mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-06-12 18:41:27 +02:00
apparmor for all
This commit is contained in:
Alexandre
48
bitwarden/apparmor.txt
Normal file
48
bitwarden/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
48
cloudcommander/apparmor.txt
Normal file
48
cloudcommander/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
48
code-server/apparmor.txt
Normal file
48
code-server/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile code_server_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
48
joal/apparmor.txt
Normal file
48
joal/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile joal_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
48
nextcloud/apparmor.txt
Normal file
48
nextcloud/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
48
papermerge/apparmor.txt
Normal file
48
papermerge/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile papermerge_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
48
piwigo/apparmor.txt
Normal file
48
piwigo/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
48
radarr/apparmor.txt
Normal file
48
radarr/apparmor.txt
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
capability,
|
||||||
|
file,
|
||||||
|
mount,
|
||||||
|
umount,
|
||||||
|
remount,
|
||||||
|
|
||||||
|
capability setgid,
|
||||||
|
capability setuid,
|
||||||
|
capability sys_admin,
|
||||||
|
capability dac_read_search,
|
||||||
|
# capability dac_override,
|
||||||
|
# capability sys_rawio,
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/usr/lib/bashio/** ix,
|
||||||
|
/etc/s6/** rix,
|
||||||
|
/run/s6/** rix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/init rix,
|
||||||
|
/var/run/** mrwkl,
|
||||||
|
/var/run/ mrwkl,
|
||||||
|
/dev/i2c-1 mrwkl,
|
||||||
|
# Files required
|
||||||
|
/dev/sda1 mrwkl,
|
||||||
|
/dev/sdb1 mrwkl,
|
||||||
|
/dev/mmcblk0p1 mrwkl,
|
||||||
|
/dev/* mrwkl,
|
||||||
|
/tmp/** mrkwl,
|
||||||
|
|
||||||
|
# Data access
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
||||||
|
ptrace (trace,read) peer=docker-default,
|
||||||
|
|
||||||
|
# docker daemon confinement requires explict allow rule for signal
|
||||||
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
||||||
|
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user