diff --git a/profiles/apparmor/profiles/extras/bin.netstat b/profiles/apparmor/profiles/extras/bin.netstat index 8ea2243f7..fd8d15606 100644 --- a/profiles/apparmor/profiles/extras/bin.netstat +++ b/profiles/apparmor/profiles/extras/bin.netstat @@ -15,12 +15,12 @@ abi , -#include +include profile netstat /{usr/,}bin/netstat { - #include - #include - #include + include + include + include capability dac_override, capability dac_read_search, diff --git a/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate b/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate index 08dc9e03f..7ba4b38ea 100644 --- a/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate +++ b/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate @@ -13,12 +13,12 @@ abi , -#include +include /etc/cron.daily/logrotate { - #include - #include - #include + include + include + include capability chown, capability dac_override, diff --git a/profiles/apparmor/profiles/extras/etc.cron.daily.slocate.cron b/profiles/apparmor/profiles/extras/etc.cron.daily.slocate.cron index 4a8f2742a..2b551dfdf 100644 --- a/profiles/apparmor/profiles/extras/etc.cron.daily.slocate.cron +++ b/profiles/apparmor/profiles/extras/etc.cron.daily.slocate.cron @@ -14,10 +14,10 @@ abi , -#include +include /etc/cron.daily/slocate.cron { - #include + include /{usr/,}bin/bash mixr, /dev/tty wr , /etc/cron.daily/slocate.cron r , diff --git a/profiles/apparmor/profiles/extras/etc.cron.daily.tmpwatch b/profiles/apparmor/profiles/extras/etc.cron.daily.tmpwatch index eea0135d9..fa0b95617 100644 --- a/profiles/apparmor/profiles/extras/etc.cron.daily.tmpwatch +++ b/profiles/apparmor/profiles/extras/etc.cron.daily.tmpwatch @@ -10,10 +10,10 @@ abi , -#include +include /etc/cron.daily/tmpwatch { - #include + include /etc/cron.daily/tmpwatch r, /tmp r, /tmp/** rwl, diff --git a/profiles/apparmor/profiles/extras/postfix.anvil b/profiles/apparmor/profiles/extras/postfix.anvil index f0d81f64a..2aec87286 100644 --- a/profiles/apparmor/profiles/extras/postfix.anvil +++ b/profiles/apparmor/profiles/extras/postfix.anvil @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-anvil /usr/lib/postfix/{bin/,sbin/,}anvil { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}anvil mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.bounce b/profiles/apparmor/profiles/extras/postfix.bounce index 22171f762..f23f19724 100644 --- a/profiles/apparmor/profiles/extras/postfix.bounce +++ b/profiles/apparmor/profiles/extras/postfix.bounce @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-bounce /usr/lib/postfix/{bin/,sbin/,}bounce { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}bounce mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.cleanup b/profiles/apparmor/profiles/extras/postfix.cleanup index 1821c5b8d..e277f14cc 100644 --- a/profiles/apparmor/profiles/extras/postfix.cleanup +++ b/profiles/apparmor/profiles/extras/postfix.cleanup @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-cleanup /usr/lib/postfix/{bin/,sbin/,}cleanup { - #include - #include - #include + include + include + include capability net_bind_service, capability dac_read_search, diff --git a/profiles/apparmor/profiles/extras/postfix.discard b/profiles/apparmor/profiles/extras/postfix.discard index 4f3ffc413..fbfe784f8 100644 --- a/profiles/apparmor/profiles/extras/postfix.discard +++ b/profiles/apparmor/profiles/extras/postfix.discard @@ -12,10 +12,10 @@ abi , -#include +include profile postfix-discard /usr/lib/postfix/{bin/,sbin/,}discard { - #include + include /usr/lib/postfix/{bin/,sbin/,}discard mrix, } diff --git a/profiles/apparmor/profiles/extras/postfix.dnsblog b/profiles/apparmor/profiles/extras/postfix.dnsblog index 95d079305..f8ce329b1 100644 --- a/profiles/apparmor/profiles/extras/postfix.dnsblog +++ b/profiles/apparmor/profiles/extras/postfix.dnsblog @@ -11,10 +11,10 @@ abi , -#include +include profile postfix-dnsblog /usr/lib/postfix/{bin/,sbin/,}dnsblog { - #include + include /usr/lib/postfix/{bin/,sbin/,}dnsblog mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.error b/profiles/apparmor/profiles/extras/postfix.error index a53522009..4719f8973 100644 --- a/profiles/apparmor/profiles/extras/postfix.error +++ b/profiles/apparmor/profiles/extras/postfix.error @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-error /usr/lib/postfix/{bin/,sbin/,}error { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}error mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.flush b/profiles/apparmor/profiles/extras/postfix.flush index 734ea6e7a..f4f67ad4d 100644 --- a/profiles/apparmor/profiles/extras/postfix.flush +++ b/profiles/apparmor/profiles/extras/postfix.flush @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-flush /usr/lib/postfix/{bin/,sbin/,}flush { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}flush mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.lmtp b/profiles/apparmor/profiles/extras/postfix.lmtp index 255e421ab..d133d6459 100644 --- a/profiles/apparmor/profiles/extras/postfix.lmtp +++ b/profiles/apparmor/profiles/extras/postfix.lmtp @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-lmtp /usr/lib/postfix/{bin/,sbin/,}lmtp { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}lmtp mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.local b/profiles/apparmor/profiles/extras/postfix.local index 2d60c22a6..f5647784a 100644 --- a/profiles/apparmor/profiles/extras/postfix.local +++ b/profiles/apparmor/profiles/extras/postfix.local @@ -11,14 +11,14 @@ abi , -#include +include profile postfix-local /usr/lib/postfix/{bin/,sbin/,}local { - #include - #include - #include - #include - #include + include + include + include + include + include /usr/bin/procmail Px, diff --git a/profiles/apparmor/profiles/extras/postfix.master b/profiles/apparmor/profiles/extras/postfix.master index 4614901a8..5951c98d3 100644 --- a/profiles/apparmor/profiles/extras/postfix.master +++ b/profiles/apparmor/profiles/extras/postfix.master @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-master /usr/lib/postfix/{bin/,sbin/,}master { - #include - #include - #include + include + include + include capability net_bind_service, capability kill, diff --git a/profiles/apparmor/profiles/extras/postfix.nqmgr b/profiles/apparmor/profiles/extras/postfix.nqmgr index f750472f4..717c9add6 100644 --- a/profiles/apparmor/profiles/extras/postfix.nqmgr +++ b/profiles/apparmor/profiles/extras/postfix.nqmgr @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-nqmgr /usr/lib/postfix/{bin/,sbin/,}nqmgr { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}nqmgr mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.oqmgr b/profiles/apparmor/profiles/extras/postfix.oqmgr index 4664c306e..625e92966 100644 --- a/profiles/apparmor/profiles/extras/postfix.oqmgr +++ b/profiles/apparmor/profiles/extras/postfix.oqmgr @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-oqmgr /usr/lib/postfix/{bin/,sbin/,}oqmgr { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}oqmgr mrix, } diff --git a/profiles/apparmor/profiles/extras/postfix.pickup b/profiles/apparmor/profiles/extras/postfix.pickup index ea698074b..33b1e5ca0 100644 --- a/profiles/apparmor/profiles/extras/postfix.pickup +++ b/profiles/apparmor/profiles/extras/postfix.pickup @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-pickup /usr/lib/postfix/{bin/,sbin/,}pickup { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}pickup mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.pipe b/profiles/apparmor/profiles/extras/postfix.pipe index 3749a596e..dbc0867f5 100644 --- a/profiles/apparmor/profiles/extras/postfix.pipe +++ b/profiles/apparmor/profiles/extras/postfix.pipe @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-pipe /usr/lib/postfix/{bin/,sbin/,}pipe { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}pipe mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.postscreen b/profiles/apparmor/profiles/extras/postfix.postscreen index 19157a84f..46d9c0558 100644 --- a/profiles/apparmor/profiles/extras/postfix.postscreen +++ b/profiles/apparmor/profiles/extras/postfix.postscreen @@ -10,10 +10,10 @@ abi , -#include +include profile postfix-postscreen /usr/lib/postfix/{bin/,sbin/,}postscreen { - #include + include /usr/lib/postfix/{bin/,sbin/,}postscreen mrix, } diff --git a/profiles/apparmor/profiles/extras/postfix.proxymap b/profiles/apparmor/profiles/extras/postfix.proxymap index 5ca505278..b3b44e076 100644 --- a/profiles/apparmor/profiles/extras/postfix.proxymap +++ b/profiles/apparmor/profiles/extras/postfix.proxymap @@ -12,13 +12,13 @@ abi , -#include +include profile postfix-proxymap /usr/lib/postfix/{bin/,sbin/,}proxymap { - #include - #include - #include - #include + include + include + include + include /etc/my.cnf r, /usr/lib/postfix/{bin/,sbin/,}proxymap mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.qmgr b/profiles/apparmor/profiles/extras/postfix.qmgr index ade06e9dd..d6092a36a 100644 --- a/profiles/apparmor/profiles/extras/postfix.qmgr +++ b/profiles/apparmor/profiles/extras/postfix.qmgr @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-qmgr /usr/lib/postfix/{bin/,sbin/,}qmgr { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}qmgr mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.qmqpd b/profiles/apparmor/profiles/extras/postfix.qmqpd index 7a06de968..ecd64cab5 100644 --- a/profiles/apparmor/profiles/extras/postfix.qmqpd +++ b/profiles/apparmor/profiles/extras/postfix.qmqpd @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-qmqpd /usr/lib/postfix/{bin/,sbin/,}qmqpd { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}qmqpd mrix, } diff --git a/profiles/apparmor/profiles/extras/postfix.scache b/profiles/apparmor/profiles/extras/postfix.scache index 72cb8e3ff..a584f837e 100644 --- a/profiles/apparmor/profiles/extras/postfix.scache +++ b/profiles/apparmor/profiles/extras/postfix.scache @@ -13,12 +13,12 @@ abi , -#include +include profile postfix-scache /usr/lib/postfix/{bin/,sbin/,}scache { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}scache mrix, } diff --git a/profiles/apparmor/profiles/extras/postfix.showq b/profiles/apparmor/profiles/extras/postfix.showq index 255674fa4..91f8735fc 100644 --- a/profiles/apparmor/profiles/extras/postfix.showq +++ b/profiles/apparmor/profiles/extras/postfix.showq @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-showq /usr/lib/postfix/{bin/,sbin/,}showq { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}showq mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.smtp b/profiles/apparmor/profiles/extras/postfix.smtp index c5ec29082..c9e5b91a9 100644 --- a/profiles/apparmor/profiles/extras/postfix.smtp +++ b/profiles/apparmor/profiles/extras/postfix.smtp @@ -12,13 +12,13 @@ abi , -#include +include profile postfix-smtp /usr/lib/postfix/{bin/,sbin/,}smtp { - #include - #include - #include - #include + include + include + include + include capability dac_override, capability dac_read_search, diff --git a/profiles/apparmor/profiles/extras/postfix.smtpd b/profiles/apparmor/profiles/extras/postfix.smtpd index 7cb605b6f..95ec61f06 100644 --- a/profiles/apparmor/profiles/extras/postfix.smtpd +++ b/profiles/apparmor/profiles/extras/postfix.smtpd @@ -12,15 +12,15 @@ abi , -#include +include profile postfix-smtpd /usr/lib/postfix/{bin/,sbin/,}smtpd { - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include capability