# Rules for Pi-hole’s AdminLTE, a PHP control panel.

​

/{,usr/}bin/bash                                        Cx -> bash,

​

@{PROC}/loadavg                                         r,    # Shown in header.

​

/run/php-fpm/pihole.sock                                w,    # nginx-user will delete the socket during restart.

​

/etc/pihole/**                                          r,

/etc/pihole/gravity.db                                  wk,

/etc/pihole/pihole-FTL.db                               k,

​

/srv/www/pihole/admin/index.php                         r,

/srv/www/pihole/admin/**.php                            r,

​

/var/log/pihole/pihole-FTL.log                          r,    # To show FTL’s log in the web UI.

​

/tmp/                                                   r,    # session_start() may cause this read. Still inside systemd’s private namespace.

​

owner /run/php-fpm/pihole.sock                          rw,

​

owner /var/log/pihole/adminlte-error.log                rw,   # Set as error log via PHP_ERROR_LOG env var, by AdminLTE code.

owner /var/log/pihole/fpm-php.log                       rw,   # Error log configured in php-fpm configuration.

​

owner /tmp/sess_*                                       rwlk, # This is necessary, even though these are saved under namespace to pihole-admin-lte.service’s private tmp dir.

​

# Separate bash for better control.

#

# attach_disconnected: from

#   name="var/lib/nscd/passwd" comm="sh" requested_mask="r" denied_mask="r" fsuid=65534 ouid=0

profile bash flags=(attach_disconnected) {

  include <abstractions/base>

  include <abstractions/consoles>

  include <abstractions/nameservice>

​

  /{,usr/}bin/bash                                      mr,

  /usr/bin/nproc                                        ix,   # Output is shown in header.

  /usr/bin/pihole                                       rix,  # Allow control of Pi-hole. # TODO: Create separate profile for pihole. This way normal commands can use the profile too.

}

​

# kate: syntax AppArmor; indent-width 2

​