci**/usb*/**/busnum r,
/sys/devices/pci**/usb*/**/devnum r,
/sys/devices/pci**/usb*/**/idVendor r,
/sys/devices/pci**/usb*/**/idProduct r,
/sys/devices/pci**/usb*/**/interface r,
/sys/devices/pci**/usb*/**/modalias r,
/sys/devices/pci**/usb*/**/speed r,
/run/udev/data/c81:[0-9]* r, # video4linux (/dev/video*, etc)
/sys/class/video4linux/ r,
/sys/devices/pci**/usb*/**/video4linux/** r,
Expand Down
4 changes: 4 additions & 0 deletions interfaces/builtin/hardware_observe.go
View file
Open in desktop
Expand Up @@ -52,6 +52,9 @@ capability sys_admin,
/sys/firmware/dmi/tables/DMI r,
/sys/firmware/dmi/tables/smbios_entry_point r,

# power information
/sys/power/{,**} r,

# interrupts
@{PROC}/interrupts r,

Expand All @@ -64,6 +67,7 @@ capability sys_admin,
network netlink raw,

# util-linux
/{,usr/}bin/lsblk ixr,
/{,usr/}bin/lscpu ixr,
/{,usr/}bin/lsmem ixr,

Expand Down
3 changes: 3 additions & 0 deletions interfaces/builtin/network_control.go
View file
Open in desktop
Expand Up @@ -154,6 +154,9 @@ capability setuid,
@{PROC}/@{pid}/loginuid r,
@{PROC}/@{pid}/mounts r,

# static host tables
/etc/hosts w,

# resolvconf
/sbin/resolvconf ixr,
/run/resolvconf/{,**} r,
Expand Down
2 changes: 2 additions & 0 deletions interfaces/builtin/process_control.go
View file
Open in desktop
Expand Up @@ -43,6 +43,8 @@ capability sys_resource,
capability sys_nice,

signal (send),
/{,usr/}bin/kill ixr,
/{,usr/}bin/pkill ixr,
`

const processControlConnectedPlugSecComp = `
Expand Down