qugalet/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2024-11-28 22:52:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
gotosocial/example/apparmor/gotosocial

65 lines
2 KiB
Plaintext
Raw Normal View History

[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
#include <tunables/global>
profile gotosocial flags=(attach_disconnected, mediate_deleted) {
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/gio-open>
include <abstractions/nameservice>
include <abstractions/user-tmp>
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
/gotosocial/gotosocial mrix,
/usr/local/bin/gotosocial mrix,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
/usr/bin/gotosocial mrix,
/usr/sbin/gotosocial mrix,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
owner /gotosocial/{,**} r,
[bugfix/docs] AppArmor profile for SQLite (#1864) Our default configuration places the SQLite DB in /gotosocial/, but the AppArmor profile doesn't allow us to write there. Instead of making the whole directory writable, add a writable area in /gotosocial/db/ instead and advise in the docs to move the DB there.
2023-06-04 16:55:57 +00:00
owner /gotosocial/db/* wk,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
owner /gotosocial/storage/** wk,
# Allow GoToSocial to write logs
# NOTE: you only need to allow write permissions to /var/log/syslog if you've
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
# enabled logging to syslog.
# owner /var/log/syslog w,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
# These directories are not currently used by any of the recommended
# GoToSocial installation methods, but they may be used in the future and/or
# for custom installations.
owner /etc/gotosocial/{,**} r,
owner /usr/local/etc/gotosocial/{,**} r,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
owner /usr/share/gotosocial/{,**} r,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
owner /usr/local/share/gotosocial/{,**} r,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
owner /usr/lib/gotosocial/{,**} r,
owner /usr/lib/gotosocial/db/* wk,
owner /usr/lib/gotosocial/storage/** wk,
owner /usr/local/lib/gotosocial/{,**} r,
owner /usr/local/lib/gotosocial/db/* wk,
owner /usr/local/lib/gotosocial/storage/** wk,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
owner /var/lib/gotosocial/{,**} r,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
owner /var/lib/gotosocial/db/* wk,
owner /var/lib/gotosocial/storage/** wk,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
owner /opt/gotosocial/{,**} r,
owner /run/gotosocial/{,**} r,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
/etc/mime.types r,
/etc/services r,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
/proc/sys/net/core/somaxconn r,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
/sys/fs/cgroup/system.slice/gotosocial.service/{,*} r,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
owner /proc/*/cgroup r,
owner /proc/*/cpuset r,
owner /proc/*/mountinfo r,
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
# TCP / UDP network access
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
# Allow GoToSocial to receive signals from unconfined processes
signal (receive) peer=unconfined,
[docs/bugfix] Allow access to TMP directories in example AppArmor config (#2683) * Remove trailing whitespace from example config * Update and extend example AppArmor profile
2024-02-24 08:44:53 +00:00
# Allow GoToSocial to send signals to/receive signals from worker processes
[docs] Add AppArmor profile for Debian and Ubuntu installations (#1183) * Enable the 'admonitions' Markdown extension for Mkdocs. The admonitions extension to Python-Markdown allows you to include rST-style "admonitions" to Markdown documents, for instance, !!! note Here's an important note to keep in mind! In general, the current documentation uses bold text to try to achieve the same effect, which is a bit harder to notice and makes it difficult to differentiate between "here's something useful to know" versus "here there be dragons". * Add AppArmor profile and documentation for LSM-related sandboxing This commit adds an AppArmor profile for gotosocial in examples/apparmor/gotosocial. This will (hopefully) serve as a helpful security mitigation for people are planning on deploying GTS on a Debian-family Linux distribution. I've also updates the documentation to include some information about deploying GTS with either AppArmor or SELinux (moving the documentation for the former out of the "binary installation guide" docs).
2022-11-30 22:09:26 +00:00
signal (send,receive) peer=gotosocial,
}
# vim:syntax=apparmor
Reference in a new issue Copy permalink