36 lines
1011 B
Plaintext
36 lines
1011 B
Plaintext
#include <tunables/global>
|
|
|
|
/usr/bin/vector flags=(attach_disconnected) {
|
|
#include <abstractions/base>
|
|
#include <abstractions/bash>
|
|
#include <abstractions/consoles>
|
|
#include <abstractions/dbus-session-strict>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/openssl>
|
|
#include <abstractions/ssl_keys>
|
|
#include <abstractions/user-tmp>
|
|
|
|
deny @{HOME}/** rwx,
|
|
/etc/machine-id r,
|
|
/etc/vector/** r,
|
|
/proc/*/sched r,
|
|
/proc/cmdline r,
|
|
/proc/sys/kernel/osrelease r,
|
|
/run/log/journal/ r,
|
|
/var/log/journal/** r,
|
|
/run/systemd/notify rw,
|
|
/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c r,
|
|
/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
|
|
/sys/kernel/mm/transparent_hugepage/enabled r,
|
|
/usr/bin/journalctl mrix,
|
|
/usr/bin/vector mrix,
|
|
/var/lib/vector/** rw,
|
|
/var/log/journal/ r,
|
|
/var/log/postgresql/ r,
|
|
/var/log/postgresql/** rw,
|
|
/var/run/systemd/notify rw,
|
|
owner /proc/*/cgroup r,
|
|
owner /proc/*/mountinfo r,
|
|
owner /proc/*/stat r,
|
|
}
|