root@ecm-e00f:/# cat /etc/apparmor.d/usr.bin.
man
# vim:syntax=apparmor
#include <tunables/global>
/usr/bin/
man {
#include <abstractions/base>
# Use a special pr
ofile when
man calls anything gr
off-related. We only
# include
the programs that actually parse input data in a non-trivial
# way, not wrappers such as gr
off and nr
off, since
the latter would need a
# broader pr
ofile.
/usr/bin/eqn rmCx -> &
man_gr
off,
/usr/bin/grap rmCx -> &
man_gr
off,
/usr/bin/pic rmCx -> &
man_gr
off,
/usr/bin/preconv rmCx -> &
man_gr
off,
/usr/bin/refer rmCx -> &
man_gr
off,
/usr/bin/tbl rmCx -> &
man_gr
off,
/usr/bin/tr
off rmCx -> &
man_gr
off,
/usr/bin/vgrind rmCx -> &
man_gr
off,
# Similarly, use a special pr
ofile when
man calls decompressors and o
ther
# simple filters.
/{,usr/}bin/bzip2 rmCx -> &
man_filter,
/{,usr/}bin/gzip rmCx -> &
man_filter,
/usr/bin/col rmCx -> &
man_filter,
/usr/bin/compress rmCx -> &
man_filter,
/usr/bin/iconv rmCx -> &
man_filter,
/usr/bin/lzip.lzip rmCx -> &
man_filter,
/usr/bin/tr rmCx -> &
man_filter,
/usr/bin/xz rmCx -> &
man_filter,
# Allow basically anything in terms
of file system access, subject to DAC.
#
The purpose
of this pr
ofile isn't to confine
man itself (that might be
# nice in
the future, but is tricky since it's quite configurable), but to
# confine
the processes it calls that parse untrusted data.
/** mrixwlk,
unix,
capability setuid,
capability setgid,
# Ordinary permission checks sometimes involve checking whe
ther
the
# process has this capability, which can produce audit log messages.
#
Silence them.
deny capability dac_override,
deny capability dac_read_search,
signal peer=@{pr
ofile_name},
signal peer=/usr/bin/
man//&
man_gr
off,
signal peer=/usr/bin/
man//&
man_filter,
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.bin.
man>
}
pr
ofile
man_gr
off {
#include <abstractions/base>
# Recent kernels revalidate open FDs, and
there are
often some still
# open on TTYs. This is temporary until
man learns to close irrelevant
# open FDs before execve.
#include <abstractions/consoles>
#
man always runs its gr
off pipeline with
the input file open on stdin,
# so we can skip <abstractions/user-
manpages>.
/usr/bin/eqn rm,
/usr/bin/grap rm,
/usr/bin/pic rm,
/usr/bin/preconv rm,
/usr/bin/refer rm,
/usr/bin/tbl rm,
/usr/bin/tr
off rm,
/usr/bin/vgrind rm,
/etc/gr
off/** r,
/etc/papersize r,
/usr/lib/gr
off/site-tmac/** r,
/usr/share/gr
off/** r,
/tmp/gr
off* rw,
signal peer=/usr/bin/
man,
# @{pr
ofile_name} doesn't seem to work here.
signal peer=/usr/bin/
man//&
man_gr
off,
}
pr
ofile
man_filter {
#include <abstractions/base>
# Recent kernels revalidate open FDs, and
there are
often some still
# open on TTYs. This is temporary until
man learns to close irrelevant
# open FDs before execve.
#include <abstractions/consoles>
/{,usr/}bin/bzip2 rm,
/{,usr/}bin/gzip rm,
/usr/bin/col rm,
/usr/bin/compress rm,
/usr/bin/iconv rm,
/usr/bin/lzip.lzip rm,
/usr/bin/tr rm,
/usr/bin/xz rm,
#
Manual pages can be more or less anywhere, especially with "
man -l", and
#
there's no harm in allowing wide read access here since
the worst it can
# do is feed data to
the invoking
man process.
/** r,
# Allow writing cat pages.
/var/cache/
man/** w,
signal peer=/usr/bin/
man,
# @{pr
ofile_name} doesn't seem to work here.
signal peer=/usr/bin/
man//&
man_filter,
}
本文探讨了在领导者滔滔不绝时保持冷静与沉默的重要性。通过简短的指导建议，文章鼓励读者在面对喋喋不休的领导时学会适时沉默，保持内心的平和。
扫一扫
2918
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
