Add support for tlp #585

barmogund · 2024-10-25T11:42:44Z

No description provided.

roddhjav · 2024-10-27T16:28:48Z

apparmor.d/profiles-s-z/tlp

+
+  @{bin}/systemctl              rix,
+  @{bin}/logger                 rix,
+  @{shells_path}                rix,


That should be @{sh_path} (shell_path is for interactive shell and logging system using that use the user shell).

roddhjav · 2024-10-27T16:29:51Z

apparmor.d/profiles-s-z/tlp

+  owner / r,
+
+  owner /etc/tlp.d/ r,
+  owner /etc/tlp.d/** rw,
+  owner /etc/udev/udev.conf r,


Do not use owner in this context. It would prevent any non root user to use the program.

roddhjav · 2024-10-27T16:32:02Z

apparmor.d/profiles-s-z/tlp

+  @{bin}/iw                     rpx,
+  @{bin}/hdparm                 rix,
+  @{bin}/uname                  rpx,
+  @{bin}/udevadm                rix, 


udevadm should be used in a subprofile: https://apparmor.pujol.io/development/abstractions/#appudevadm
Then, all rule that will go in the subprofile will have to be removed from the main one.

roddhjav · 2024-10-27T16:33:24Z

apparmor.d/profiles-s-z/tlp

+  owner /usr/share/tlp/** rw,
+  owner /usr/share/tlp/func.d/** rw,


No owner here.

It is highly unlikely that tlp needs to write something in /usr/share (this folder is considered read-only)

roddhjav · 2024-10-27T16:35:21Z

apparmor.d/profiles-s-z/tlp

+
+  /usr/share/tlp/tlp-readconfs   rw,
+
+  /var/lib/power-profiles-daemon/{,**} rw,


This should be restricted: as it write files on another program var, only the specific file names should be allowed and not everything.

roddhjav · 2024-10-27T16:36:44Z

apparmor.d/profiles-s-z/tlp

+  /var/lib/power-profiles-daemon/{,**} rw,
+
+  owner /usr/share/tlp/bat.d/** rw,
+  owner /usr/share/perl5/core_perl/** r,


You don't seems to used perl here, so this should not be here.

If perl is really needed, use the perl abstraction instead.

roddhjav · 2024-10-27T16:38:02Z

apparmor.d/profiles-s-z/tlp

+
+  @{sys}/firmware/acpi/platform_profile* rw,
+  @{sys}/firmware/acpi/pm_profile* rw,
+  @{sys}/devices/virtusl/** rw,


there is a typo: virtual/. Also full write access to it is too wide.

roddhjav · 2024-10-27T16:39:47Z

Thanks for this PR. I have added a few minor comments. Once resolved, it will be ready to merge.

You should use the disk-read abstraction, and only add rules on @{sys}/ on system when it is really needed.

roddhjav · 2024-10-27T16:42:59Z

apparmor.d/profiles-g-l/hdparm

+  # interaction with tlp
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/**/**/power/autosuspend_delay_ms r,
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/scsi_host/host0/link_power_management_policy rw,
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/target*/**/block/{sda,sr0}/* r,
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/target*/**/block/{sda,sr0}/dev r,
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/target*/**/block/sda/sda@{int}/dev r,
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/target*/**/block/sda@{int}/dev r,
+


Most of this should be covered by disk-read.

Note: you cannot have path specific to a given hardware in a rule. Eg: sda sr0, scsi_host, host0. We aim at supporting all distribution and all kind of hardware, therefore, it should also work with sdb, an ssd... Luckily disk-read already handle all of this.

Only add rule here for @{sys} path when writing is needed.

