mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 01:57:43 +00:00
0e58e3d7fb
This ideally is a temporary fix because we do not want to allow all users of curl to be able to access the snapd socket. However, this will work for now until we can mediate the accesses better. Fixes: LP: #2120669 Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
52 lines
1.5 KiB
Plaintext
52 lines
1.5 KiB
Plaintext
#------------------------------------------------------------------
|
|
# Copyright (C) 2025 Canonical Ltd.
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
# License published by the Free Software Foundation.
|
|
#------------------------------------------------------------------
|
|
# vim: ft=apparmor
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile curl /usr/bin/curl {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice>
|
|
include <abstractions/private-files-strict>
|
|
include <abstractions/ssl_certs>
|
|
|
|
@{exec_path} mr,
|
|
|
|
# allow reading configuration files from $HOME
|
|
priority=1 file r @{HOME}/.curlrc,
|
|
priority=1 file r @{HOME}/.config/curlrc,
|
|
|
|
# allow reading other configuration files/certs from $HOME
|
|
# (see --config, --cacert options)
|
|
file r @{HOME}/**,
|
|
|
|
# allow reading data/config from tmp
|
|
owner file r /tmp/**,
|
|
|
|
# allow writing output to $HOME, /tmp (see -o option)
|
|
file w @{HOME}/**,
|
|
file w /tmp/**,
|
|
|
|
# allows UDP (for DNS), TCP (for http, https, etc), abstract Unix sockets, IPv4, IPv6
|
|
network unix stream,
|
|
network unix dgram,
|
|
network inet stream,
|
|
network inet dgram,
|
|
network inet6 stream,
|
|
network inet6 dgram,
|
|
|
|
# Allow access to the snap socket until we can revisit it with delegation
|
|
# or profile refactoring
|
|
file rw @{run}/snapd.socket,
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
include if exists <local/curl>
|
|
}
|