updated apparmor state
This commit is contained in:
parent
32dd635a3c
commit
18300a1b1d
@ -1,4 +1,8 @@
|
||||
---
|
||||
apparmor:
|
||||
enabled: true
|
||||
config:
|
||||
configs:
|
||||
- 'usr.bin.skype'
|
||||
- 'opt.kingsoft'
|
||||
- 'usr.bin.spotify'
|
||||
- 'opt.sublime_text.sublime_text'
|
||||
|
@ -1,11 +1,11 @@
|
||||
---
|
||||
{%- from "apparmor/map.jinja" import apparmor with context %}
|
||||
{%- if apparmor.enabled is defined and apparmor.enabled %}
|
||||
{%- for apparmor_config in ['usr.bin.skype','opt.kingsoft','usr.bin.spotify','opt.sublime_text_3.sublime_text'] %}
|
||||
apparmor-{{ apparmor_config }}:
|
||||
{%- for cfg in apparmor.configs %}
|
||||
apparmor-{{ cfg }}:
|
||||
file.managed:
|
||||
- name: "/etc/apparmor.d/{{ apparmor_config }}"
|
||||
- source: "salt://apparmor/{{ apparmor_config }}.j2"
|
||||
- name: "/etc/apparmor.d/{{ cfg }}"
|
||||
- source: "salt://apparmor/{{ cfg }}.j2"
|
||||
- user: root
|
||||
- group: root
|
||||
- mode: 0644
|
||||
|
@ -1,6 +1,6 @@
|
||||
#include <tunables/global>
|
||||
|
||||
/opt/sublime_text_3/sublime_text {
|
||||
/opt/sublime_text*/sublime_text {
|
||||
#include <abstractions/base>
|
||||
#include <abstractions/X>
|
||||
#include <abstractions/ibus>
|
||||
@ -16,8 +16,8 @@
|
||||
/dev/null r,
|
||||
|
||||
/{dev,run}/{,shm/}** rwmkl,
|
||||
/opt/sublime_text_3/ rwixmkl,
|
||||
/opt/sublime_text_3/** rwixmkl,
|
||||
/opt/sublime_text*/ rwixmkl,
|
||||
/opt/sublime_text*/** rwixmkl,
|
||||
|
||||
owner @{HOME}/.config/sublime-text-3/ rwmkl,
|
||||
owner @{HOME}/.config/sublime-text-3/** rwmkl,
|
||||
@ -29,7 +29,7 @@
|
||||
deny network raw,
|
||||
}
|
||||
|
||||
/opt/sublime_text_3/plugin_host {
|
||||
/opt/sublime_text*/plugin_host* {
|
||||
#include <abstractions/base>
|
||||
deny network inet,
|
||||
deny network inet6,
|
Loading…
Reference in New Issue
Block a user