Merge pull request #54 from mdegat01/aa-journal-variable

Journald variable in apparmor profile
mdegat01 · Apr 11, 2021 · 22514ca · 22514ca
2 parents 87d1dca + 8f96c0a
commit 22514ca
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/promtail/apparmor.txt b/promtail/apparmor.txt
@@ -1,5 +1,8 @@
 include <tunables/global>
 
+# Systemd Journal location
+@{journald}=/var/log/journal/{,**} @{run}/log/journal/{,**}
+
 profile promtail flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/base>
 
@@ -39,15 +42,15 @@ profile promtail flags=(attach_disconnected,mediate_deleted) {
   @{etc_rw}/promtail/{,**}          rw,
   /share/{,**}                      r,
   /ssl/{,**}                        r,
-  /var/log/journal/{,**}            r,
+  @{journald}                       r,
 
   # Programs
   /usr/bin/promtail                 cx,
   /usr/bin/yq                       Cx,
 
   # Shell access
   owner @{HOME}/.*                  rw,
-  /etc/bash.bashrc                  r,
+  @{etc_ro}/bash.bashrc             r,
 
   profile /usr/bin/promtail flags=(attach_disconnected,mediate_deleted) {
     include <abstractions/base>
@@ -68,8 +71,7 @@ profile promtail flags=(attach_disconnected,mediate_deleted) {
     /data/promtail/**               rwk,
 
     # Log sources
-    @{run}/log/journal/{,**}        r,
-    /var/log/journal/{,**}          r,
+    @{journald}                     r,
     /share/**                       r,
 
     # Config