Browse Source

d/control[.in}, d/rules, d/usr.sbin.gpsd, d/gpsd.install: add apparmor profile for gpsd

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
tags/debian/3.19-1
Christian Ehrhardt Bernd Zeimetz 2 years ago
parent
commit
911decd674
5 changed files with 76 additions and 2 deletions
  1. +2
    -1
      debian/control
  2. +2
    -1
      debian/control.in
  3. +1
    -0
      debian/gpsd.install
  4. +1
    -0
      debian/rules
  5. +70
    -0
      debian/usr.sbin.gpsd

+ 2
- 1
debian/control View File

@@ -24,6 +24,7 @@ Build-Depends: debhelper (>= 11),
scons (>= 2.0.1), chrpath,
dh-buildinfo,
dh-python,
dh-apparmor,
pps-tools (>= 0.20120406+g0deb9c7e-2~) [linux-any],
pkg-config
Standards-Version: 4.2.1
@@ -41,7 +42,7 @@ Depends: netbase | systemd-sysv, lsb-base (>= 3.2-13),
libgps23 (= ${binary:Version})
Recommends: udev [linux-any], ${python:Depends}, python
Breaks: ${gpsd:Breaks}
Suggests: gpsd-clients, dbus
Suggests: gpsd-clients, dbus, apparmor
Conflicts: fso-gpsd
Multi-Arch: foreign
Description: Global Positioning System - daemon


+ 2
- 1
debian/control.in View File

@@ -24,6 +24,7 @@ Build-Depends: debhelper (>= 11),
scons (>= 2.0.1), chrpath,
dh-buildinfo,
dh-python,
dh-apparmor,
pps-tools (>= 0.20120406+g0deb9c7e-2~) [linux-any],
pkg-config
Standards-Version: 4.2.1
@@ -41,7 +42,7 @@ Depends: netbase | systemd-sysv, lsb-base (>= 3.2-13),
libgpsLIBGPSSONAME (= ${binary:Version})
Recommends: udev [linux-any], ${python:Depends}, python
Breaks: ${gpsd:Breaks}
Suggests: gpsd-clients, dbus
Suggests: gpsd-clients, dbus, apparmor
Conflicts: fso-gpsd
Multi-Arch: foreign
Description: Global Positioning System - daemon


+ 1
- 0
debian/gpsd.install View File

@@ -2,3 +2,4 @@ usr/sbin/*
usr/share/man/man8/*
lib/systemd/system/*
usr/bin/ppscheck
debian/usr.sbin.gpsd /etc/apparmor.d/

+ 1
- 0
debian/rules View File

@@ -195,6 +195,7 @@ binary: install-stamp
dh_installman
dh_installmenu
dh_systemd_enable -pgpsd
dh_apparmor --profile-name=usr.sbin.gpsd -pgpsd
dh_installinit
dh_systemd_start -pgpsd --restart-after-upgrade
dh_installexamples


+ 70
- 0
debian/usr.sbin.gpsd View File

@@ -0,0 +1,70 @@
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
# Copyright (C) 2018 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

#include <tunables/global>

/usr/sbin/gpsd {
#include <abstractions/base>
#include <abstractions/nameservice>

capability ipc_lock,
capability net_bind_service,
capability sys_nice,
capability fsetid,
capability setgid,
capability setuid,
capability sys_resource,

# for all the remote connection options
network dgram,
network stream,

# common serial paths to GPS devices
/dev/tty{,S,USB,AMA}[0-9]* rw,
/dev/ACM[0-9]* rw,
/sys/dev/char r,
/sys/dev/char/** r,

# pps related devices
/dev/pps[0-9]* rw,
/sys/devices/virtual/pps r,
/sys/devices/virtual/pps/** r,

# gpsd device to share
/dev/gpsd[0-9] rw,

# libusb device access to GPS devices
/proc/ r,
/dev/ r,
/sys/class/ r,
/sys/bus/ r,
/dev/bus/usb/ r,
/sys/bus/usb/devices/ r,
/sys/devices/pci[0-9]*/**/{uevent,busnum,devnum,speed,descriptors} r,
/run/udev/data/+usb* r,
/run/udev/data/c189* r,

# common config path (by default unused)
/etc/gpsd/* r,

# enumerate own FDs
@{PROC}/@{pid}/fd/ r,

# default paths feeding GPS data into chrony
/{,var/}run/chrony.tty{,S,USB,AMA}[0-9]*.sock rw,
/tmp/chrony.tty{,S,USB,AMA}[0-9]*.sock rw,

# logging
/{,var/}run/systemd/journal/dev-log w,

# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.gpsd>
}

Loading…
Cancel
Save