Skip to content

Commit 25b23c2

Browse files
Rippanda12Rippanda12
committed
add other shit
1 parent ee83787 commit 25b23c2

File tree

6 files changed

+375
-0
lines changed

6 files changed

+375
-0
lines changed

‎apparmor.txt‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#include <tunables/global>
2+
3+
profile hassio-supervisor flags=(attach_disconnected,mediate_deleted) {
4+
#include <abstractions/base>
5+
#include <abstractions/python>
6+
7+
network,
8+
deny network raw,
9+
10+
signal (send) set=(kill,term,int,hup,cont),
11+
12+
capability net_admin,
13+
capability net_bind_service,
14+
capability dac_read_search,
15+
capability dac_override,
16+
capability chown,
17+
18+
/bin/** ix,
19+
/usr/bin/** ix,
20+
/bin/udevadm Ux,
21+
/sbin/udevd Ux,
22+
/usr/local/bin/python* ix,
23+
/usr/bin/git cx,
24+
/usr/bin/gdbus cx,
25+
/usr/lib/bashio/** ix,
26+
/etc/s6/** ix,
27+
/run/{s6,s6-rc*,service}/** ix,
28+
/package/** ix,
29+
/command/** ix,
30+
/etc/services.d/** rwix,
31+
/etc/cont-init.d/** rwix,
32+
/etc/cont-finish.d/** rwix,
33+
34+
deny /proc/** wl,
35+
deny /sys/** wl,
36+
37+
/ r,
38+
/** r,
39+
/tmp/** rwk,
40+
/data/** rw,
41+
/run/{,**} rwk,
42+
/dev/tty rw,
43+
/root/.cas/{,**} rwk,
44+
/etc/resolv.conf rw,
45+
/run/docker.sock rw,
46+
47+
/usr/local/lib/** mr,
48+
49+
profile /usr/bin/gdbus flags=(attach_disconnected,mediate_deleted) {
50+
#include <abstractions/base>
51+
#include <abstractions/dbus>
52+
53+
signal (receive) set=(int),
54+
unix (send, receive) type=stream,
55+
56+
capability sys_nice,
57+
58+
/** r,
59+
/lib/* mr,
60+
/usr/bin/gdbus mr,
61+
/usr/local/lib/** mr,
62+
63+
/run/dbus/system_bus_socket rw,
64+
}
65+
66+
profile /usr/bin/git flags=(attach_disconnected,mediate_deleted) {
67+
#include <abstractions/base>
68+
69+
network,
70+
deny network raw,
71+
72+
signal (receive) set=(term),
73+
74+
/bin/busybox ix,
75+
/usr/bin/git mrix,
76+
/usr/libexec/git-core/* ix,
77+
78+
deny /data/homeassistant rw,
79+
deny /data/ssl rw,
80+
81+
/** r,
82+
/lib/* mr,
83+
/data/addons/** lrw,
84+
/usr/local/lib/** mr,
85+
86+
capability dac_override,
87+
}
88+
}

