mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

profiles/apparmor.d: add mosquitto profile

Browse Source 
Signed-off-by: vyomydv <vyom.yadav@canonical.com>
This commit is contained in:
vyomydv 2025-01-27 17:43:17 +05:30
parent 8e586e5492
commit 532d4be050
No known key found for this signature in database
GPG Key ID: BB05ADC4298B2829
1 changed files with 54 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
profiles/apparmor.d/mosquitto Normal file
View File

@ -0,0 +1,54 @@
#------------------------------------------------------------------
# Copyright (C) 2025 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#------------------------------------------------------------------
# vim: ft=apparmor
#
abi <abi/4.0>,
include <tunables/global>
profile mosquitto /usr/sbin/mosquitto {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/hosts_access>
# If run as a root user, drop privileges to mosquitto/nobody/custom-user
capability setgid,
capability setuid,
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
network netlink raw,
file @{run}/.nscd_socket rw,
file @{run}/nscd/socket rw,
# nss can be configured to use libvirt in host resolution
file /var/lib/libvirt/dnsmasq/ r,
file /var/lib/libvirt/dnsmasq/*.status r,
file @{run}/systemd/notify w,
file /usr/sbin/mosquitto mr,
file @{run}/mosquitto/mosquitto.pid rw,
file @{etc_ro}/mosquitto/* r,
file @{etc_ro}/mosquitto/conf.d/ r,
file @{etc_ro}/mosquitto/conf.d/** r,
file @{etc_ro}/mosquitto/mosquitto.conf r,
file @{etc_ro}/mosquitto/ca_certificates/** r,
file @{etc_ro}/mosquitto/certs/** r,
file /var/lib/mosquitto/mosquitto.db rwk,
file /var/lib/mosquitto/mosquitto.db.new rwk,
file /var/log/mosquitto/mosquitto.log w,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/mosquitto>
}