github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

add basic Firejail support to AppArmor base abstraction (#3226)

Browse source
This commit is contained in:
smitsohu 2021-10-21 00:17:51 +02:00
parent d2389ec9a7
commit 9267904112
2 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Makefile.in
View file

@ -144,9 +144,13 @@ ifeq ($(HAVE_APPARMOR),-DHAVE_APPARMOR)
# install apparmor profile
sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d; fi;"
install -m 0644 etc/apparmor/firejail-default $(DESTDIR)$(sysconfdir)/apparmor.d
sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/local ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/local; fi;"
# install apparmor profile customization file
sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/local ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/local; fi;"
sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-default ]; then install -c -m 0644 etc/apparmor/firejail-local $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-default; fi;"
# install apparmor base abstraction drop-in
sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions; fi;"
sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions/base.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions/base.d; fi;"
install -m 0644 etc/apparmor/firejail-base $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/base.d
endif
ifneq ($(HAVE_MAN),no)
# man pages

26
etc/apparmor/firejail-base Normal file
View file

@ -0,0 +1,26 @@
#########################################
# Firejail base abstraction drop-in
#########################################
# Adds basic Firejail support to AppArmor profiles.
# Please note: Firejail's nonewprivs and seccomp options
# are not compatible with AppArmor profile transitions.
# Discovery of process names
owner /{,run/firejail/mnt/oroot/}proc/@{pid}/comm r,
##########
# Following paths only exist inside a Firejail sandbox
##########
# Library preloading
/{,run/firejail/mnt/oroot/}{,var/}run/firejail/lib/*.so mr,
# Supporting seccomp
owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/seccomp/seccomp.postexec r,
# Supporting trace
owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/trace w,
# Supporting tracelog
/{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/fslogger r,