Skip to content

Commit

Permalink
feat(profile): rewrite update-ca-certificates.
Browse files Browse the repository at this point in the history
  • Loading branch information
roddhjav committed Oct 20, 2023
1 parent ed7585c commit 4276ede
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 66 deletions.
82 changes: 16 additions & 66 deletions apparmor.d/profiles-s-z/update-ca-certificates
Original file line number Diff line number Diff line change
Expand Up @@ -14,101 +14,51 @@ profile update-ca-certificates @{exec_path} {
include <abstractions/openssl>
include <abstractions/ssl_certs>

@{exec_path} r,
@{bin}/{,ba,da}sh rix,
@{exec_path} rmix,

@{bin}/{,ba,da}sh rix,
@{bin}/basename rix,
@{bin}/cat rix,
@{bin}/chmod rix,
@{bin}/find rix,
@{bin}/flock rix,
@{bin}/install rix,
@{bin}/ln rix,
@{bin}/mktemp rix,
@{bin}/mv rix,
@{bin}/openssl rix,
@{bin}/readlink rix,
@{bin}/rm rix,
@{bin}/sed rix,
@{bin}/sort rix,
@{bin}/test rix,
@{bin}/trust rix,
@{bin}/wc rix,

@{bin}/openssl rix,
@{lib}/ca-certificates/update.d/ r,
@{lib}/ca-certificates/update.d/* rix,
/etc/ca-certificates/update.d/ r,
/etc/ca-certificates/update.d/* rix,

/etc/ca-certificates/update.d/ r,
/etc/ca-certificates/update.d/jks-keystore rCx -> jks-keystore,
@{bin}/run-parts rCx -> run-parts,
/usr/share/p11-kit/modules/{,*} r,

/etc/ r,
/etc/ca-certificates.conf r,
/etc/ssl/certs/ca-certificates.crt{,.new} rw,
/etc/ssl/certs/*.pem rw,
/etc/ssl/certs/@{hex}.[0-9] rw,

@{lib}/locale/locale-archive r,
/var/lib/ca-certificates/ rwk,
/var/lib/ca-certificates/** rw,

/ r,

/tmp/ r,
owner /tmp/ca-certificates{,.crt}.tmp.* rw,

# For shell pwd
/root/ r,

/usr/local/share/ r,

profile run-parts {
include <abstractions/base>

@{bin}/run-parts mr,

/etc/ca-certificates/update.d/ r,

# file_inherit
owner /dev/pts/@{int} rw,

}

profile jks-keystore {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>

/etc/ca-certificates/update.d/jks-keystore mr,

@{lib}/ r,
@{lib}/jvm/java-[0-9]*-openjdk-*/jre/bin/java rix,
@{lib}/jvm/java-[0-9]*-openjdk-*/bin/java rix,
@{lib}/jvm/java-[0-9]*-openjdk-*/lib/server/classes.jsa mr,

@{bin}/{,ba,da}sh rix,
@{bin}/sed rix,
@{bin}/head rix,
@{bin}/mountpoint rix,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
@{bin}/dpkg-query rpx,
#
@{bin}/dpkg rPx -> child-dpkg,

/usr/share/ca-certificates-java/ca-certificates-java.jar r,
/usr/share/java/java-atk-wrapper.jar r,

/etc/default/cacerts r,
/etc/ssl/certs/java/cacerts rw,

/etc/java-[0-9]*-openjdk/{,**} r,

owner @{PROC}/@{pid}/coredump_filter rw,
owner @{PROC}/@{pid}/coredump rw,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mountinfo r,

@{sys}/fs/cgroup/** r,

owner /tmp/hsperfdata_*/ rw,
owner /tmp/hsperfdata_*/@{pid} rw,
@{PROC}/filesystems r,

}
/dev/tty rw,

include if exists <local/update-ca-certificates>
}
1 change: 1 addition & 0 deletions dists/flags/main.flags
Original file line number Diff line number Diff line change
Expand Up @@ -312,6 +312,7 @@ udisksctl complain
udisksd attach_disconnected,complain
umount complain
umount.udisks2 complain
update-ca-certificates complain
update-grub complain
update-secureboot-policy complain
userdbctl complain
Expand Down

0 comments on commit 4276ede

Please sign in to comment.