mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-29 19:45:10 +00:00
parent 1f8507548f
commit 0619f4dcec
Failed to generate hash of commit
43 changed files with 160 additions and 208 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/apps/imv-wayland
View file

@ -1,4 +1,5 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -8,8 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/imv-wayland @{exec_path} = @{bin}/imv-wayland
profile imv @{exec_path} { profile imv @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/freedesktop.org> include <abstractions/desktop>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -18,7 +18,7 @@ profile imv @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/etc/imv_config r, /etc/imv_config r,
/usr/share/X11/xkb/** r,
/tmp/ r, /tmp/ r,
owner @{user_config_dirs}/imv/config r, owner @{user_config_dirs}/imv/config r,

11
apparmor.d/groups/apps/zathura
View file

@ -1,4 +1,5 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -8,18 +9,16 @@ include <tunables/global>
@{exec_path} = @{bin}/zathura @{exec_path} = @{bin}/zathura
profile zathura @{exec_path} { profile zathura @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/freedesktop.org> include <abstractions/dconf-write>
include <abstractions/fonts> include <abstractions/desktop>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/dconf-write> include <abstractions/user-read-strict>
include <abstractions/gtk>
include <abstractions/user-read>
@{exec_path} mr, @{exec_path} mr,
/usr/share/file/{,**} r, /usr/share/file/{,**} r,
/usr/share/X11/xkb/{,**} r,
/etc/xdg/{,**} r, /etc/xdg/{,**} r,
/etc/zathurarc r, /etc/zathurarc r,

1
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -21,6 +21,7 @@ profile dpkg-preconfigure @{exec_path} {
@{sh_path} rix, @{sh_path} rix,
@{bin}/{,e}grep rix, @{bin}/{,e}grep rix,
@{bin}/dialog rix,
@{bin}/locale rix, @{bin}/locale rix,
@{bin}/sed rix, @{bin}/sed rix,
@{bin}/sort rix, @{bin}/sort rix,

1
apparmor.d/groups/browsers/firefox-crashreporter
View file

@ -26,6 +26,7 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
network inet6 dgram, network inet6 dgram,
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
network netlink raw,
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/bus/at-spi2-registryd
View file

@ -15,6 +15,8 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/X-strict> include <abstractions/X-strict>
signal (receive) set=(term) peer=gdm,
#aa:dbus own bus=accessibility name=org.a11y.atspi.{R,r}egistry #aa:dbus own bus=accessibility name=org.a11y.atspi.{R,r}egistry
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties

6
apparmor.d/groups/bus/ibus-engine-simple
View file

@ -9,12 +9,18 @@ include <tunables/global>
@{exec_path} = @{lib}/{,ibus/}ibus-engine-simple @{exec_path} = @{lib}/{,ibus/}ibus-engine-simple
profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) { profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/ibus> include <abstractions/ibus>
signal (receive) set=term peer=ibus-daemon, signal (receive) set=term peer=ibus-daemon,
unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????", label=ibus-daemon), unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????", label=ibus-daemon),
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr, @{exec_path} mr,
/etc/machine-id r, /etc/machine-id r,

5
apparmor.d/groups/bus/ibus-memconf
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{lib}/{,ibus/}ibus-memconf @{exec_path} = @{lib}/{,ibus/}ibus-memconf
profile ibus-memconf @{exec_path} { profile ibus-memconf @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/ibus> include <abstractions/ibus>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -16,9 +18,6 @@ profile ibus-memconf @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{desktop_cache_dirs}/ibus/dbus-@{rand8} rw, owner @{desktop_cache_dirs}/ibus/dbus-@{rand8} rw,
owner @{desktop_config_dirs}/ibus/bus/ r, owner @{desktop_config_dirs}/ibus/bus/ r,
owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r,

1
apparmor.d/groups/bus/ibus-x11
View file

@ -12,6 +12,7 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/desktop> include <abstractions/desktop>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

