mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-29 13:28:19 +00:00
Add more ruletypes to the cleanprof test profiles
To ensure aa-cleanprof works as expected (and writing the rules works as expected), add some rules for every rule class to the cleanprof.in and cleanprof.out test profiles. Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
This commit is contained in:
parent
bdf264a9be
commit
9f569d285f
@ -4,12 +4,32 @@
|
|||||||
/usr/bin/a/simple/cleanprof/test/profile {
|
/usr/bin/a/simple/cleanprof/test/profile {
|
||||||
# Just for the heck of it, this comment wont see the day of light
|
# Just for the heck of it, this comment wont see the day of light
|
||||||
#include <abstractions/base>
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability sys_admin,
|
||||||
|
audit capability,
|
||||||
|
|
||||||
|
change_profile -> /bin/foo,
|
||||||
|
change_profile,
|
||||||
|
|
||||||
|
network inet stream,
|
||||||
|
network stream,
|
||||||
|
|
||||||
#Below rule comes from abstractions/base
|
#Below rule comes from abstractions/base
|
||||||
allow /usr/share/X11/locale/** r,
|
allow /usr/share/X11/locale/** r,
|
||||||
allow /home/*/** r,
|
allow /home/*/** r,
|
||||||
|
|
||||||
|
ptrace tracedby peer=/bin/strace,
|
||||||
|
ptrace tracedby,
|
||||||
unix (receive) type=dgram,
|
unix (receive) type=dgram,
|
||||||
|
|
||||||
|
set rlimit nofile <= 256,
|
||||||
|
set rlimit nofile <= 64,
|
||||||
|
|
||||||
|
signal set=(hup int quit ill trap abrt)
|
||||||
|
set=(bus,fpe,,,kill,usr1)
|
||||||
|
set=segv set=usr2 set=pipe set=alrm set=term set=stkflt set=chld,
|
||||||
|
signal set=(hup int quit),
|
||||||
|
|
||||||
^foo {
|
^foo {
|
||||||
/etc/fstab r,
|
/etc/fstab r,
|
||||||
capability dac_override,
|
capability dac_override,
|
||||||
|
@ -6,11 +6,23 @@
|
|||||||
/usr/bin/a/simple/cleanprof/test/profile {
|
/usr/bin/a/simple/cleanprof/test/profile {
|
||||||
#include <abstractions/base>
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
set rlimit nofile <= 256,
|
||||||
|
|
||||||
|
audit capability,
|
||||||
|
|
||||||
|
network stream,
|
||||||
|
|
||||||
|
signal set=(abrt alrm bus chld fpe hup ill int kill pipe quit segv stkflt term trap usr1 usr2),
|
||||||
|
|
||||||
|
ptrace tracedby,
|
||||||
|
|
||||||
unix (receive) type=dgram,
|
unix (receive) type=dgram,
|
||||||
|
|
||||||
/home/*/** r,
|
/home/*/** r,
|
||||||
/home/foo/** w,
|
/home/foo/** w,
|
||||||
|
|
||||||
|
change_profile,
|
||||||
|
|
||||||
|
|
||||||
^foo {
|
^foo {
|
||||||
capability dac_override,
|
capability dac_override,
|
||||||
|
Loading…
x
Reference in New Issue
Block a user