avm/hassio-addons
1
0
Fork 0
mirror of https://github.com/alexbelgium/hassio-addons.git synced 2026-01-11 02:11:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

add apparmor

Browse Source
This commit is contained in:
Alexandre
2022-01-25 09:45:21 +01:00
parent afc7f27686
commit 5c31043c8f
4 changed files with 169 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
addons_updater/apparmor.txt
View File

@@ -25,7 +25,7 @@ profile addon_updater flags=(attach_disconnected,mediate_deleted) {
/etc/cont-finish.d/** rwix,
/run/** rwk,
# Bashio
# bashio
/usr/lib/bashio/** ix,
/tmp/** rw,

56
ombi/apparmor.txt Normal file
View File

@@ -0,0 +1,56 @@
#include <tunables/global>
profile ombi_addon flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
capability,
file,
signal,
mount,
umount,
remount,
network udp,
network tcp,
network dgram,
network stream,
network inet,
network inet6,
network netlink raw,
capability setgid,
capability setuid,
capability sys_admin,
capability dac_read_search,
# capability dac_override,
# capability sys_rawio,
# S6-Overlay
/bin/** ix,
/usr/bin/** ix,
/usr/lib/bashio/** ix,
/etc/s6/** rix,
/run/s6/** rix,
/etc/services.d/** rwix,
/etc/cont-init.d/** rwix,
/etc/cont-finish.d/** rwix,
/init rix,
/var/run/** mrwkl,
/var/run/ mrwkl,
/dev/i2c-1 mrwkl,
# Files required
/dev/sda1 mrwkl,
/dev/sdb1 mrwkl,
/dev/mmcblk0p1 mrwkl,
/dev/* mrwkl,
/tmp/** mrkwl,
# Data access
/data/** rw,
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
ptrace (trace,read) peer=docker-default,
# docker daemon confinement requires explict allow rule for signal
signal (receive) set=(kill,term) peer=/usr/bin/docker,
}

56
requestrr/apparmor.txt Normal file
View File

@@ -0,0 +1,56 @@
#include <tunables/global>
profile requestrr_addon flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
capability,
file,
signal,
mount,
umount,
remount,
network udp,
network tcp,
network dgram,
network stream,
network inet,
network inet6,
network netlink raw,
capability setgid,
capability setuid,
capability sys_admin,
capability dac_read_search,
# capability dac_override,
# capability sys_rawio,
# S6-Overlay
/bin/** ix,
/usr/bin/** ix,
/usr/lib/bashio/** ix,
/etc/s6/** rix,
/run/s6/** rix,
/etc/services.d/** rwix,
/etc/cont-init.d/** rwix,
/etc/cont-finish.d/** rwix,
/init rix,
/var/run/** mrwkl,
/var/run/ mrwkl,
/dev/i2c-1 mrwkl,
# Files required
/dev/sda1 mrwkl,
/dev/sdb1 mrwkl,
/dev/mmcblk0p1 mrwkl,
/dev/* mrwkl,
/tmp/** mrkwl,
# Data access
/data/** rw,
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
ptrace (trace,read) peer=docker-default,
# docker daemon confinement requires explict allow rule for signal
signal (receive) set=(kill,term) peer=/usr/bin/docker,
}

56
resiliosync/apparmor.txt Normal file
View File

@@ -0,0 +1,56 @@
#include <tunables/global>
profile resiliosync_addon flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
capability,
file,
signal,
mount,
umount,
remount,
network udp,
network tcp,
network dgram,
network stream,
network inet,
network inet6,
network netlink raw,
capability setgid,
capability setuid,
capability sys_admin,
capability dac_read_search,
# capability dac_override,
# capability sys_rawio,
# S6-Overlay
/bin/** ix,
/usr/bin/** ix,
/usr/lib/bashio/** ix,
/etc/s6/** rix,
/run/s6/** rix,
/etc/services.d/** rwix,
/etc/cont-init.d/** rwix,
/etc/cont-finish.d/** rwix,
/init rix,
/var/run/** mrwkl,
/var/run/ mrwkl,
/dev/i2c-1 mrwkl,
# Files required
/dev/sda1 mrwkl,
/dev/sdb1 mrwkl,
/dev/mmcblk0p1 mrwkl,
/dev/* mrwkl,
/tmp/** mrkwl,
# Data access
/data/** rw,
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
ptrace (trace,read) peer=docker-default,
# docker daemon confinement requires explict allow rule for signal
signal (receive) set=(kill,term) peer=/usr/bin/docker,
}