roddhjav · 2024-10-27T16:46:41Z

apparmor.d/profiles-s-z/tlp

+  /dev/disk/by-id/ r,
+  owner /dev/sda r,


In disk-read

roddhjav · 2024-10-27T16:46:49Z

apparmor.d/profiles-s-z/tlp

+  @{sys}/bus/ r,
+  owner @{sys}/bus/pci/drivers/nouveau/ r,
+  owner @{sys}/devices/@{pci}/ r,
+  owner @{sys}/devices/@{pci}/power/control rw,
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/scsi_host/ r,
+  owner @{sys}/devices/@{pci}/ta@{int}/host@{int}/scsi_host/host@{int}/link_power_management_policy rw,
+  @{sys}/bus/platform/devices/ r,
+  @{sys}/class/ r,
+  @{sys}/class/power_supply/ r,
+  @{sys}/devices/@{pci}/uevent r,
+  @{sys}/devices/**/power_supply/*/scope r,
+  @{sys}/devices/**/power_supply/*/uevent r,
+  @{sys}/devices/platform/**/uevent r,
+  @{sys}/devices/system/cpu/*_pstate/{no_turbo,turbo_pct} r,
+  @{sys}/devices/system/cpu/*_pstate/status r,
+  @{sys}/devices/system/cpu/cpu@{int}/power/energy_perf_bias rw,
+  @{sys}/devices/system/cpu/cpufreq/ r,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw,
+  owner @{sys}/bus/pci/drivers/mei_me/ r,
+  owner @{sys}/bus/pci/devices/ r,
+  owner @{sys}/block/ r,
+  owner @{sys}/class/net/ r,
+  owner @{sys}/devices/platform/**/**/** r,
+  owner @{sys}/devices/virtual/block/loop@{int}/ r,
+  owner @{sys}/devices/virtual/block/loop@{int}/dev r,
+  owner @{sys}/devices/virtual/net/lo/uevent r,
+  owner @{sys}/devices/virtual/dmi/id/product_version rw,
+  owner @{sys}/class/drm/ rw,
+  owner @{sys}/module/pcie_aspm/parameters/policy  rw,
+  owner @{sys}/module/snd_hda_intel/parameters/power_save rw,
+  owner @{sys}/module/snd_hda_intel/parameters/power_save_controller rw,


Use disk-read here too. Only keep what has not been defined in disk-read as well as the few write access.

roddhjav · 2024-10-27T16:50:46Z

apparmor.d/profiles-s-z/tlp

+  @{bin}/rm                     rix,
+  @{bin}/id                     rpx,
+  @{bin}/iw                     rpx,
+  @{bin}/hdparm                 rix,


Use the profile instead: @{bin}/hdparm rPx,

It should also make a few rule in tlp not needed anymore as they are part of hdparam (possibly all disk related one).

roddhjav · 2024-10-27T16:51:11Z

apparmor.d/profiles-s-z/tlp

+  @{bin}/id                     rpx,
+  @{bin}/iw                     rpx,


Use rPx instead of rpx.

ok checking what remains to be added

perl is needed checked wich @{sys} additions were needed

roddhjav · 2024-11-01T11:06:01Z

apparmor.d/profiles-g-l/hdparm

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/hdparm
 profile hdparm @{exec_path} flags=(complain) {
  include <abstractions/base>
+  include <abstractions/disks-read>


It is already included.

roddhjav · 2024-11-01T11:06:55Z

apparmor.d/profiles-s-z/tlp

+  /usr/share/tlp/** rw,
+  /usr/share/tlp/func.d/** rw,
+
+  /usr/share/tlp/tlp-readconfs   rw,


rw is still a no go here. The first rule include the other ones.

roddhjav · 2024-11-01T11:07:33Z

apparmor.d/profiles-s-z/tlp

+
+  /var/lib/power-profiles-daemon/state.ini rw,
+
+  owner /usr/share/tlp/bat.d/** rw,


That rule is included by the other share/tlp ones

roddhjav · 2024-11-01T11:08:17Z

apparmor.d/profiles-s-z/tlp

+  @{run}/udev/data/+platform:* r,
+  owner @{run}/tlp/* rw,
+  owner @{run}/tlp/lock_tlp  rwk,
+  owner @{run}/udev/data/b@{int}:@{int} r,


This is part of disk-read

roddhjav · 2024-11-01T11:09:21Z

apparmor.d/profiles-s-z/tlp

+  /etc/tlp.d/ r,
+  /etc/tlp.d/** rw,
+  /etc/tlp.conf rw,
+  /etc/udev/udev.conf r,


Since udevadm is not part of the profile. This rule might not be needed anymore.

roddhjav · 2024-11-01T11:10:53Z

apparmor.d/profiles-s-z/tlp

+  @{sys}/devices/LNXSYSTM:@{rand2}/**/power_supply/BAT@{int}/type r,
+  @{sys}/devices/LNXSYSTM:@{rand2}/**/**/power_supply/BAT@{int}/type r,
+  @{sys}/devices/LNXSYSTM:@{rand2}/**/**/power_supply/BAT@{int}/present r,


It should be:

