Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tools: Add AppArmor profile for cockpit-desktop #20156

Merged
merged 1 commit into from
Mar 12, 2024
Merged

tools: Add AppArmor profile for cockpit-desktop #20156

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion tools/Makefile-tools.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,7 @@ coverage:
@echo "file://$(abs_top_builddir)/tools/coverage/index.html"
endif

EXTRA_DIST += pkg/apps/content-security-policy.override
EXTRA_DIST += \
pkg/apps/content-security-policy.override \
tools/apparmor.d/cockpit-desktop \
$(NULL)
10 changes: 10 additions & 0 deletions tools/apparmor.d/cockpit-desktop
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
abi <abi/4.0>,

include <tunables/global>

profile cockpit-desktop /usr/lib/cockpit/cockpit-desktop flags=(unconfined) {
userns,

# Site-specific additions and overrides. See local/README for details.
include if exists <local/cockpit-desktop>
}
1 change: 1 addition & 0 deletions tools/debian/cockpit-ws.install
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
etc/cockpit/ws-certs.d
etc/pam.d/cockpit
tools/apparmor.d/cockpit-desktop etc/apparmor.d/
${env:deb_systemdsystemunitdir}/cockpit.service
${env:deb_systemdsystemunitdir}/cockpit-motd.service
${env:deb_systemdsystemunitdir}/cockpit.socket
Expand Down
5 changes: 5 additions & 0 deletions tools/debian/cockpit-ws.postinst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,11 @@ if [ -d /run/systemd/system ] && [ -n "$2" ]; then
deb-systemd-invoke try-restart cockpit.service >/dev/null || true
fi

# update AppArmor profile
if [ "$1" = "configure" ] && aa-enabled --quiet 2>/dev/null; then
apparmor_parser -r -T -W /etc/apparmor.d/cockpit-desktop || true
fi

# set up dynamic motd/issue symlinks on first-time install or upgrades from < 244 (which moved them out of the .deb)
if [ "$1" = "configure" ] && dpkg --compare-versions "$2" lt 244; then
mkdir -p /etc/motd.d /etc/issue.d
Expand Down