D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
etc
/
apparmor.d
/
Filename :
fusermount3
back
Copy
abi <abi/5.0>, include <tunables/global> @{fuse_types} = {fuse,fuse.*,fuseblk,fusectl} profile fusermount3 /usr/bin/fusermount3 { include <abstractions/base> include <abstractions/nameservice> capability sys_admin, capability dac_read_search, # Denials newly generated between 3.14 and 3.17 (LP: #2122161) # Flatpak seems to work fine without these capabilities, so don't grant # them unless actual functionality breakage is caused elsewhere # capability dac_override, # capability setuid, # Allow both rw and ro type mounts (e.g. AppImage uses ro) #MS_DIRSYNC, MS_NOATIME, MS_NODIRATIME, MS_NOEXEC, MS_SYNCHRONOUS, MS_NOSYMFOLLOW # Below broad mount flags should be revisited once we have rule delegation mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> @{HOME}/**/, mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> /mnt/{,**/}, mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> @{run}/user/@{uid}/**/, mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> /media/**/, mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> /tmp/**/, # Cern VM fs is special and only uses these exact flags mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> /cvmfs/**/, umount @{HOME}/**/, umount /mnt/{,**/}, umount @{run}/user/@{uid}/**/, umount /media/**/, umount /tmp/**/, umount /cvmfs/**/, # Flatpak's default cache directory where it mounts a revokefs-fuse mount fstype=fuse options=(nosuid,nodev,rw) /dev/fuse -> /var/tmp/flatpak-cache-*/**/, mount fstype=fuse.revokefs-fuse options=(nosuid,nodev,rw) revokefs-fuse -> /var/tmp/flatpak-cache-*/**/, umount /var/tmp/flatpak-cache-*/**/, # flatpak-builder uses rofiles-fuse mount fstype=fuse.rofiles-fuse options=(nosuid,nodev,rw) {rofiles-fuse,/dev/fuse} -> /var/tmp/test-flatpak-*/**/, umount /var/tmp/test-flatpak-*/**/, /dev/fuse rw, # needed since libfuse 3.17.1-rc0 (LP: #2111845) /usr/bin/mount ix, /usr/bin/umount ix, # Rules needed by umount, until we can make a separate umount profile # First encountered with LP: #2122161 @{run}/mount/utab r, @{run}/mount/utab.act wk, @{run}/mount/utab.event w, @{run}/mount/utab.lock rwk, @{etc_ro}/fuse.conf r, @{PROC}/@{pid}/{mounts,mountinfo} r, @{exec_path} mr, include if exists <local/fusermount3> } # vim:ft=apparmor