Suggested change

@{sys}/devices/LNXSYSTM:@{rand2}/**/power_supply/BAT@{int}/type r,

@{sys}/devices/LNXSYSTM:@{rand2}/**/**/power_supply/BAT@{int}/type r,

@{sys}/devices/LNXSYSTM:@{rand2}/**/**/power_supply/BAT@{int}/present r,

@{sys}/devices/**/power_supply/BAT@{int}/type r,

@{sys}/devices/**/power_supply/BAT@{int}/present r,

roddhjav · 2024-11-01T11:12:11Z

apparmor.d/profiles-s-z/tlp

+  owner /dev/sda r,
+  /dev/tty rw,
+
+  include if exists <local/tlp>


Please move this include after the subprofiles.

roddhjav · 2024-11-01T11:13:46Z

apparmor.d/profiles-s-z/tlp

+
+  @{exec_path} mr,
+
+  @{bin}/systemctl              rix,


In a subprofile: https://apparmor.pujol.io/development/abstractions/#appsystemctl

barmogund added 2 commits October 25, 2024 13:38

Create tlp

3d67b17

Update hdparm

2411da2

roddhjav reviewed Oct 27, 2024

View reviewed changes

apparmor.d/profiles-s-z/tlp Outdated

Comment on lines 115 to 116

/dev/disk/by-id/ r,

owner /dev/sda r,

Copy link

Owner

roddhjav Oct 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In disk-read

roddhjav reviewed Oct 27, 2024

View reviewed changes

apparmor.d/profiles-s-z/tlp Outdated

Comment on lines 43 to 44

@{bin}/id rpx,

@{bin}/iw rpx,

Copy link

Owner

roddhjav Oct 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use rPx instead of rpx.

barmogund added 9 commits October 27, 2024 18:49

Update tlp

875180d

Update hdparm

c4c5103

Update tlp

ed35098

ok checking what remains to be added

Update tlp

062b1ea

Update hdparm

9cc2872

Update tlp

04173c8

perl is needed checked wich @{sys} additions were needed

Update tlp

0f906c7

Update tlp

7d0fd5e

Update tlp

ba89afe

roddhjav reviewed Nov 1, 2024

View reviewed changes

barmogund added 5 commits November 1, 2024 14:54

Update tlp

16b440e

Update hdparm

81859c1

Update tlp

8388779

Update tlp

d5ca36f

Update tlp

04799f9

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for tlp #585

Add support for tlp #585

barmogund commented Oct 25, 2024

roddhjav Oct 27, 2024 •

edited

Loading

roddhjav Oct 27, 2024

roddhjav Oct 27, 2024

roddhjav Oct 27, 2024

roddhjav Oct 27, 2024

roddhjav Oct 27, 2024

roddhjav Oct 27, 2024

roddhjav commented Oct 27, 2024 •

edited

Loading

roddhjav Oct 27, 2024 •

edited

Loading

roddhjav Oct 27, 2024

roddhjav Oct 27, 2024

roddhjav Oct 27, 2024 •

edited

Loading

roddhjav Oct 27, 2024

roddhjav Nov 1, 2024

roddhjav Nov 1, 2024 •

edited

Loading

roddhjav Nov 1, 2024

roddhjav Nov 1, 2024

roddhjav Nov 1, 2024

roddhjav Nov 1, 2024 •

edited

Loading

roddhjav Nov 1, 2024

roddhjav Nov 1, 2024

		owner /usr/share/tlp/** rw,
		owner /usr/share/tlp/func.d/** rw,


		/usr/share/tlp/tlp-readconfs rw,

		/var/lib/power-profiles-daemon/{,**} rw,


		/var/lib/power-profiles-daemon/state.ini rw,

		owner /usr/share/tlp/bat.d/** rw,

Add support for tlp #585

Are you sure you want to change the base?

Add support for tlp #585

Conversation

barmogund commented Oct 25, 2024

roddhjav Oct 27, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

roddhjav commented Oct 27, 2024 • edited Loading

roddhjav Oct 27, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

roddhjav Oct 27, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

roddhjav Nov 1, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

roddhjav Nov 1, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

roddhjav Oct 27, 2024 •

edited

Loading

roddhjav commented Oct 27, 2024 •

edited

Loading

roddhjav Oct 27, 2024 •

edited

Loading

roddhjav Oct 27, 2024 •

edited

Loading

roddhjav Nov 1, 2024 •

edited

Loading

roddhjav Nov 1, 2024 •

edited

Loading