[mirrors/AppArmor-Profiles.git] / bin.netstat

# vim:syntax=apparmor
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2005 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# evolution, amongst other things, calls this program. I didn't want to
# give evolution access to significant chunks of /proc
#

#include <tunables/global>

/bin/netstat {
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/nameservice>

  capability dac_override,
  capability dac_read_search,
  deny capability sys_ptrace,

  /bin/netstat rmix,
  /etc/networks r,
  @{PROC} r,
  @{PROC}/[0-9]*/cmdline r,
  @{PROC}/[0-9]*/fd r,
  @{PROC}/net r,
  @{PROC}/net/* r,
  @{PROC}/*/fd/ r,
  owner @{PROC}/*/net/raw r,
  owner @{PROC}/*/net/raw6 r,
  owner @{PROC}/*/net/tcp r,
  owner @{PROC}/*/net/tcp6 r,
  owner @{PROC}/*/net/udp r,
  owner @{PROC}/*/net/udp6 r,
  owner @{PROC}/*/net/unix r,
}
Commit	Line	Data
92bc3717	1	# vim:syntax=apparmor
	2	# ------------------------------------------------------------------
	3	#
	4	# Copyright (C) 2002-2005 Novell/SUSE
	5	#
	6	# This program is free software; you can redistribute it and/or
	7	# modify it under the terms of version 2 of the GNU General Public
	8	# License published by the Free Software Foundation.
	9	#
	10	# ------------------------------------------------------------------
	11	# evolution, amongst other things, calls this program. I didn't want to
	12	# give evolution access to significant chunks of /proc
	13	#
	14
	15	#include <tunables/global>
	16
	17	/bin/netstat {
	18	#include <abstractions/base>
	19	#include <abstractions/consoles>
	20	#include <abstractions/nameservice>
	21
	22	capability dac_override,
	23	capability dac_read_search,
	24	deny capability sys_ptrace,
	25
	26	/bin/netstat rmix,
	27	/etc/networks r,
	28	@{PROC} r,
	29	@{PROC}/[0-9]*/cmdline r,
	30	@{PROC}/[0-9]*/fd r,
	31	@{PROC}/net r,
	32	@{PROC}/net/* r,
	33	@{PROC}/*/fd/ r,
	34	owner @{PROC}/*/net/raw r,
	35	owner @{PROC}/*/net/raw6 r,
	36	owner @{PROC}/*/net/tcp r,
	37	owner @{PROC}/*/net/tcp6 r,
	38	owner @{PROC}/*/net/udp r,
	39	owner @{PROC}/*/net/udp6 r,
	40	owner @{PROC}/*/net/unix r,
	41	}