6
apparmor.d/groups/freedesktop/pipewire
View file

@ -46,12 +46,12 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
/ r, / r,
/.flatpak-info r, /.flatpak-info r,
owner @{user_config_dirs}/pipewire/pipewire-pulse.conf r, owner @{user_config_dirs}/pipewire/{,**} r,
owner @{user_config_dirs}/pipewire/pipewire.conf r,
owner /tmp/librnnoise-@{int}.so rm, owner /tmp/librnnoise-@{int}.so rm,
owner @{run}/user/@{uid}/pipewire-@{int} rw,
owner @{run}/user/@{uid}/pipewire-@{int}-manager.lock rwk, owner @{run}/user/@{uid}/pipewire-@{int}-manager.lock rwk,
owner @{run}/user/@{uid}/pipewire-@{int}.lock rwk, owner @{run}/user/@{uid}/pipewire-@{int}.lock rwk,
owner @{run}/user/@{uid}/pulse/pid rw, owner @{run}/user/@{uid}/pulse/pid rw,

17
apparmor.d/groups/freedesktop/xprop
View file

@ -10,23 +10,10 @@ include <tunables/global>
@{exec_path} = @{bin}/xprop @{exec_path} = @{bin}/xprop
profile xprop @{exec_path} { profile xprop @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/freedesktop.org>
include <abstractions/X-strict>
@{exec_path} mr, @{exec_path} mr,
/usr/etc/X11/xdm/Xresources r,
/usr/share/icons/*/cursors/crosshair r,
owner @{HOME}/.Xauthority r,
owner @{HOME}/.icons/default/index.theme r,
owner /tmp/runtime-*/xauth_@{rand6} r,
owner /tmp/xauth_@{rand6} r,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,
# file_inherit
owner /dev/tty@{int} rw,
owner @{HOME}/.xsession-errors w,
include if exists <local/xprop> include if exists <local/xprop>
} }

2
apparmor.d/groups/freedesktop/xwayland
View file

@ -18,8 +18,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup) peer=kwin_wayland, signal (receive) set=(term hup) peer=kwin_wayland,
signal (receive) set=(term hup) peer=login, signal (receive) set=(term hup) peer=login,
unix (send,receive) type=stream addr=none peer=(label=gnome-shell),
@{exec_path} mrix, @{exec_path} mrix,
@{sh_path} rix, @{sh_path} rix,

3
apparmor.d/groups/gnome/evolution-alarm-notify
View file

@ -12,11 +12,12 @@ profile evolution-alarm-notify @{exec_path} {
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/nameservice-strict>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/nameservice-strict>
network netlink raw, network netlink raw,

11
apparmor.d/groups/gnome/gdm
View file

@ -27,16 +27,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
ptrace (read) peer=unconfined, ptrace (read) peer=unconfined,
signal (send) set=(term) peer=dbus-accessibility, signal (send) set=(term),
signal (send) set=(term) peer=dbus-session,
signal (send) set=(term) peer=dconf-service,
signal (send) set=(term) peer=gdm-session-worker,
signal (send) set=(term) peer=gdm-session,
signal (send) set=(term) peer=gnome-session-binary,
signal (send) set=(term) peer=jackdbus,
signal (send) set=(term) peer=tracker-miner,
signal (send) set=(term) peer=xdg-*,
signal (send) set=(term) peer=xorg,
unix (bind, listen) type=stream addr="@/tmp/dbus-@{rand8}", unix (bind, listen) type=stream addr="@/tmp/dbus-@{rand8}",
unix (send receive accept) type=stream addr="@/tmp/dbus-@{rand8}" peer=(label=gdm-session-worker, addr=none), unix (send receive accept) type=stream addr="@/tmp/dbus-@{rand8}" peer=(label=gdm-session-worker, addr=none),

1
apparmor.d/groups/gnome/gjs-console
View file

@ -18,6 +18,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/bus/org.gnome.Shell.Introspect> include <abstractions/bus/org.gnome.Shell.Introspect>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-write> include <abstractions/fontconfig-cache-write>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>