dac_override, capability dac_read_search, diff --git a/profiles/apparmor/profiles/extras/postfix.spawn b/profiles/apparmor/profiles/extras/postfix.spawn index 8bf34d706..86db87f21 100644 --- a/profiles/apparmor/profiles/extras/postfix.spawn +++ b/profiles/apparmor/profiles/extras/postfix.spawn @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-spawn /usr/lib/postfix/{bin/,sbin/,}spawn { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}spawn mrix, } diff --git a/profiles/apparmor/profiles/extras/postfix.tlsmgr b/profiles/apparmor/profiles/extras/postfix.tlsmgr index 376fde554..743391e2c 100644 --- a/profiles/apparmor/profiles/extras/postfix.tlsmgr +++ b/profiles/apparmor/profiles/extras/postfix.tlsmgr @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-tlsmgr /usr/lib/postfix/{bin/,sbin/,}tlsmgr { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}tlsmgr mrix, diff --git a/profiles/apparmor/profiles/extras/postfix.trivial-rewrite b/profiles/apparmor/profiles/extras/postfix.trivial-rewrite index c754330cf..5624ca0a5 100644 --- a/profiles/apparmor/profiles/extras/postfix.trivial-rewrite +++ b/profiles/apparmor/profiles/extras/postfix.trivial-rewrite @@ -12,12 +12,12 @@ abi , -#include +include profile postfix-trivial-rewrite /usr/lib/postfix/{bin/,sbin/,}trivial-rewrite { - #include - #include - #include + include + include + include capability dac_read_search, diff --git a/profiles/apparmor/profiles/extras/postfix.verify b/profiles/apparmor/profiles/extras/postfix.verify index 8b5cfd58b..d7d629d1d 100644 --- a/profiles/apparmor/profiles/extras/postfix.verify +++ b/profiles/apparmor/profiles/extras/postfix.verify @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-verify /usr/lib/postfix/{bin/,sbin/,}verify { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}verify mrix, } diff --git a/profiles/apparmor/profiles/extras/postfix.virtual b/profiles/apparmor/profiles/extras/postfix.virtual index a78798efd..d477f1d4e 100644 --- a/profiles/apparmor/profiles/extras/postfix.virtual +++ b/profiles/apparmor/profiles/extras/postfix.virtual @@ -11,12 +11,12 @@ abi , -#include +include profile postfix-virtual /usr/lib/postfix/{bin/,sbin/,}virtual { - #include - #include - #include + include + include + include /usr/lib/postfix/{bin/,sbin/,}virtual mrix, diff --git a/profiles/apparmor/profiles/extras/sbin.dhclient b/profiles/apparmor/profiles/extras/sbin.dhclient index acf98d6a2..0abeb5ee7 100644 --- a/profiles/apparmor/profiles/extras/sbin.dhclient +++ b/profiles/apparmor/profiles/extras/sbin.dhclient @@ -21,12 +21,12 @@ abi , -#include +include profile dhclient /{usr/,}sbin/dhclient { - #include - #include - #include + include + include + include capability net_raw, diff --git a/profiles/apparmor/profiles/extras/sbin.dhclient-script b/profiles/apparmor/profiles/extras/sbin.dhclient-script index cabadb944..637ab8ffc 100644 --- a/profiles/apparmor/profiles/extras/sbin.dhclient-script +++ b/profiles/apparmor/profiles/extras/sbin.dhclient-script @@ -2,15 +2,15 @@ abi , -#include +include # dhclient-script will call plugins from /etc/netconfig.d, so this # will need to be extended on a per-site basis. profile dhclient-script /{usr/,}sbin/dhclient-script { - #include - #include - #include + include + include + include /{usr/,}bin/bash rix, /{usr/,}bin/grep rix, diff --git a/profiles/apparmor/profiles/extras/sbin.dhcpcd b/profiles/apparmor/profiles/extras/sbin.dhcpcd index 8b5678bf7..53b3b3567 100644 --- a/profiles/apparmor/profiles/extras/sbin.dhcpcd +++ b/profiles/apparmor/profiles/extras/sbin.dhcpcd @@ -18,11 +18,11 @@ abi , -#include +include profile dhcpcd /{usr/,}sbin/dhcpcd { - #include - #include + include + include capability net_raw, capability net_admin, diff --git a/profiles/apparmor/profiles/extras/sbin.portmap b/profiles/apparmor/profiles/extras/sbin.portmap index c081d9fa8..3ffb56819 100644 --- a/profiles/apparmor/profiles/extras/sbin.portmap +++ b/profiles/apparmor/profiles/extras/sbin.portmap @@ -10,11 +10,11 @@ abi , -#include +include profile portmap /{usr/,}sbin/portmap { - #include - #include + include + include capability net_bind_service, capability setuid, diff --git a/profiles/apparmor/profiles/extras/sbin.resmgrd b/profiles/apparmor/profiles/extras/sbin.resmgrd index ba0aa0ab5..c794cacae 100644 --- a/profiles/apparmor/profiles/extras/sbin.resmgrd +++ b/profiles/apparmor/profiles/extras/sbin.resmgrd @@ -12,11 +12,11 @@ abi , -#include +include profile resmgrd /{usr/,}sbin/resmgrd { - #include - #include + include + include capability fowner, capability chown, diff --git a/profiles/apparmor/profiles/extras/sbin.rpc.lockd b/profiles/apparmor/profiles/extras/sbin.rpc.lockd index 9c95dfad6..8a198a279 100644 --- a/profiles/apparmor/profiles/extras/sbin.rpc.lockd +++ b/profiles/apparmor/profiles/extras/sbin.rpc.lockd @@ -10,9 +10,9 @@ abi , -#include +include profile rpc.lockd /{usr/,}sbin/rpc.lockd { - #include + include /{usr/,}sbin/rpc.lockd rmix, } diff --git a/profiles/apparmor/profiles/extras/sbin.rpc.statd b/profiles/apparmor/profiles/extras/sbin.rpc.statd index 96a6b4691..dcef0872b 100644 --- a/profiles/apparmor/profiles/extras/sbin.rpc.statd +++ b/profiles/apparmor/profiles/extras/sbin.rpc.statd @@ -10,11 +10,11 @@ abi , -#include +include profile rpc.statd /{usr/,}sbin/rpc.statd { - #include - #include + include + include # needed to sanely drop privileges capability setgid, diff --git a/profiles/apparmor/profiles/extras/usr.NX.bin.nxclient b/profiles/apparmor/profiles/extras/usr.NX.bin.nxclient index e196a71b5..1173b8d06 100644 --- a/profiles/apparmor/profiles/extras/usr.NX.bin.nxclient +++ b/profiles/apparmor/profiles/extras/usr.NX.bin.nxclient @@ -11,15 +11,15 @@ abi , -#include +include /usr/NX/bin/nxclient { - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include /{usr/,}bin/bash mix, /usr/bin/cut mix, diff --git a/profiles/apparmor/profiles/extras/usr.bin.acroread b/profiles/apparmor/profiles/extras/usr.bin.acroread index 91d5cd048..f24f0a64a 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.acroread +++ b/profiles/apparmor/profiles/extras/usr.bin.acroread @@ -12,17 +12,17 @@ abi , -#include +include /usr/X11R6/bin/acroread { - #include - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include + include capability dac_override, diff --git a/profiles/apparmor/profiles/extras/usr.bin.apropos b/profiles/apparmor/profiles/extras/usr.bin.apropos index d6277fc66..292cd6de9 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.apropos +++ b/profiles/apparmor/profiles/extras/usr.bin.apropos @@ -10,12 +10,12 @@ abi , -#include +include /usr/bin/apropos { - #include - #include - #include + include + include + include /{usr/,}bin/basename mixr, /{usr/,}bin/bash mixr, /{usr/,}bin/grep mixr, diff --git a/profiles/apparmor/profiles/extras/usr.bin.dumpcap b/profiles/apparmor/profiles/extras/usr.bin.dumpcap index 91211b438..556f3d9f1 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.dumpcap +++ b/profiles/apparmor/profiles/extras/usr.bin.dumpcap @@ -2,11 +2,11 @@ abi , -#include +include /usr/bin/dumpcap { - #include - #include + include + include capability net_admin, capability net_raw, diff --git a/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10 b/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10 index 58b3717aa..48c11bf95 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10 +++ b/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10 @@ -40,19 +40,19 @@ abi , -#include +include /usr/bin/evolution-2.10 { - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include + include + include + include capability ipc_lock, capability setuid, diff --git a/profiles/apparmor/profiles/extras/usr.bin.fam b/profiles/apparmor/profiles/extras/usr.bin.fam index a2fdc5e1a..8b8385ac0 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.fam +++ b/profiles/apparmor/profiles/extras/usr.bin.fam @@ -10,11 +10,11 @@ abi , -#include +include /usr/bin/fam { - #include - #include + include + include /tmp/.fam* wl, /etc/mtab rw, /usr/bin/fam rmix, diff --git a/profiles/apparmor/profiles/extras/usr.bin.freshclam b/profiles/apparmor/profiles/extras/usr.bin.freshclam index 95aa917ef..d0bf30b74 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.freshclam +++ b/profiles/apparmor/profiles/extras/usr.bin.freshclam @@ -11,12 +11,12 @@ abi , -#include +include /usr/bin/freshclam { - #include - #include - #include + include + include + include capability setgid, capability setuid, diff --git a/profiles/apparmor/profiles/extras/usr.bin.gaim b/profiles/apparmor/profiles/extras/usr.bin.gaim index 2d8873f41..e5ae3ef11 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.gaim +++ b/profiles/apparmor/profiles/extras/usr.bin.gaim @@ -12,18 +12,18 @@ abi , -#include +include /usr/bin/gaim { - #include - #include - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include + include + include /{usr/,}bin/bash mixr, /dev/random r, diff --git a/profiles/apparmor/profiles/extras/usr.bin.man b/profiles/apparmor/profiles/extras/usr.bin.man index 37f8991c4..4dcc19c2c 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.man +++ b/profiles/apparmor/profiles/extras/usr.bin.man @@ -14,11 +14,11 @@ abi , -#include +include /usr/bin/man { - #include - #include + include + include capability setgid, capability setuid, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-bounce b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-bounce index bd86b419b..a562dfe23 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-bounce +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-bounce @@ -12,10 +12,10 @@ abi , -#include +include /usr/bin/mlmmj-bounce { - #include + include /usr/bin/mlmmj-bounce mr, /usr/bin/mlmmj-send Px, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-maintd b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-maintd index 6d7e93dd8..366d074f8 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-maintd +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-maintd @@ -12,10 +12,10 @@ abi , -#include +include /usr/bin/mlmmj-maintd { - #include + include capability setuid, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-make-ml.sh b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-make-ml.sh index b70fa4bc5..bbdd0e721 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-make-ml.sh +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-make-ml.sh @@ -11,13 +11,13 @@ abi , -#include +include /usr/bin/mlmmj-make-ml.sh { - #include - #include - #include - #include + include + include + include + include capability sys_admin, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-process b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-process index 2513acb8b..7a9a6ff1c 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-process +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-process @@ -12,10 +12,10 @@ abi , -#include +include /usr/bin/mlmmj-process { - #include + include /usr/bin/mlmmj-process mr, /usr/bin/mlmmj-send Px, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-receive b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-receive index 076bc28b0..a0742b476 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-receive +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-receive @@ -12,10 +12,10 @@ abi , -#include +include /usr/bin/mlmmj-receive { - #include + include /usr/bin/mlmmj-process Px, /usr/bin/mlmmj-receive