mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-11-04 03:42:14 +00:00
2f733f33f5
* feat(omniroute): add OmniRoute add-on v3.8.52 * docs(omniroute): fix markdown list spacing and table formatting * fix(omniroute): sanitize nginx log format, drop json sub_filter, and drop privileges when PUID configured * fix(omniroute): use --clear-groups in setpriv to allow numeric PUID without passwd entry * fix(omniroute): ensure cp error stops migration before rm -rf deletes data * refactor(omniroute): simplify and align with repo architecture based on maintainer review * omniroute: keep upstream CSP, fix healthcheck, drop non-Supervisor fallbacks - ingress.conf: rewrite only frame-ancestors 'none' -> 'self' in upstream's CSP (nginx map) instead of replacing it with a broad one - Dockerfile: healthcheck used '&>' which dash (/bin/sh) parses as a background job, so it could never fail; use '>/dev/null 2>&1' - drop :-/ingress, :-8099, :-0.0.0.0 and || true fallbacks - delete 20-config_location.sh (only created the mounted /config) - config.yaml: no empty INITIAL_PASSWORD default; OMNIROUTE_MEMORY_MB int - CHANGELOG/README: port 20128 is opt-in; TZ and password have no default Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * omniroute: wrap long config.yaml lines Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: BirdNET-Go Addon Builder <addon-builder@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.1 KiB
Plaintext
56 lines
1.1 KiB
Plaintext
#include <tunables/global>
|
|
|
|
profile omniroute_addon flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
|
|
capability chown,
|
|
capability dac_override,
|
|
capability fowner,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_chroot,
|
|
file,
|
|
signal,
|
|
mount,
|
|
umount,
|
|
remount,
|
|
network udp,
|
|
network tcp,
|
|
network dgram,
|
|
network stream,
|
|
network inet,
|
|
network inet6,
|
|
network netlink raw,
|
|
network unix dgram,
|
|
|
|
/init ix,
|
|
/run/{s6,s6-rc*,service}/** ix,
|
|
/package/** ix,
|
|
/command/** ix,
|
|
/run/{,**} rwk,
|
|
/dev/tty rw,
|
|
/bin/** ix,
|
|
/usr/bin/** ix,
|
|
/usr/lib/bashio/** ix,
|
|
/etc/s6/** rix,
|
|
/run/s6/** rix,
|
|
/etc/services.d/** rwix,
|
|
/etc/cont-init.d/** rwix,
|
|
/etc/cont-finish.d/** rwix,
|
|
/init rix,
|
|
/var/run/** mrwkl,
|
|
/var/run/ mrwkl,
|
|
/dev/* mrwkl,
|
|
/tmp/** mrkwl,
|
|
|
|
# Data access
|
|
/data/** rw,
|
|
/config/** rw,
|
|
|
|
# suppress ptrace denials
|
|
ptrace (trace,read) peer=docker-default,
|
|
|
|
# docker daemon confinement requires explicit allow rule for signal
|
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
|
}
|