Marcus Rueckert
e7da101e6a
- allow reading the webapp dir to make the builtin webserver work
- modernize the profile to use a short profile name
- remove php abstraction, replaced with rule to read the icu data
files
- remove all file rules that are covered by the base and
nameservice abstraction
- allow include (with "if exists) for local/rspamd and
local/usr.bin.rspamd (for backrwards compat)
OBS-URL: https://build.opensuse.org/package/show/server:mail/rspamd?expand=0&rev=49
35 lines
829 B
Plaintext
35 lines
829 B
Plaintext
# Last Modified: Mon Oct 5 10:19:40 2020
|
|
#include <tunables/global>
|
|
|
|
# based on https://github.com/progmaticltd/homebox/blob/master/install/playbooks/roles/rspamd/templates/apparmor.d/usr.bin.rspamd
|
|
|
|
profile rspamd /usr/bin/rspamd {
|
|
#include <abstractions/base>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/openssl>
|
|
#include <abstractions/ssl_certs>
|
|
|
|
/usr/bin/rspamd mr,
|
|
|
|
/etc/rspamd/** r,
|
|
|
|
/srv/www/webapps/rspamd/ r,
|
|
/srv/www/webapps/rspamd/** r,
|
|
/usr/share/rspamd/ r,
|
|
/usr/share/rspamd/** r,
|
|
|
|
/var/lib/rspamd/ r,
|
|
/var/lib/rspamd/** rwk,
|
|
|
|
/var/log/rspamd/rspamd.log* rwk,
|
|
/{var/,}run/rspamd/* rwk,
|
|
|
|
/dev/shm/rhm.* rw,
|
|
/etc/magic r,
|
|
/proc/sys/kernel/random/uuid r,
|
|
|
|
/usr/share/icu/*/icu*.dat r,
|
|
|
|
#include if exists <local/usr.bin.rspamd>
|
|
#include if exists <local/rspamd>
|
|
} |