mr, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-recieve b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-recieve index 05960cfb4..ebce17d77 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-recieve +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-recieve @@ -15,10 +15,10 @@ abi , -#include +include /usr/bin/mlmmj-recieve { - #include + include /usr/bin/mlmmj-process Px, /usr/bin/mlmmj-recieve mr, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-send b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-send index 8eeaf15be..4ffb9d715 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-send +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-send @@ -12,11 +12,11 @@ abi , -#include +include /usr/bin/mlmmj-send { - #include - #include + include + include /usr/bin/mlmmj-send mr, /var/spool/mlmmj/*/archive/* w, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-sub b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-sub index 5b0745ff5..ed6a64f94 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-sub +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-sub @@ -12,10 +12,10 @@ abi , -#include +include /usr/bin/mlmmj-sub { - #include + include capability setuid, diff --git a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-unsub b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-unsub index e0ad69f46..88fa6b152 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-unsub +++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-unsub @@ -12,10 +12,10 @@ abi , -#include +include /usr/bin/mlmmj-unsub { - #include + include /usr/bin/mlmmj-unsub mr, /usr/bin/mlmmj-send Px, diff --git a/profiles/apparmor/profiles/extras/usr.bin.opera b/profiles/apparmor/profiles/extras/usr.bin.opera index ebfac0772..324bc8d30 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.opera +++ b/profiles/apparmor/profiles/extras/usr.bin.opera @@ -11,16 +11,16 @@ abi , -#include +include /usr/bin/opera { - #include - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include + include capability dac_override, diff --git a/profiles/apparmor/profiles/extras/usr.bin.passwd b/profiles/apparmor/profiles/extras/usr.bin.passwd index e6e269e70..d28d8be0e 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.passwd +++ b/profiles/apparmor/profiles/extras/usr.bin.passwd @@ -11,14 +11,14 @@ abi , -#include +include /usr/bin/passwd { - #include - #include - #include - #include - #include + include + include + include + include + include capability chown, capability sys_resource, diff --git a/profiles/apparmor/profiles/extras/usr.bin.procmail b/profiles/apparmor/profiles/extras/usr.bin.procmail index 5f0af871e..a9219682c 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.procmail +++ b/profiles/apparmor/profiles/extras/usr.bin.procmail @@ -10,13 +10,13 @@ abi , -#include +include /usr/bin/procmail { - #include - #include - #include - #include + include + include + include + include # procmail configuration /etc/procmailrc r, diff --git a/profiles/apparmor/profiles/extras/usr.bin.skype b/profiles/apparmor/profiles/extras/usr.bin.skype index 81c65cb1c..dce23e344 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.skype +++ b/profiles/apparmor/profiles/extras/usr.bin.skype @@ -5,21 +5,21 @@ abi , -#include +include /usr/bin/skype flags=(complain) { - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include + include + include + include + include + include + include @{PROC}/sys/kernel/{ostype,osrelease} r, @{PROC}/@{pid}/net/arp r, diff --git a/profiles/apparmor/profiles/extras/usr.bin.spamc b/profiles/apparmor/profiles/extras/usr.bin.spamc index 56d098d72..e51ba8e2a 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.spamc +++ b/profiles/apparmor/profiles/extras/usr.bin.spamc @@ -12,11 +12,11 @@ abi , -#include +include /usr/bin/spamc { - #include - #include + include + include /usr/bin/spamc r, } diff --git a/profiles/apparmor/profiles/extras/usr.bin.svnserve b/profiles/apparmor/profiles/extras/usr.bin.svnserve index d803b4b43..9aa7868d3 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.svnserve +++ b/profiles/apparmor/profiles/extras/usr.bin.svnserve @@ -10,11 +10,11 @@ abi , -#include +include /usr/bin/svnserve { - #include - #include + include + include # network service ;) capability net_bind_service, diff --git a/profiles/apparmor/profiles/extras/usr.bin.wireshark b/profiles/apparmor/profiles/extras/usr.bin.wireshark index e45799fa8..a835afb34 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.wireshark +++ b/profiles/apparmor/profiles/extras/usr.bin.wireshark @@ -12,24 +12,24 @@ abi , -#include +include /usr/bin/wireshark { - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include + include + include + include + include signal (send) peer=/usr/bin/dumpcap, - #include + include dbus (send) bus=session peer=(name=org.a11y.Bus), diff --git a/profiles/apparmor/profiles/extras/usr.bin.xfs b/profiles/apparmor/profiles/extras/usr.bin.xfs index e0c787ac8..17b9d06ba 100644 --- a/profiles/apparmor/profiles/extras/usr.bin.xfs +++ b/profiles/apparmor/profiles/extras/usr.bin.xfs @@ -10,11 +10,11 @@ abi , -#include +include /usr/bin/xfs { - #include - #include + include + include / r, /dev/tty wr, diff --git a/profiles/apparmor/profiles/extras/usr.lib.GConf.2.gconfd-2 b/profiles/apparmor/profiles/extras/usr.lib.GConf.2.gconfd-2 index e2a28ded2..02ffdb4be 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.GConf.2.gconfd-2 +++ b/profiles/apparmor/profiles/extras/usr.lib.GConf.2.gconfd-2 @@ -12,12 +12,12 @@ abi , -#include +include /usr/lib/GConf/2/gconfd-2 { - #include - #include - #include + include + include + include /etc/gconf/2/path r, /etc/gconf/gconf.xml.defaults r, diff --git