8
apparmor.d/groups/gnome/gnome-characters-backgroudservice
View file

@ -11,19 +11,13 @@ profile gnome-characters-backgroudservice @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/wayland> include <abstractions/gnome-strict>
@{exec_path} mr, @{exec_path} mr,
@{bin}/gjs-console rix, @{bin}/gjs-console rix,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService.*.gresource r, /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService.*.gresource r,
/usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r,
/etc/gtk-3.0/settings.ini r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,

25
apparmor.d/groups/gnome/gnome-control-center
View file

@ -45,12 +45,12 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{bin}/locale rix, @{bin}/locale rix,
@{bin}/sed rix, @{bin}/sed rix,
@{bin}/bwrap rPUx, @{bin}/bwrap rCx -> bwrap,
@{bin}/gkbd-keyboard-display rPUx, @{bin}/gkbd-keyboard-display rPx,
@{bin}/gnome-software rPUx, @{bin}/gnome-software rPx,
@{bin}/openvpn rPx, @{bin}/openvpn rPx,
@{bin}/passwd rPx, @{bin}/passwd rPx,
@{bin}/pkexec rPx, @{bin}/pkexec rCx -> pkexec,
@{bin}/software-properties-gtk rPx, @{bin}/software-properties-gtk rPx,
@{bin}/usermod rPx, @{bin}/usermod rPx,
@{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKitNetworkProcess rPx, @{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKitNetworkProcess rPx,
@ -165,5 +165,22 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
profile bwrap {
include <abstractions/base>
include <abstractions/common/bwrap>
@{bin}/bwrap mr,
include if exists <local/gnome-control-center_bwrap>
}
profile pkexec {
include <abstractions/base>
@{bin}/pkexec mr,
include if exists <local/gnome-control-center_pkexec>
}
include if exists <local/gnome-control-center> include if exists <local/gnome-control-center>
} }

3
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -71,6 +71,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/usr/share/gdm/greeter/autostart/{,*.desktop} r, /usr/share/gdm/greeter/autostart/{,*.desktop} r,
/usr/share/gnome-session/hardware-compatibility r, /usr/share/gnome-session/hardware-compatibility r,
/usr/share/gnome-session/sessions/*.session r, /usr/share/gnome-session/sessions/*.session r,
/usr/share/gnome-shell/extensions/*/metadata.json r,
/usr/share/gnome/autostart/{,*.desktop} r, /usr/share/gnome/autostart/{,*.desktop} r,
@{etc_ro}/xdg/autostart/{,*.desktop} r, @{etc_ro}/xdg/autostart/{,*.desktop} r,
@ -141,7 +142,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx, @{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
@{lib}/caribou/caribou rPUx, @{lib}/caribou/caribou rPUx,
@{lib}/deja-dup/deja-dup-monitor rPx, @{lib}/deja-dup/deja-dup-monitor rPx,
@{lib}/gsd-disk-utility-notify rPx, @{lib}/gsd-* rPx,
@{lib}/update-notifier/ubuntu-advantage-notification rPx, @{lib}/update-notifier/ubuntu-advantage-notification rPx,
@{lib}/xapps/sn-watcher/* rPUx, @{lib}/xapps/sn-watcher/* rPUx,
@{thunderbird_path} rPx, @{thunderbird_path} rPx,

3
apparmor.d/groups/gnome/gnome-shell
View file

@ -80,7 +80,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
#aa:dbus own bus=session name=org.gnome.Shell #aa:dbus own bus=session name=org.gnome.Shell
#aa:dbus own bus=session name=com.canonical.Unity path=/com/canonical/{U,u}nity #aa:dbus own bus=session name=com.canonical.Unity path=/com/canonical/{U,u}nity
#aa:dbus own bus=session name=com.rastersoft.dingextension interface=org.gtk.Actions #aa:dbus own bus=session name=com.rastersoft.dingextension
#aa:dbus own bus=session name=org.gtk.Actions path=/**
#aa:dbus own bus=session name=org.gtk.MountOperationHandler #aa:dbus own bus=session name=org.gtk.MountOperationHandler
#aa:dbus own bus=session name=org.gtk.Notifications #aa:dbus own bus=session name=org.gtk.Notifications
#aa:dbus own bus=session name=org.kde.StatusNotifierWatcher path=/StatusNotifierWatcher #aa:dbus own bus=session name=org.kde.StatusNotifierWatcher path=/StatusNotifierWatcher

