From cac848e240d998391070871d37256f99f978b63e Mon Sep 17 00:00:00 2001 From: Christian Boltz Date: Sat, 4 Dec 2021 20:27:25 +0100 Subject: [PATCH] abstractions/python: add several permissions - allow reading *.so.* - allow directory listings in .../site-packages/ - allow reading various metadata files These additions are based on denials seen on openSUSE Leap 15.3 with python 3.9. --- profiles/apparmor.d/abstractions/python | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/profiles/apparmor.d/abstractions/python b/profiles/apparmor.d/abstractions/python index 3bc249314..87f7f2b07 100644 --- a/profiles/apparmor.d/abstractions/python +++ b/profiles/apparmor.d/abstractions/python @@ -12,9 +12,13 @@ abi , - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so} mr, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so,so.*[0-9]} mr, /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r, /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.dist-info/{METADATA,namespace_packages.txt} r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.VERSION r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.egg-info/PKG-INFO r, /usr/{local/,}lib{,32,64}/python3.{1,}[0-9]/lib-dynload/*.so mr, # Site-wide configuration