a/profiles/apparmor/profiles/extras/usr.lib.RealPlayer10.realplay b/profiles/apparmor/profiles/extras/usr.lib.RealPlayer10.realplay index 8a7bdd01e..a2de723a4 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.RealPlayer10.realplay +++ b/profiles/apparmor/profiles/extras/usr.lib.RealPlayer10.realplay @@ -12,18 +12,18 @@ abi , -#include +include /usr/lib/RealPlayer10/realplay { - #include - #include - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include + include + include /{usr/,}bin/bash mix, /{usr/,}bin/sed mixr, diff --git a/profiles/apparmor/profiles/extras/usr.lib.bonobo.bonobo-activation-server b/profiles/apparmor/profiles/extras/usr.lib.bonobo.bonobo-activation-server index 7cacb2def..e09c0b945 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.bonobo.bonobo-activation-server +++ b/profiles/apparmor/profiles/extras/usr.lib.bonobo.bonobo-activation-server @@ -12,12 +12,12 @@ abi , -#include +include /usr/lib/bonobo/bonobo-activation-server { - #include - #include - #include + include + include + include /etc/bonobo-activation/bonobo-activation-config.xml r, /usr/lib/bonobo/bonobo-activation-server rmix, diff --git a/profiles/apparmor/profiles/extras/usr.lib.evolution-data-server.evolution-data-server-1.10 b/profiles/apparmor/profiles/extras/usr.lib.evolution-data-server.evolution-data-server-1.10 index 938f5ca86..a649fe531 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.evolution-data-server.evolution-data-server-1.10 +++ b/profiles/apparmor/profiles/extras/usr.lib.evolution-data-server.evolution-data-server-1.10 @@ -12,12 +12,12 @@ abi , -#include +include /usr/lib/evolution-data-server/evolution-data-server-1.10 { - #include - #include - #include + include + include + include /etc/mtab r, /etc/** r, diff --git a/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox b/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox index 96eba9124..cecf634d7 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox +++ b/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox @@ -11,7 +11,7 @@ abi , -#include +include # We want to confine the binaries that match: # /usr/lib/firefox-4.0b8/firefox @@ -19,13 +19,13 @@ abi , # but not: # /usr/lib/firefox-4.0b8/firefox.sh /usr/lib/firefox{,-[0-9]*}/firefox{,*[^s][^h]} { - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include # for networking network inet stream, diff --git a/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox.sh b/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox.sh index bb12c3aa8..95a7a7de4 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox.sh +++ b/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox.sh @@ -2,12 +2,12 @@ abi , -#include +include /usr/lib/firefox/firefox.sh { - #include - #include - #include + include + include + include deny capability sys_ptrace, diff --git a/profiles/apparmor/profiles/extras/usr.lib.firefox.mozilla-xremote-client b/profiles/apparmor/profiles/extras/usr.lib.firefox.mozilla-xremote-client index 7e4346e27..bb8ca311f 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.firefox.mozilla-xremote-client +++ b/profiles/apparmor/profiles/extras/usr.lib.firefox.mozilla-xremote-client @@ -12,11 +12,11 @@ abi , -#include +include /usr/lib/firefox/mozilla-xremote-client { - #include - #include + include + include /usr/lib/mozilla/lib*so* mr, /usr/lib/firefox/mozilla-xremote-client rmix, diff --git a/profiles/apparmor/profiles/extras/usr.lib.man-db.man b/profiles/apparmor/profiles/extras/usr.lib.man-db.man index f37eaf6d8..1770359f7 100644 --- a/profiles/apparmor/profiles/extras/usr.lib.man-db.man +++ b/profiles/apparmor/profiles/extras/usr.lib.man-db.man @@ -11,13 +11,13 @@ abi , -#include +include /usr/lib/man-db/man { - #include - #include - #include - #include + include + include + include + include /{usr/,}bin/bash rmix, /{usr/,}bin/cat rmix, diff --git a/profiles/apparmor/profiles/extras/usr.lib64.GConf.2.gconfd-2 b/profiles/apparmor/profiles/extras/usr.lib64.GConf.2.gconfd-2 index c97900881..89925b059 100644 --- a/profiles/apparmor/profiles/extras/usr.lib64.GConf.2.gconfd-2 +++ b/profiles/apparmor/profiles/extras/usr.lib64.GConf.2.gconfd-2 @@ -12,12 +12,12 @@ abi , -#include +include /usr/lib64/GConf/2/gconfd-2 { - #include - #include - #include + include + include + include /etc/gconf/2/path r, /etc/gconf/gconf.xml.defaults r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.cupsd b/profiles/apparmor/profiles/extras/usr.sbin.cupsd index fe76dabd7..e381e0169 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.cupsd +++ b/profiles/apparmor/profiles/extras/usr.sbin.cupsd @@ -2,13 +2,13 @@ abi , -#include +include /usr/sbin/cupsd { - #include - #include - #include - #include - #include + include + include + include + include + include capability chown, capability dac_override, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.dhcpd b/profiles/apparmor/profiles/extras/usr.sbin.dhcpd index 471872ec1..13f210a5d 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.dhcpd +++ b/profiles/apparmor/profiles/extras/usr.sbin.dhcpd @@ -10,11 +10,11 @@ abi , -#include +include /usr/sbin/dhcpd { - #include - #include + include + include capability dac_override, capability net_bind_service, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork b/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork index 948190aa1..ada4f5634 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork +++ b/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork @@ -11,16 +11,16 @@ abi , -#include +include /usr/sbin/httpd2-prefork { - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include capability kill, capability net_bind_service, @@ -132,13 +132,13 @@ abi , ^HANDLING_UNTRUSTED_INPUT { - #include + include /var/log/apache2/* w, } ^DEFAULT_URI { - #include - #include + include + include # Note that mod_perl, mod_php, mod_python, etc, allows in-apache # execution of content regardless of 'x' permissions, as no exec(2) diff --git a/profiles/apparmor/profiles/extras/usr.sbin.imapd b/profiles/apparmor/profiles/extras/usr.sbin.imapd index d0e921206..0d21823d2 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.imapd +++ b/profiles/apparmor/profiles/extras/usr.sbin.imapd @@ -10,14 +10,14 @@ abi , -#include +include /usr/sbin/imapd { - #include - #include - #include - #include - #include + include + include + include + include + include /dev/urandom r, /tmp/* rwl, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.in.fingerd b/profiles/apparmor/profiles/extras/usr.sbin.in.fingerd index 81632b800..1bcb43b4b 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.in.fingerd +++ b/profiles/apparmor/profiles/extras/usr.sbin.in.fingerd @@ -10,11 +10,11 @@ abi , -#include +include /usr/sbin/in.fingerd { - #include - #include + include + include @{HOME}/.plan r, @{HOME}/.project r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.in.ftpd b/profiles/apparmor/profiles/extras/usr.sbin.in.ftpd index f1bd0a215..e39356dd2 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.in.ftpd +++ b/profiles/apparmor/profiles/extras/usr.sbin.in.ftpd @@ -10,12 +10,12 @@ abi , -#include +include /usr/sbin/in.ftpd { - #include - #include - #include + include + include + include / r, /dev/urandom r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.in.ntalkd b/profiles/apparmor/profiles/extras/usr.sbin.in.ntalkd index 74c8a6adf..7b454a76a 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.in.ntalkd +++ b/profiles/apparmor/profiles/extras/usr.sbin.in.ntalkd @@ -10,12 +10,12 @@ abi , -#include +include /usr/sbin/in.ntalkd { - #include - #include - #include + include + include + include /usr/sbin/in.ntalkd r, /{,var/}run/utmp r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.ipop2d b/profiles/apparmor/profiles/extras/usr.sbin.ipop2d index eb80c153a..c65c9c958 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.ipop2d +++ b/profiles/apparmor/profiles/extras/usr.sbin.ipop2d @@ -10,14 +10,14 @@ abi , -#include +include /usr/sbin/ipop2d { - #include - #include - #include - #include - #include + include + include + include + include + include /dev/urandom r , /tmp/.* rwl , diff --git a/profiles/apparmor/profiles/extras/usr.sbin.ipop3d b/profiles/apparmor/profiles/extras/usr.sbin.ipop3d index b52dc6602..ca6348f5c 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.ipop3d +++ b/profiles/apparmor/profiles/extras/usr.sbin.ipop3d @@ -10,14 +10,14 @@ abi , -#include +include /usr/sbin/ipop3d { - #include - #include - #include - #include - #include + include + include + include + include + include /dev/urandom r , /tmp/.* rwl , diff --git a/profiles/apparmor/profiles/extras/usr.sbin.lighttpd b/profiles/apparmor/profiles/extras/usr.sbin.lighttpd index 0bf98a4e0..af11fb5a9 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.lighttpd +++ b/profiles/apparmor/profiles/extras/usr.sbin.lighttpd @@ -11,13 +11,13 @@ abi , -#include +include /usr/sbin/lighttpd { - #include - #include - #include - #include + include + include + include + include # needed to change max file descriptors capability sys_resource, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.mysqld b/profiles/apparmor/profiles/extras/usr.sbin.mysqld index b5745c0d1..cd0801944 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.mysqld +++ b/profiles/apparmor/profiles/extras/usr.sbin.mysqld @@ -14,13 +14,13 @@ abi , -#include +include /usr/sbin/mysqld { - #include - #include - #include - #include + include + include + include + include capability dac_override, capability setgid, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.oidentd b/profiles/apparmor/profiles/extras/usr.sbin.oidentd index 334d96d3d..999cefefa 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.oidentd +++ b/profiles/apparmor/profiles/extras/usr.sbin.oidentd @@ -11,11 +11,11 @@ abi , -#include +include /usr/sbin/oidentd { - #include - #include + include + include capability net_bind_service, capability dac_override, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.popper b/profiles/apparmor/profiles/extras/usr.sbin.popper index c88c2ef23..3b2ef4c6e 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.popper +++ b/profiles/apparmor/profiles/extras/usr.sbin.popper @@ -12,13 +12,13 @@ abi , -#include +include /usr/sbin/popper { - #include - #include - #include - #include + include + include + include + include capability setgid, capability setuid, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.postalias b/profiles/apparmor/profiles/extras/usr.sbin.postalias index 7346ece1f..6b5f3ccdd 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.postalias +++ b/profiles/apparmor/profiles/extras/usr.sbin.postalias @@ -10,14 +10,14 @@ abi , -#include +include /usr/sbin/postalias { - #include - #include - #include - #include - #include + include + include + include + include + include /etc/aliases r, /etc/aliases.db rwlk, /etc/postfix r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.postdrop b/profiles/apparmor/profiles/extras/usr.sbin.postdrop index 22b0312c9..3b1706799 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.postdrop +++ b/profiles/apparmor/profiles/extras/usr.sbin.postdrop @@ -11,13 +11,13 @@ abi , -#include +include /usr/sbin/postdrop { - #include - #include - #include - #include + include + include + include + include # This is needed at least for permissions=paranoid capability dac_override, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.postmap