17
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -29,10 +29,11 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{bin}/lsblk rPx,
@{bin}/pkexec rPx,
@{bin}/sed rix,
@{sh_path} rix, @{sh_path} rix,
@{bin}/lsblk rPx,
@{bin}/pkexec rCx -> pkexec,
@{bin}/sed rix,
@{bin}/tr rix,
/usr/share/gnome-system-monitor/{,**} r, /usr/share/gnome-system-monitor/{,**} r,
/usr/share/firefox-esr/browser/chrome/icons/default/*.png r, /usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
@ -75,5 +76,15 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
/dev/tty rw,
profile pkexec {
include <abstractions/base>
@{bin}/pkexec mr,
include if exists <local/gnome-system-monitor_pkexec>
}
include if exists <local/gnome-system-monitor> include if exists <local/gnome-system-monitor>
} }

1
apparmor.d/groups/gnome/goa-identity-service
View file

@ -11,6 +11,7 @@ profile goa-identity-service @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/authentication> include <abstractions/authentication>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.MountTracker>
#aa:dbus own bus=session name=org.gnome.Identity #aa:dbus own bus=session name=org.gnome.Identity

1
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -46,6 +46,7 @@ profile gsd-xsettings @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/sed rix,
@{bin}/which{,.debianutils} rix, @{bin}/which{,.debianutils} rix,
@{bin}/busctl rPx, @{bin}/busctl rPx,

3
apparmor.d/groups/gnome/mutter-x11-frames
View file

@ -12,11 +12,14 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
signal (receive) set=(term) peer=gdm,
@{exec_path} mr, @{exec_path} mr,
/usr/share/dconf/profile/gdm r, /usr/share/dconf/profile/gdm r,

2
apparmor.d/groups/grub/grub-sort-version
View file

@ -9,8 +9,8 @@ include <tunables/global>
@{exec_path} = @{lib}/grub/grub-sort-version @{exec_path} = @{lib}/grub/grub-sort-version
profile grub-sort-version @{exec_path} { profile grub-sort-version @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/apt>
include <abstractions/python> include <abstractions/python>
include if exists <abstractions/common/apt>
capability dac_read_search, capability dac_read_search,

9
apparmor.d/groups/gvfs/gvfsd
View file

@ -13,14 +13,7 @@ profile gvfsd @{exec_path} {
include <abstractions/bus-session> include <abstractions/bus-session>
#aa:dbus own bus=session name=org.gtk.vfs.Daemon #aa:dbus own bus=session name=org.gtk.vfs.Daemon
#aa:dbus own bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
peer=(name=org.freedesktop.DBus),
dbus receive bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
peer=(name=:*), # all members
dbus send bus=session path=/org/gtk/vfs/mountable dbus send bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable interface=org.gtk.vfs.Mountable

2
apparmor.d/groups/gvfs/gvfsd-dnssd
View file

@ -15,7 +15,7 @@ profile gvfsd-dnssd @{exec_path} {
include <abstractions/bus/org.freedesktop.Avahi> include <abstractions/bus/org.freedesktop.Avahi>
include <abstractions/bus/org.gtk.vfs.MountTracker> include <abstractions/bus/org.gtk.vfs.MountTracker>
dbus bind bus=session name=org.gtk.vfs.mountpoint_dnssd, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_dnssd
dbus receive bus=session path=/org/gtk/vfs/Daemon dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon interface=org.gtk.vfs.Daemon

2
apparmor.d/groups/gvfs/gvfsd-network
View file

@ -13,7 +13,7 @@ profile gvfsd-network @{exec_path} {
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/dconf-write> include <abstractions/dconf-write>
dbus bind bus=session name=org.gtk.vfs.mountpoint_@{int}, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner interface=org.gtk.vfs.Spawner

