mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

Merge profiles: add a profile for hwctl

Browse Source 
I'm working on a Rust library project that collects hardware and OS information from the local system and queries the Ubuntu Hardware Certification service to determine if the device model has been certified.

I'd like to add an AppArmor profile to ensure the `hwctl` program has access to the resources it needs.

Project source code: https://github.com/canonical/hardware-api/

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1658
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen 2025-05-02 22:22:25 +00:00
commit e510dfd0e7
1 changed files with 54 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
profiles/apparmor.d/usr.bin.hwctl Normal file
View File

@ -0,0 +1,54 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2025 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 3 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
abi <abi/4.0>,
include <tunables/global>
profile hwctl /usr/bin/hwctl {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/ssl_certs>
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
network netlink raw,
/sys/firmware/dmi/tables/* r, # for collecting SMBIOS info
/sys/devices/system/cpu/cpufreq/policy*/cpuinfo_max_freq r,
/sys/fs/cgroup/**/cpu.max r,
@{PROC}/version r,
@{PROC}/@{pid}/cgroup r,
# for collecting OS information
/usr/bin/{dpkg,kmod} cx,
/usr/bin/lsb_release Px -> lsb_release,
profile dpkg /usr/bin/dpkg {
include <abstractions/base>
/usr/bin/dpkg r,
/etc/dpkg/** r,
}
profile kmod /usr/bin/kmod {
include <abstractions/base>
/usr/bin/kmod r,
@{PROC}/{cmdline,modules} r,
@{sys}/module/** r, # for fetching kernel modules
}
include if exists <local/usr.bin.hwctl>
}