mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

cupsd: convert profile to @etc_ro/rw

Browse Source 
While cups itself writes to /etc the others require only read-only access
and might therefore live in /usr/etc.

(cherry picked from commit c3af6228fdf808c5013c27239c9ac73e2d6a355f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Jörg Sommer 2024-12-31 09:59:44 +01:00 committed by John Johansen
parent c456101ebb
commit 2aa7fe4659
1 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
profiles/apparmor/profiles/extras/usr.sbin.cupsd
View File

@ -23,28 +23,28 @@ include <tunables/global>
/{usr/,}bin/cat ix, /{usr/,}bin/cat ix,
/usr/bin/foomatic-rip ixr, /usr/bin/foomatic-rip ixr,
/etc/foomatic/** r, @{etc_ro}/foomatic/** r,
/usr/bin/gs ix, /usr/bin/gs ix,
/usr/lib/ghostscript/** m, /usr/lib/ghostscript/** m,
/usr/lib64/ghostscript/** m, /usr/lib64/ghostscript/** m,
/usr/share/ghostscript/** r, /usr/share/ghostscript/** r,
/etc/ghostscript/** r, @{etc_ro}/ghostscript/** r,
/dev/lp0 rw, /dev/lp0 rw,
/dev/tty rw, /dev/tty rw,
/dev/ttyS? w, /dev/ttyS? w,
/etc/cups rw, @{etc_rw}/cups rw,
/etc/cups/ r, @{etc_rw}/cups/ r,
/etc/cups/** r, @{etc_rw}/cups/** r,
/etc/cups/certs w, @{etc_rw}/cups/certs w,
/etc/cups/certs/* w, @{etc_rw}/cups/certs/* w,
/etc/cups/*.conf* rw, @{etc_rw}/cups/*.conf* rw,
/etc/cups/ppd rw, @{etc_rw}/cups/ppd rw,
/etc/printcap rw, @{etc_rw}/printcap rw,
/etc/cups/printcap rw, @{etc_rw}/cups/printcap rw,
/etc/cups/ssl rw, @{etc_rw}/cups/ssl rw,
/etc/cups/yes/* rw, @{etc_rw}/cups/yes/* rw,
@{PROC}/meminfo r, @{PROC}/meminfo r,
@{PROC}/sys/dev/parport/** r, @{PROC}/sys/dev/parport/** r,
/sys/class/usb r, /sys/class/usb r,
@ -65,7 +65,7 @@ include <tunables/global>
/var/cache/cups/ rw, /var/cache/cups/ rw,
/var/cache/cups/** rw, /var/cache/cups/** rw,
/etc/paperspecs r, @{etc_ro}/paperspecs r,
# Site-specific additions and overrides. See local/README for details. # Site-specific additions and overrides. See local/README for details.
include if exists <local/usr.sbin.cupsd> include if exists <local/usr.sbin.cupsd>