21
apparmor.d/groups/gvfs/gvfsd-recent
View file

@ -10,10 +10,27 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-recent @{exec_path} = @{lib}/{,gvfs/}gvfsd-recent
profile gvfsd-recent @{exec_path} { profile gvfsd-recent @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-read> include <abstractions/thumbnails-cache-read>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=RegisterMount
peer=(name=:*, label=gvfsd),
@{exec_path} mr, @{exec_path} mr,
/usr/share/mime/mime.cache r, /usr/share/mime/mime.cache r,
# Full access to user's data # Full access to user's data
@ -27,10 +44,10 @@ profile gvfsd-recent @{exec_path} {
owner @{run}/user/@{uid}/gvfsd/ rw, owner @{run}/user/@{uid}/gvfsd/ rw,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
@{run}/mount/utab r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
@{run}/mount/utab r,
include if exists <local/gvfsd-recent> include if exists <local/gvfsd-recent>
} }

2
apparmor.d/groups/gvfs/gvfsd-smb-browse
View file

@ -21,7 +21,7 @@ profile gvfsd-smb-browse @{exec_path} {
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,
dbus bind bus=session name=org.gtk.vfs.mountpoint_smb_browse, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_smb_browse
dbus receive bus=session path=/org/gtk/vfs/mountable dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable interface=org.gtk.vfs.Mountable

2
apparmor.d/groups/gvfs/gvfsd-trash
View file

@ -19,7 +19,7 @@ profile gvfsd-trash @{exec_path} {
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
dbus bind bus=session name=org.gtk.vfs.mountpoint_@{int}, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
dbus receive bus=session path=/org/gtk/vfs/Daemon dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon interface=org.gtk.vfs.Daemon

2
apparmor.d/groups/kde/sddm-xsession
View file

@ -89,7 +89,7 @@ profile sddm-xsession @{exec_path} {
include if exists <local/sddm-xsession_dbus> include if exists <local/sddm-xsession_dbus>
} }
profile gpg { profile gpg {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>

4
apparmor.d/groups/systemd/systemd-cryptsetup
View file

@ -20,6 +20,8 @@ profile systemd-cryptsetup @{exec_path} {
/etc/fstab r, /etc/fstab r,
/var/swapfile rw, #aa:only whonix
@{run}/ r, @{run}/ r,
@{run}/cryptsetup/ r, @{run}/cryptsetup/ r,
@{run}/cryptsetup/* rwk, @{run}/cryptsetup/* rwk,
@ -31,5 +33,7 @@ profile systemd-cryptsetup @{exec_path} {
@{PROC}/devices r, @{PROC}/devices r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
/dev/loop-control r, #aa:only whonix
include if exists <local/systemd-cryptsetup> include if exists <local/systemd-cryptsetup>
} }

1
apparmor.d/groups/ubuntu/apport
View file

@ -29,6 +29,7 @@ profile apport @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{bin}/gdbus rix, @{bin}/gdbus rix,
@{bin}/{,e,f}grep rix,
@{bin}/dpkg rPx -> child-dpkg, @{bin}/dpkg rPx -> child-dpkg,
@{bin}/dpkg-divert rPx -> child-dpkg-divert, @{bin}/dpkg-divert rPx -> child-dpkg-divert,