‎apparmor_beta.txt‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#include <tunables/global>
2+
3+
profile hassio-supervisor flags=(attach_disconnected,mediate_deleted) {
4+
#include <abstractions/base>
5+
#include <abstractions/python>
6+
7+
network unix stream,
8+
network inet stream,
9+
network inet6 stream,
10+
network inet dgram,
11+
network inet6 dgram,
12+
network netlink raw,
13+
14+
signal (send) set=(kill,term,int,hup,cont),
15+
16+
capability net_admin,
17+
capability net_bind_service,
18+
capability dac_read_search,
19+
capability dac_override,
20+
capability chown,
21+
22+
/bin/** ix,
23+
/usr/bin/** ix,
24+
/bin/udevadm Ux,
25+
/sbin/udevd Ux,
26+
/usr/local/bin/python* ix,
27+
/usr/bin/git cx,
28+
/usr/bin/gdbus cx,
29+
/usr/lib/bashio/** ix,
30+
/etc/s6/** ix,
31+
/run/{s6,s6-rc*,service}/** ix,
32+
/package/** ix,
33+
/command/** ix,
34+
/etc/services.d/** rwix,
35+
/etc/cont-init.d/** rwix,
36+
/etc/cont-finish.d/** rwix,
37+
38+
deny /proc/** wl,
39+
deny /sys/** wl,
40+
41+
/ r,
42+
/** r,
43+
/tmp/** rwk,
44+
/data/** rw,
45+
/run/{,**} rwk,
46+
/dev/tty rw,
47+
/root/.cas/{,**} rwk,
48+
/etc/resolv.conf rw,
49+
/run/docker.sock rw,
50+
51+
/usr/local/lib/** mr,
52+
53+
profile /usr/bin/gdbus flags=(attach_disconnected,mediate_deleted) {
54+
#include <abstractions/base>
55+
#include <abstractions/dbus>
56+
57+
signal (receive) set=(int),
58+
unix (send, receive) type=stream,
59+
60+
capability sys_nice,
61+
62+
/** r,
63+
/lib/* mr,
64+
/usr/bin/gdbus mr,
65+
/usr/local/lib/** mr,
66+
67+
/run/dbus/system_bus_socket rw,
68+
}
69+
70+
profile /usr/bin/git flags=(attach_disconnected,mediate_deleted) {
71+
#include <abstractions/base>
72+
73+
network,
74+
deny network raw,
75+
76+
signal (receive) set=(term),
77+
78+
/bin/busybox ix,
79+
/usr/bin/git mrix,
80+
/usr/libexec/git-core/* ix,
81+
82+
deny /data/homeassistant rw,
83+
deny /data/ssl rw,
84+
85+
/** r,
86+
/lib/* mr,
87+
/data/addons/** lrw,
88+
/usr/local/lib/** mr,
89+
90+
capability dac_override,
91+
}
92+
}

‎apparmor_dev.txt‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#include <tunables/global>
2+
3+
profile hassio-supervisor flags=(attach_disconnected,mediate_deleted) {
4+
#include <abstractions/base>
5+
#include <abstractions/python>
6+
7+
network unix stream,
8+
network inet stream,
9+
network inet6 stream,
10+
network inet dgram,
11+
network inet6 dgram,
12+
network netlink raw,
13+
14+
signal (send) set=(kill,term,int,hup,cont),
15+
16+
capability net_admin,
17+
capability net_bind_service,
18+
capability dac_read_search,
19+
capability dac_override,
20+
capability chown,
21+
22+
/bin/** ix,
23+
/usr/bin/** ix,
24+
/bin/udevadm Ux,
25+
/sbin/udevd Ux,
26+
/usr/local/bin/python* ix,
27+
/usr/bin/git cx,
28+
/usr/bin/gdbus cx,
29+
/usr/lib/bashio/** ix,
30+
/etc/s6/** ix,
31+
/run/{s6,s6-rc*,service}/** ix,
32+
/package/** ix,
33+
/command/** ix,
34+
/etc/services.d/** rwix,
35+
/etc/cont-init.d/** rwix,
36+
/etc/cont-finish.d/** rwix,
37+
38+
deny /proc/** wl,
39+
deny /sys/** wl,
40+
41+
/ r,
42+
/** r,
43+
/tmp/** rwk,
44+
/data/** rw,
45+
/run/{,**} rwk,
46+
/dev/tty rw,
47+
/root/.cas/{,**} rwk,
48+
/etc/resolv.conf rw,
49+
/run/docker.sock rw,
50+
51+
/usr/local/lib/** mr,
52+
53+
profile /usr/bin/gdbus flags=(attach_disconnected,mediate_deleted) {
54+
#include <abstractions/base>
55+
#include <abstractions/dbus>
56+
57+
signal (receive) set=(int),
58+
unix (send, receive) type=stream,
59+
60+
capability sys_nice,
61+
62+
/** r,
63+
/lib/* mr,
64+
/usr/bin/gdbus mr,
65+
/usr/local/lib/** mr,
66+
67+
/run/dbus/system_bus_socket rw,
68+
}
69+
70+
profile /usr/bin/git flags=(attach_disconnected,mediate_deleted) {
71+
#include <abstractions/base>
72+
73+
network,
74+
deny network raw,
75+
76+
signal (receive) set=(term),
77+
78+
/bin/busybox ix,
79+
/usr/bin/git mrix,
80+
/usr/libexec/git-core/* ix,
81+
82+
deny /data/homeassistant rw,
83+
deny /data/ssl rw,
84+
85+
/** r,
86+
/lib/* mr,
87+
/data/addons/** lrw,
88+
/usr/local/lib/** mr,
89+
90+
capability dac_override,
91+
}
92+
}

