mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 01:57:43 +00:00
Code Issues Releases Wiki Activity

profiles: add additional rules needed for lsusb under sudo + other flags

Browse Source 
Fixes: https://bugs.launchpad.net/ubuntu/+source/usbutils/+bug/2110212
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
This commit is contained in:
Ryan Lee 2025-06-09 12:56:36 -07:00
parent ac81cafa4f
commit 9f70004058
1 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
profiles/apparmor.d/lsusb
View File

@ -16,8 +16,14 @@ include <tunables/global>
profile lsusb /usr/bin/lsusb {
include <abstractions/base>
/usr/bin/lsusb mr,
network netlink raw,
# Needed for additional information gathered under sudo
capability net_admin,
/dev/bus/usb/@{d}@{d}@{d}/@{d}@{d}@{d} rw,
/dev/ r,
/dev/bus/usb/ r,
@{run}/udev/data/*usb:* r,
@ -35,6 +41,31 @@ profile lsusb /usr/bin/lsusb {
@{sys}/devices/**/usb[0-9]**/manufacturer r,
@{sys}/devices/**/usb[0-9]**/product r,
@{sys}/devices/**/usb[0-9]**/serial r,
# needed for --tree
@{sys}/devices/**/usb[0-9]**/bAlternateSetting r,
@{sys}/devices/**/usb[0-9]**/bInterfaceClass r,
@{sys}/devices/**/usb[0-9]**/bInterfaceNumber r,
@{sys}/devices/**/usb[0-9]**/bInterfaceProtocol r,
@{sys}/devices/**/usb[0-9]**/bInterfaceSubClass r,
@{sys}/devices/**/usb[0-9]**/bNumEndpoints r,
@{sys}/devices/**/usb[0-9]**/bConfigurationValue r,
@{sys}/devices/**/usb[0-9]**/bDeviceClass r,
@{sys}/devices/**/usb[0-9]**/bDeviceProtocol r,
@{sys}/devices/**/usb[0-9]**/bDeviceSubClass r,
@{sys}/devices/**/usb[0-9]**/bMaxPacketSize0 r,
@{sys}/devices/**/usb[0-9]**/bNumConfigurations r,
@{sys}/devices/**/usb[0-9]**/bNumInterfaces r,
@{sys}/devices/**/usb[0-9]**/bcdDevice r,
@{sys}/devices/**/usb[0-9]**/bmAttributes r,
@{sys}/devices/**/usb[0-9]**/configuration r,
@{sys}/devices/**/usb[0-9]**/idProduct r,
@{sys}/devices/**/usb[0-9]**/idVendor r,
@{sys}/devices/**/usb[0-9]**/maxchild r,
@{sys}/devices/**/usb[0-9]**/rx_lanes r,
@{sys}/devices/**/usb[0-9]**/tx_lanes r,
# Needed for --tree -v
@{sys}/devices/**/usb[0-9]**/bMaxPower r,
@{sys}/devices/**/usb[0-9]**/version r,
include if exists <local/lsusb>
}