b/profiles/apparmor/profiles/extras/usr.sbin.postmap index 4c605823a..b946eff96 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.postmap +++ b/profiles/apparmor/profiles/extras/usr.sbin.postmap @@ -10,13 +10,13 @@ abi , -#include +include /usr/sbin/postmap { - #include - #include - #include - #include + include + include + include + include /etc/fstab r, /etc/mtab r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.postqueue b/profiles/apparmor/profiles/extras/usr.sbin.postqueue index e08479aae..4ca429c38 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.postqueue +++ b/profiles/apparmor/profiles/extras/usr.sbin.postqueue @@ -10,14 +10,14 @@ abi , -#include +include /usr/sbin/postqueue { - #include - #include - #include - #include - #include + include + include + include + include + include # This is needed at least for permissions=paranoid capability dac_override, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.sendmail b/profiles/apparmor/profiles/extras/usr.sbin.sendmail index b169c9b67..2392ed695 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.sendmail +++ b/profiles/apparmor/profiles/extras/usr.sbin.sendmail @@ -13,15 +13,15 @@ abi , -#include +include /usr/sbin/sendmail { - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include /usr/bin/procmail Px, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.sendmail.postfix b/profiles/apparmor/profiles/extras/usr.sbin.sendmail.postfix index fbb73125d..23bdce2f1 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.sendmail.postfix +++ b/profiles/apparmor/profiles/extras/usr.sbin.sendmail.postfix @@ -10,15 +10,15 @@ abi , -#include +include /usr/sbin/sendmail.postfix { - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include /etc/mtab r, /etc/postfix r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.sendmail.sendmail b/profiles/apparmor/profiles/extras/usr.sbin.sendmail.sendmail index 86248d833..85f5dbd1d 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.sendmail.sendmail +++ b/profiles/apparmor/profiles/extras/usr.sbin.sendmail.sendmail @@ -10,11 +10,11 @@ abi , -#include +include /usr/sbin/sendmail.sendmail { - #include - #include + include + include @{PROC}/loadavg r, /etc/aliases rw, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.spamd b/profiles/apparmor/profiles/extras/usr.sbin.spamd index b72efbbf9..6ee9f97a2 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.spamd +++ b/profiles/apparmor/profiles/extras/usr.sbin.spamd @@ -12,13 +12,13 @@ abi , -#include +include /usr/sbin/spamd { - #include - #include - #include - #include + include + include + include + include capability net_bind_service, capability setgid, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.squid b/profiles/apparmor/profiles/extras/usr.sbin.squid index dc8038541..a94eb3e71 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.squid +++ b/profiles/apparmor/profiles/extras/usr.sbin.squid @@ -11,13 +11,13 @@ abi , -#include +include /usr/sbin/squid { - #include - #include - #include - #include + include + include + include + include capability setgid, capability setuid, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.sshd b/profiles/apparmor/profiles/extras/usr.sbin.sshd index b231d51dc..8a04a5225 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.sshd +++ b/profiles/apparmor/profiles/extras/usr.sbin.sshd @@ -16,15 +16,15 @@ abi , -#include +include /usr/sbin/sshd { - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include capability sys_chroot, capability sys_resource, @@ -101,9 +101,9 @@ abi , # to set memory protection for passwd @{PROC}/@{pid}/task/@{pid}/attr/exec w, profile passwd { - #include - #include - #include + include + include + include capability audit_write, capability chown, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.useradd b/profiles/apparmor/profiles/extras/usr.sbin.useradd index 5205eae1c..1b38a0e42 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.useradd +++ b/profiles/apparmor/profiles/extras/usr.sbin.useradd @@ -11,16 +11,16 @@ abi , -#include +include /usr/sbin/useradd { - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include capability audit_write, capability chown, @@ -62,9 +62,9 @@ abi , /var/spool/mail/* rw, profile pam_tally2 { - #include - #include - #include + include + include + include capability audit_write, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.userdel b/profiles/apparmor/profiles/extras/usr.sbin.userdel index 5494609e0..138a5b1eb 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.userdel +++ b/profiles/apparmor/profiles/extras/usr.sbin.userdel @@ -11,16 +11,16 @@ abi , -#include +include /usr/sbin/userdel { - #include - #include - #include - #include - #include - #include - #include + include + include + include + include + include + include + include capability chown, capability dac_override, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.vsftpd b/profiles/apparmor/profiles/extras/usr.sbin.vsftpd index b527efa7d..0027fbae0 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.vsftpd +++ b/profiles/apparmor/profiles/extras/usr.sbin.vsftpd @@ -11,12 +11,12 @@ abi , -#include +include /usr/sbin/vsftpd { - #include - #include - #include + include + include + include /dev/urandom r, /etc/environment r, diff --git a/profiles/apparmor/profiles/extras/usr.sbin.xinetd b/profiles/apparmor/profiles/extras/usr.sbin.xinetd index b164bfa13..857fcd4e3 100644 --- a/profiles/apparmor/profiles/extras/usr.sbin.xinetd +++ b/profiles/apparmor/profiles/extras/usr.sbin.xinetd @@ -10,11 +10,11 @@ abi , -#include +include /usr/sbin/xinetd { - #include - #include + include + include capability net_bind_service, capability setgid,