mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profiles): add gnome-software.

Browse Source
This commit is contained in:
Alexandre Pujol 2022-10-23 11:25:23 +01:00
parent 05fd596859
commit 0168f8b13b
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 133 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

132
apparmor.d/groups/gnome/gnome-software Normal file
View File

@ -0,0 +1,132 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/gnome-software
profile gnome-software @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/openssl>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
include <abstractions/vulkan>
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
network netlink raw,
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/,
@{exec_path} mr,
/{usr/,}bin/bwrap rPUx,
/{usr/,}bin/fusermount{,3} rCx -> fusermount,
/{usr/,}bin/gpg rCx -> gpg,
/{usr/,}bin/gpgconf rCx -> gpg,
/{usr/,}bin/gpgsm rCx -> gpg,
/{usr/,}lib/gio-launch-desktop rPx -> child-open,
/{usr/,}lib/revokefs-fuse rix,
/usr/share/app-info/{,**} r,
/usr/share/appdata/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/metainfo/{,**} r,
/usr/share/swcatalog/xml/{,**} r,
/usr/share/X11/xkb/{,**} r,
/usr/share/xml/iso-codes/{,**} r,
/etc/appstream.conf r,
/etc/flatpak/remotes.d/{,**} r,
/etc/PackageKit/Vendor.conf r,
/etc/pulse/client.conf r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/var/lib/flatpak/app/{,**} r,
/var/lib/flatpak/appstream/{,**} r,
/var/lib/flatpak/repo/{,**} r,
/var/lib/flatpak/runtime/{,**} r,
/var/lib/PackageKit/offline-update-competed r,
/var/lib/PackageKit/prepared-update r,
owner @{HOME}/.var/app/{,**/} r,
owner @{user_cache_dirs}/gnome-software/{,**} rw,
owner @{user_cache_dirs}/flatpak/system-cache/{,**} rw,
owner @{user_share_dirs}/flatpak/repo/{,**} rw,
/var/tmp/flatpak-cache-*/ rw,
/var/tmp/flatpak-cache-*/** rwkl,
/var/tmp/#[0-9]* rw,
owner /tmp/ostree-gpg-*/ rw,
owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
owner /tmp/#[0-9]* rw,
@{run}/systemd/inhibit/*.ref rw,
owner @{run}/user/@{uid}/.dbus-proxy/a11y-bus-proxy-[0-9A-Z]* rw,
owner @{run}/user/@{uid}/.dbus-proxy/session-bus-proxy-[0-9A-Z]* rw,
owner @{run}/user/@{uid}/.flatpak-cache rw,
owner @{run}/user/@{uid}/.flatpak/{,**} rw,
owner @{run}/user/@{uid}/.flatpak/**/*.ref rwk,
@{sys}/devices/system/cpu/possible r,
@{sys}/module/nvidia/version r,
@{PROC}/@{pids}/mounts r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/stat r,
/dev/fuse rw,
profile gpg {
include <abstractions/base>
/{usr/,}bin/gpg mr,
/{usr/,}bin/gpgconf mr,
/{usr/,}bin/gpgsm mr,
@{HOME}/@{XDG_GPG_DIR}/*.conf r,
owner /tmp/ostree-gpg-*/ r,
owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
}
profile fusermount {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability sys_admin,
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/,
/{usr/,}bin/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
}
include if exists <local/gnome-software>
}

1
dists/flags/main.flags
View File

@ -76,6 +76,7 @@ gnome-music complain
gnome-photos-thumbnailer complain gnome-photos-thumbnailer complain
gnome-remote-desktop-daemon complain gnome-remote-desktop-daemon complain
gnome-shell attach_disconnected,complain gnome-shell attach_disconnected,complain
gnome-software complain
gnome-system-monitor attach_disconnected,complain gnome-system-monitor attach_disconnected,complain
gnome-terminal-server complain gnome-terminal-server complain
gnome-tweaks complain gnome-tweaks complain