5
apparmor.d/groups/ubuntu/apport-gtk
View file

@ -9,11 +9,12 @@ include <tunables/global>
@{exec_path} = /usr/share/apport/apport-gtk @{exec_path} = /usr/share/apport/apport-gtk
profile apport-gtk @{exec_path} { profile apport-gtk @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/apt>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/common/apt>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -49,6 +50,7 @@ profile apport-gtk @{exec_path} {
@{bin}/md5sum rix, @{bin}/md5sum rix,
@{bin}/pkexec rPx, # TODO: rCx or something @{bin}/pkexec rPx, # TODO: rCx or something
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,
@{bin}/systemd-detect-virt rPx,
@{bin}/which{,.debianutils} rix, @{bin}/which{,.debianutils} rix,
@{lib}/{,colord/}colord-sane rPx, @{lib}/{,colord/}colord-sane rPx,
@{lib}/@{multiarch}/ld*.so* rix, @{lib}/@{multiarch}/ld*.so* rix,
@ -58,6 +60,7 @@ profile apport-gtk @{exec_path} {
/usr/share/apport/general-hooks/*.py r, /usr/share/apport/general-hooks/*.py r,
/etc/apport/{,**} r, /etc/apport/{,**} r,
/etc/cloud/cloud.cfg.d/{,**} r,
/etc/bash_completion.d/apport_completion r, /etc/bash_completion.d/apport_completion r,
/etc/cron.daily/apport r, /etc/cron.daily/apport r,
/etc/default/apport r, /etc/default/apport r,

5
apparmor.d/groups/whonix/sensible-browser
View file

@ -17,7 +17,12 @@ profile sensible-browser @{exec_path} {
@{bin}/whichbrowser rix, @{bin}/whichbrowser rix,
@{bin}/x-www-browser rix, @{bin}/x-www-browser rix,
@{lib}/msgcollector/generic_gui_message rPx,
@{lib}/msgcollector/striphtml rPx,
@{bin}/torbrowser rPx, @{bin}/torbrowser rPx,
/etc/open_link_confirm.d/{,**} r,
include if exists <local/sensible-browser> include if exists <local/sensible-browser>
} }

4
apparmor.d/groups/whonix/whonix-firewall-restarter
View file

@ -33,9 +33,7 @@ profile whonix-firewall-restarter @{exec_path} {
/{run,var}/log/journal/ r, /{run,var}/log/journal/ r,
/{run,var}/log/journal/@{hex32}/ r, /{run,var}/log/journal/@{hex32}/ r,
/{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r, /{run,var}/log/journal/@{hex32}/*.journal* r,
/{run,var}/log/journal/@{hex32}/system.journal* r,
/{run,var}/log/journal/@{hex32}/system@@{hex}.journal* r,
owner /tmp/tmp.@{rand10} rw, owner /tmp/tmp.@{rand10} rw,

