78 lines
3.2 KiB
Text
78 lines
3.2 KiB
Text
# veilor-os AppArmor profile — veilor-power
|
|
#
|
|
# Scope:
|
|
# Confine /usr/local/bin/veilor-power, the power profile switcher. The
|
|
# script is small but invokes sudo to talk to tuned-adm; we want a tight
|
|
# surface so a compromised user shell cannot abuse the sudoers entry to
|
|
# pivot beyond profile switching.
|
|
#
|
|
# Mode:
|
|
# enforce — this binary is ours, the surface is small, no need for a
|
|
# complain runway. Verified rules at write time.
|
|
#
|
|
# Manual enable:
|
|
# sudo install -m 0644 scripts/apparmor/usr.bin.veilor-power /etc/apparmor.d/
|
|
# sudo apparmor_parser -r /etc/apparmor.d/usr.bin.veilor-power
|
|
# sudo aa-enforce /etc/apparmor.d/usr.bin.veilor-power
|
|
# # to debug:
|
|
# sudo aa-complain /etc/apparmor.d/usr.bin.veilor-power
|
|
#
|
|
# NOT enabled in kickstart by default. v0.5 work.
|
|
|
|
#include <tunables/global>
|
|
|
|
profile veilor-power /usr/local/bin/veilor-power flags=(enforce) {
|
|
#include <abstractions/base>
|
|
#include <abstractions/bash>
|
|
#include <abstractions/consoles>
|
|
|
|
# ---- the script itself + bash ----
|
|
/usr/local/bin/veilor-power r,
|
|
/usr/bin/bash ix,
|
|
/usr/bin/awk ix,
|
|
/usr/bin/cat ix,
|
|
|
|
# ---- read CPU + ASUS sysfs for status ----
|
|
/sys/devices/system/cpu/cpufreq/ r,
|
|
/sys/devices/system/cpu/cpufreq/** r,
|
|
/sys/devices/system/cpu/cpu*/cpufreq/ r,
|
|
/sys/devices/system/cpu/cpu*/cpufreq/** r,
|
|
/sys/devices/platform/asus-nb-wmi/ r,
|
|
/sys/devices/platform/asus-nb-wmi/** r,
|
|
|
|
# ---- sudo handoff to tuned-adm ----
|
|
/usr/bin/sudo Cx -> sudo_tuned,
|
|
/usr/bin/tuned-adm Pix,
|
|
|
|
# ---- forbidden ----
|
|
deny network,
|
|
deny ptrace,
|
|
deny capability sys_ptrace,
|
|
deny capability sys_module,
|
|
deny capability sys_rawio,
|
|
deny /dev/kmem rwk,
|
|
deny /dev/mem rwk,
|
|
deny /etc/shadow r,
|
|
deny /etc/sudoers w,
|
|
deny /etc/sudoers.d/** w,
|
|
deny @{HOME}/.ssh/** rwk,
|
|
deny @{HOME}/.gnupg/** rwk,
|
|
|
|
# ---- child profile for the sudo subprocess ----
|
|
profile sudo_tuned {
|
|
#include <abstractions/base>
|
|
#include <abstractions/authentication>
|
|
#include <abstractions/nameservice>
|
|
/usr/bin/sudo mr,
|
|
/etc/sudoers r,
|
|
/etc/sudoers.d/ r,
|
|
/etc/sudoers.d/veilor-power r,
|
|
/usr/bin/tuned-adm Pix,
|
|
/var/log/sudo* w,
|
|
/var/db/sudo/** rwk,
|
|
capability setuid,
|
|
capability setgid,
|
|
capability audit_write,
|
|
deny network,
|
|
}
|
|
}
|