Updated apparmor; config

This commit is contained in:
Fredrik Baberg 2023-01-13 00:18:41 +01:00
parent de6a5e1916
commit f6cca76a3e
2 changed files with 23 additions and 9 deletions

View File

@ -1,12 +1,12 @@
#include <tunables/global> #include <tunables/global>
profile 3DPrinter-OctoPrint flags=(attach_disconnected,mediate_deleted,complain) { profile 3dprinter-octoprint flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base> #include <abstractions/base>
# Capabilities # Capabilities
file, file,
signal (send) set=(kill,term,int,hup,cont), signal (send) set=(kill,term,int,hup,cont),
# S6-Overlay # S6-Overlay
/init ix, /init ix,
/bin/** ix, /bin/** ix,
@ -19,11 +19,25 @@ profile 3DPrinter-OctoPrint flags=(attach_disconnected,mediate_deleted,complain)
/etc/cont-finish.d/** rwix, /etc/cont-finish.d/** rwix,
/run/{,**} rwk, /run/{,**} rwk,
/dev/tty rw, /dev/tty rw,
# Bashio # Bashio
/usr/lib/bashio/** ix, /usr/lib/bashio/** ix,
/tmp/** rwk, /tmp/** rwk,
# Access to options.json and other files within your addon # Access to options.json and other files within your addon
/data/** rw, /data/** rw,
# Start new profile for service
/usr/bin/caddy cx -> caddy,
profile caddy flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
# Receive signals from S6-Overlay
signal (receive) peer=*_3dprinter-octoprint,
capability dac_override {
/var/log/nginx* rw,
}
}
} }

View File

@ -13,9 +13,9 @@ ports:
5000/tcp: null 5000/tcp: null
ports_description: ports_description:
5000/tcp: Web-based interface 5000/tcp: Web-based interface
# devices: devices:
# - /dev/mem - /dev/mem
# - /dev/gpiomem - /dev/gpiomem
privileged: privileged:
- SYS_RAWIO - SYS_RAWIO
apparmor: true apparmor: true
@ -31,7 +31,7 @@ schema:
# camera_url: "url?" # camera_url: "url?"
# mode: "list(normal|recovery|reverse_proxy_test|camera)?" # mode: "list(normal|recovery|reverse_proxy_test|camera)?"
image: ghcr.io/fredrikbaberg/ha-addon-3dprinter-octoprint-{arch} image: ghcr.io/fredrikbaberg/ha-addon-3dprinter-octoprint-{arch}
codenotary: fredrik.baberg@gmail.com # codenotary:
tmpfs: true tmpfs: true
ingress: false ingress: false
# ingress_stream: false # ingress_stream: false