85
apparmor.d/profiles-m-r/mutt
View file

@ -26,10 +26,9 @@ profile mutt @{exec_path} {
# Used to exec programs defined in the mailcap. # Used to exec programs defined in the mailcap.
# There are countless programs that can be executed from the mailcap. # There are countless programs that can be executed from the mailcap.
# This profile includes only the most basic. # This profile includes only the most basic.
@{bin}/{,ba,da}sh rix, @{sh_path} rix,
@{bin}/sendmail rPUx, @{lib}/{,sendmail/}sendmail rPUx,
@{lib}/sendmail/sendmail rPUx,
@{bin}/ispell rPUx, @{bin}/ispell rPUx,
@{bin}/abook rPUx, @{bin}/abook rPUx,
@{bin}/mutt_dotlock rix, @{bin}/mutt_dotlock rix,
@ -41,34 +40,33 @@ profile mutt @{exec_path} {
@{bin}/vim rCx -> editor, @{bin}/vim rCx -> editor,
@{bin}/vim.* rCx -> editor, @{bin}/vim.* rCx -> editor,
@{bin}/sensible-editor rCx -> editor, @{bin}/sensible-editor rCx -> editor,
@{bin}/more rCx -> pager,
@{bin}/less rCx -> pager, @{bin}/less rPx -> child-pager,
@{bin}/pager rCx -> pager, @{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{bin}/gpg{2,} rCx -> gpg, @{bin}/gpg{2,} rCx -> gpg,
@{bin}/gpgconf rCx -> gpg, @{bin}/gpgconf rCx -> gpg,
@{bin}/gpgsm rCx -> gpg, @{bin}/gpgsm rCx -> gpg,
@{bin}/pgpewrap rCx -> gpg, @{bin}/pgpewrap rCx -> gpg,
/usr/share/terminfo/** r, /usr/share/terminfo/** r,
/usr/share/mutt/** r,
# Mutt MIME types search path @{etc_ro}/mailcap r,
/etc/mime.types r, /etc/mime.types r,
owner @{HOME}/.mime.types r, /etc/mutt{,**} r,
/etc/Muttrc r,
/etc/Muttrc.d/{*,} r,
# Mutt mailcap search path owner @{HOME}/.mail_aliases r, # Common location for mail aliases
/etc/{mutt/,}mailcap r,
/usr/etc/mailcap r,
owner @{HOME}/.mailcap r, owner @{HOME}/.mailcap r,
owner @{HOME}/.mime.types r,
# Mutt config files owner @{HOME}/.mutt_certificates rwk,
/usr/share/mutt/** r, owner @{HOME}/.mutt/{,**} r,
/etc/{mutt/,}Muttrc r, owner @{HOME}/.mutthistory rwk,
/etc/{mutt/,}Muttrc.d/{*,} r, owner @{HOME}/.muttrc* r,
owner @{HOME}/.mutt/** r, owner @{HOME}/.signature r, # Mutt signature file
owner @{HOME}/.muttrc* r,
# Needed for the edit operation.
owner @{HOME}/ r,
# User mbox # User mbox
# Could be a file or dir depending on mbox_type variable # Could be a file or dir depending on mbox_type variable
@ -76,24 +74,14 @@ profile mutt @{exec_path} {
owner @{HOME}/{mbox,postponed,sent}* rwlk, owner @{HOME}/{mbox,postponed,sent}* rwlk,
owner @{HOME}/{mbox,postponed,sent}/ rw, owner @{HOME}/{mbox,postponed,sent}/ rw,
owner @{HOME}/{mbox,postponed,sent}/** rwlk, owner @{HOME}/{mbox,postponed,sent}/** rwlk,
owner @{user_config_dirs}/mutt/{,**} r,
owner @{user_cache_dirs}/mutt rwk,
# User maildir # User maildir
owner @{user_mail_dirs}/ rw, owner @{user_mail_dirs}/ rw,
owner @{user_mail_dirs}/** rwlk -> @{user_mail_dirs}/**, owner @{user_mail_dirs}/** rwlk -> @{user_mail_dirs}/**,
# Trusted certificate store
owner @{HOME}/.mutt_certificates rwk,
# Mutt history file
owner @{HOME}/.mutthistory rwk,
# Mutt signature file
owner @{HOME}/.signature r,
# Common location for mail aliases
owner @{HOME}/.mail_aliases r,
owner @{HOME}/.cache/mutt rwk,
# Needed to compose a message # Needed to compose a message
owner /{var/,}tmp/.mutt*/ rw, owner /{var/,}tmp/.mutt*/ rw,
owner /{var/,}tmp/.mutt*/* lrwk, owner /{var/,}tmp/.mutt*/* lrwk,
@ -137,35 +125,14 @@ profile mutt @{exec_path} {
# Vim swap file # Vim swap file
owner @{HOME}/ r, owner @{HOME}/ r,
owner @{HOME}/.cache/ r, owner @{user_cache_dirs}/ r,
owner @{HOME}/.cache/vim/** wr, owner @{user_cache_dirs}/vim/** wr,
# This is the file that holds the message # This is the file that holds the message
owner /{var/,}tmp/{.,}mutt* rw, owner /{var/,}tmp/{.,}mutt* rw,
include if exists <local/mutt_editor> include if exists <local/mutt_editor>
} }
profile pager {
include <abstractions/base>
include <abstractions/consoles>
/usr/share/terminfo/** r,
/usr/share/file/misc/magic.mgc r,
@{bin}/less mr,
@{bin}/more mr,
@{bin}/pager mr,
owner @{HOME}/.lesshs* r,
owner @{HOME}/.local/state/ r,
owner @{HOME}/.local/state/less* rw,
# This is the file that holds the message
owner /{var/,}tmp/mutt* rw,
include if exists <local/mutt_pager>
}
profile gpg { profile gpg {
include <abstractions/base> include <abstractions/base>

