mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): remove linssid profile.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-09-11 19:40:01 +01:00
parent eb9e0c13ae
commit 04c2cabeb6
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
1 changed files with 0 additions and 113 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

113
apparmor.d/profiles-g-l/linssid
View File

@ -1,113 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/linssid @{bin}/linssid-pkexec
profile linssid @{exec_path} {
include <abstractions/base>
include <abstractions/X>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/qt5>
# For reading/saving config/log files when linssid is started via pkexec
#capability dac_read_search,
#capability dac_override,
# Needed?
deny capability sys_admin,
deny capability sys_nice,
@{exec_path} mr,
@{sh_path} rix,
@{bin}/cat rix,
# When linssid is run as root, it wants to exec dbus-launch, and hence it creates the two
# following root processes:
# dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr
# /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
#
# Should this be allowed? Linssid works fine without this.
#@{bin}/dbus-launch rCx -> dbus,
#@{bin}/dbus-send rCx -> dbus,
deny @{bin}/dbus-launch rx,
deny @{bin}/dbus-send rx,
@{bin}/iw rCx -> iw,
@{bin}/pkexec rPx,
# For regular run as root user
owner @{HOME}/.linssid.prefs rw,
owner @{HOME}/LinSSID.datalog rw,
# For pkexec
#@{HOME}/.linssid.prefs rw,
#@{HOME}/LinSSID.datalog rw,
/usr/share/linssid/{,*} r,
/usr/share/hwdata/pnp.ids r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/net/wireless r,
owner @{PROC}/@{pid}/cmdline r,
owner @{tmp}/runtime-root/ rw,
owner @{tmp}/linssid_* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
# For shell pwd
/root/ r,
# file_inherit
owner /dev/tty@{int} rw,
profile iw {
include <abstractions/base>
capability net_admin,
deny capability sys_module,
network netlink raw,
@{bin}/iw mr,
# file_inherit
owner @{HOME}/.linssid.prefs rw,
owner @{HOME}/LinSSID.datalog rw,
owner @{tmp}/linssid_* rw,
owner /dev/dri/card@{int} rw,
}
profile dbus {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{bin}/dbus-launch mr,
@{bin}/dbus-send mr,
@{bin}/dbus-daemon rPUx,
# for dbus-launch
owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w,
@{HOME}/.Xauthority r,
}
include if exists <local/linssid>
}
# vim:syntax=apparmor