‎apparmor_stable.txt‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#include <tunables/global>
2+
3+
profile hassio-supervisor flags=(attach_disconnected,mediate_deleted) {
4+
#include <abstractions/base>
5+
#include <abstractions/python>
6+
7+
network unix stream,
8+
network inet stream,
9+
network inet6 stream,
10+
network inet dgram,
11+
network inet6 dgram,
12+
network netlink raw,
13+
14+
signal (send) set=(kill,term,int,hup,cont),
15+
16+
capability net_admin,
17+
capability net_bind_service,
18+
capability dac_read_search,
19+
capability dac_override,
20+
capability chown,
21+
22+
/bin/** ix,
23+
/usr/bin/** ix,
24+
/bin/udevadm Ux,
25+
/sbin/udevd Ux,
26+
/usr/local/bin/python* ix,
27+
/usr/bin/git cx,
28+
/usr/bin/gdbus cx,
29+
/usr/lib/bashio/** ix,
30+
/etc/s6/** ix,
31+
/run/{s6,s6-rc*,service}/** ix,
32+
/package/** ix,
33+
/command/** ix,
34+
/etc/services.d/** rwix,
35+
/etc/cont-init.d/** rwix,
36+
/etc/cont-finish.d/** rwix,
37+
38+
deny /proc/** wl,
39+
deny /sys/** wl,
40+
41+
/ r,
42+
/** r,
43+
/tmp/** rwk,
44+
/data/** rw,
45+
/run/{,**} rwk,
46+
/dev/tty rw,
47+
/root/.cas/{,**} rwk,
48+
/etc/resolv.conf rw,
49+
/run/docker.sock rw,
50+
51+
/usr/local/lib/** mr,
52+
53+
profile /usr/bin/gdbus flags=(attach_disconnected,mediate_deleted) {
54+
#include <abstractions/base>
55+
#include <abstractions/dbus>
56+
57+
signal (receive) set=(int),
58+
unix (send, receive) type=stream,
59+
60+
capability sys_nice,
61+
62+
/** r,
63+
/lib/* mr,
64+
/usr/bin/gdbus mr,
65+
/usr/local/lib/** mr,
66+
67+
/run/dbus/system_bus_socket rw,
68+
}
69+
70+
profile /usr/bin/git flags=(attach_disconnected,mediate_deleted) {
71+
#include <abstractions/base>
72+
73+
network,
74+
deny network raw,
75+
76+
signal (receive) set=(term),
77+
78+
/bin/busybox ix,
79+
/usr/bin/git mrix,
80+
/usr/libexec/git-core/* ix,
81+
82+
deny /data/homeassistant rw,
83+
deny /data/ssl rw,
84+
85+
/** r,
86+
/lib/* mr,
87+
/data/addons/** lrw,
88+
/usr/local/lib/** mr,
89+
90+
capability dac_override,
91+
}
92+
}

‎online.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
NetworkManager is online

‎update-supervisor.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/sh
2+
3+
version=$(curl -s https://ameridroid.github.io/HA-version/stable.json | jq -r '.supervisor // "latest"' || echo "latest")
4+
arch=$(docker image ls | grep -- '-hassio-observer' | awk '{print $1}' | awk -F/ '{print $3}' | awk -F- '{print $1}')
5+
6+
docker pull "ghcr.io/ameridroid/${arch}-hassio-supervisor:${version}"
7+
docker tag "ghcr.io/ameridroid/${arch}-hassio-supervisor:${version}" "ghcr.io/ameridroid/${arch}-hassio-supervisor:latest"
8+
9+
# hassos-supervisor script will recreate the container automatically.
10+
docker stop hassio_supervisor

0 commit comments

Comments
 (0)