mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 10:07:12 +00:00
Merge profiles: add a profile for hwctl
I'm working on a Rust library project that collects hardware and OS information from the local system and queries the Ubuntu Hardware Certification service to determine if the device model has been certified. I'd like to add an AppArmor profile to ensure the `hwctl` program has access to the resources it needs. Project source code: https://github.com/canonical/hardware-api/ MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1658 Approved-by: John Johansen <john@jjmx.net> Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
commit
e510dfd0e7
54
profiles/apparmor.d/usr.bin.hwctl
Normal file
54
profiles/apparmor.d/usr.bin.hwctl
Normal file
@ -0,0 +1,54 @@
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2025 Canonical Ltd.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 3 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
profile hwctl /usr/bin/hwctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
/sys/firmware/dmi/tables/* r, # for collecting SMBIOS info
|
||||
/sys/devices/system/cpu/cpufreq/policy*/cpuinfo_max_freq r,
|
||||
/sys/fs/cgroup/**/cpu.max r,
|
||||
|
||||
@{PROC}/version r,
|
||||
@{PROC}/@{pid}/cgroup r,
|
||||
|
||||
# for collecting OS information
|
||||
/usr/bin/{dpkg,kmod} cx,
|
||||
/usr/bin/lsb_release Px -> lsb_release,
|
||||
|
||||
profile dpkg /usr/bin/dpkg {
|
||||
include <abstractions/base>
|
||||
|
||||
/usr/bin/dpkg r,
|
||||
/etc/dpkg/** r,
|
||||
}
|
||||
|
||||
profile kmod /usr/bin/kmod {
|
||||
include <abstractions/base>
|
||||
|
||||
/usr/bin/kmod r,
|
||||
@{PROC}/{cmdline,modules} r,
|
||||
@{sys}/module/** r, # for fetching kernel modules
|
||||
}
|
||||
|
||||
include if exists <local/usr.bin.hwctl>
|
||||
}
|
Loading…
x
Reference in New Issue
Block a user