mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 22:05:27 +00:00
Code Issues Releases Wiki Activity

Merge profiles: curl: switch to user-tmp abstraction

Browse Source 
The curl profile allows reading and writing to /tmp/ so instead of
two rules that don't cover all tmp locations, switch to the user-tmp
abstraction to allow access to the various possible tmp locations.

Note: The does reduce the write permission to owner write, instead
of the wider file w /tmp/**,

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1773
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen
2025-08-30 01:12:37 +00:00
parent e58f65d0c1 59e7fdd96a
commit 7757c7130c
1 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
profiles/apparmor.d/curl
View File

@@ -17,22 +17,19 @@ profile curl /usr/bin/curl {
include <abstractions/private-files-strict> include <abstractions/private-files-strict>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
#can read/write data and configs from tmp
include <abstractions/user-tmp>
@{exec_path} mr, @{exec_path} mr,
# allow reading configuration files from $HOME # allow reading configuration files from $HOME
priority=1 file r @{HOME}/.curlrc, priority=1 owner file r @{HOME}/.curlrc,
priority=1 file r @{HOME}/.config/curlrc, priority=1 owner file r @{HOME}/.config/curlrc,
# allow reading other configuration files/certs from $HOME # allow reading other configuration files/certs from $HOME
# (see --config, --cacert options) # (see --config, --cacert options)
file r @{HOME}/**,
# allow reading data/config from tmp
owner file r /tmp/**,
# allow writing output to $HOME, /tmp (see -o option) # allow writing output to $HOME, /tmp (see -o option)
file w @{HOME}/**, owner file rw @{HOME}/**,
file w /tmp/**,
# allows UDP (for DNS), TCP (for http, https, etc), abstract Unix sockets, IPv4, IPv6 # allows UDP (for DNS), TCP (for http, https, etc), abstract Unix sockets, IPv4, IPv6
network unix stream, network unix stream,