mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 05:47:59 +00:00
Code Issues Releases Wiki Activity

Merge add unconfined profiles for geary, loupe and firefox dev versions

Browse Source 
These applications need to use user namespaces, hence it needs an
unconfined profile when user namespaces are restricted from unconfined
like other applications in MR #1123

https://gitlab.com/apparmor/apparmor/-/merge_requests/1123

In addition this serves as a handle to uniquely identify them instead
of unconfined to peers in policy.

Bug: https://bugs.launchpad.net/bugs/2046844

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1185
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen 2024-03-17 07:18:03 +00:00
commit c47789340a
3 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
profiles/apparmor.d/firefox
View File

@ -4,7 +4,7 @@
abi <abi/4.0>,
include <tunables/global>
profile firefox /usr/lib/firefox{,-esr}/firefox{,-esr} flags=(unconfined) {
profile firefox /usr/lib/firefox{,-esr,-beta,-devedition,-nightly}/firefox{,-esr,-bin} flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.

12
profiles/apparmor.d/geary Normal file
View File

@ -0,0 +1,12 @@
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/4.0>,
include <tunables/global>
profile geary /usr/bin/geary flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/geary>
}

12
profiles/apparmor.d/loupe Normal file
View File

@ -0,0 +1,12 @@
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/4.0>,
include <tunables/global>
profile loupe /usr/bin/loupe flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/loupe>
}