ac938da314
* dhcpcd, wpa_supplicant: add small additional permissions
* wpa_cli: remove profile, it causes issues with the -a flag;
expected impact is low: wpa_cli is run as a normal user,
and it does not serve requests to other users.
53 lines
1.1 KiB
Text
53 lines
1.1 KiB
Text
# vim:syntax=apparmor
|
|
|
|
#include <tunables/global>
|
|
|
|
profile dhcpcd /{usr/,}bin/dhcpcd {
|
|
#include <abstractions/base>
|
|
#include <abstractions/nameservice>
|
|
|
|
capability chown,
|
|
capability net_admin,
|
|
capability net_raw,
|
|
capability sys_admin,
|
|
|
|
network packet dgram,
|
|
network inet raw,
|
|
network inet6 raw,
|
|
|
|
/dev/pts/* rw,
|
|
|
|
/etc/dhcpcd.{conf,duid,secret} r,
|
|
/etc/ld.so.cache r,
|
|
/etc/udev/udev.conf r,
|
|
|
|
/proc/*/net/if_inet6 r,
|
|
/proc/sys/net/ipv{4,6}/conf/*/* rw,
|
|
|
|
/{var/,}run/dhcpcd{-*,}.pid rwk,
|
|
/{var/,}run/dhcpcd.sock rw,
|
|
/{var/,}run/dhcpcd.unpriv.sock rw,
|
|
/{var/,}run/udev/data/* r,
|
|
|
|
/sys/devices/**/net/*/uevent r,
|
|
|
|
/{usr/,}bin/dash ix,
|
|
/{usr/,}bin/dash mrix,
|
|
|
|
/usr/lib/dhcpcd/dev/udev.so m,
|
|
/usr/lib/ld-*.so m,
|
|
/usr/lib/libc-*.so m,
|
|
|
|
# Trust hooks and run the wrapper unconfined
|
|
/usr/libexec/dhcpcd-run-hooks CUx,
|
|
|
|
/var/db/dhcpcd-*.lease rw,
|
|
/var/db/dhcpcd/** rw,
|
|
/{usr/,}bin/dhcpcd mrix,
|
|
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
owner @{PROC}/@{pid}/stat r,
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
#include <local/usr.bin.dhcpcd>
|
|
}
|