62
apparmor.d/profiles-m-r/nemo
View file

@ -10,77 +10,19 @@ include <tunables/global>
@{exec_path} = @{bin}/nemo @{exec_path} = @{bin}/nemo
profile nemo @{exec_path} { profile nemo @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/gtk> include <abstractions/desktop>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
# This should be tightened when the "profile has merged rule with conflicting x modifiers" error
# will be fixed. (#FIXME#)
include <abstractions/app-launcher-user>
include <abstractions/app-launcher-root>
# For root window
deny capability dac_read_search,
deny capability dac_override,
# Needed?
deny capability sys_nice,
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@{exec_path} mr, @{exec_path} mr,
@{lib}/@{multiarch}/nemo/** mrix, # @{lib}/@{multiarch}/nemo/** mrix,
@{lib}/gvfsd-* rPx,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
# To read/write files in the system. The read permission is granted for all files, the write
# permission only for the owner. Also, dirs like /dev/, /efi/, /proc/, /sys/ are not included in
# the list.
/ r,
/boot/ r,
/boot/** r,
owner /boot/** rw,
/etc/ r,
/etc/** r,
owner /etc/** rw,
/home/ r,
/home/** r,
owner /home/** rw,
/lost+found/ r,
/lost+found/** r,
owner /lost+found/** rw,
@{MOUNTS}/ r,
@{MOUNTS}/** r,
owner @{MOUNTS}/** rw,
/opt/ r,
/opt/** r,
owner /opt/** rw,
/root/ r,
/root/** r,
owner /root/** rw,
@{run}/ r,
@{run}/** r,
owner @{run}/** rw,
/srv/ r,
/srv/** r,
owner /srv/** rw,
/tmp/ r,
/tmp/** r,
owner /tmp/** rw,
/usr/ r,
/usr/** r,
owner /usr/** rw,
/var/ r,
/var/** r,
owner /var/** rw,
include if exists <local/nemo> include if exists <local/nemo>
} }

2
apparmor.d/profiles-m-r/packagekitd
View file

@ -13,9 +13,9 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.login1> include <abstractions/bus/org.freedesktop.login1>
include <abstractions/bus/org.freedesktop.NetworkManager> include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/bus/org.freedesktop.PolicyKit1> include <abstractions/bus/org.freedesktop.PolicyKit1>
include <abstractions/common/apt> #aa:only apt
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include if exists <abstractions/common/apt>
capability chown, capability chown,
capability dac_override, capability dac_override,

1
apparmor.d/profiles-m-r/power-profiles-daemon
View file

@ -21,6 +21,7 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) {
network netlink raw, network netlink raw,
#aa:dbus own bus=system name=net.hadess.PowerProfiles #aa:dbus own bus=system name=net.hadess.PowerProfiles
#aa:dbus own bus=system name=org.freedesktop.UPower.PowerProfiles
@{exec_path} mr, @{exec_path} mr,

3
apparmor.d/profiles-s-z/snap
View file

@ -28,6 +28,9 @@ profile snap @{exec_path} {
mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-@{int}/, mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-@{int}/,
#aa:dbus own bus=session name=io.snapcraft.Launcher
#aa:dbus own bus=session name=io.snapcraft.Settings
dbus send bus=session path=/org/freedesktop/systemd1 dbus send bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager interface=org.freedesktop.systemd1.Manager
member=StartTransientUnit member=StartTransientUnit

1
apparmor.d/profiles-s-z/spice-vdagent
View file

@ -18,6 +18,7 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/bus/org.freedesktop.RealtimeKit1> include <abstractions/bus/org.freedesktop.RealtimeKit1>
include <abstractions/bus/org.gnome.Mutter.DisplayConfig> include <abstractions/bus/org.gnome.Mutter.DisplayConfig>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dri> include <abstractions/dri>
include <abstractions/fontconfig-cache-write> include <abstractions/fontconfig-cache-write>
include <abstractions/fonts> include <abstractions/fonts>

6
apparmor.d/profiles-s-z/wireplumber
View file

@ -35,10 +35,13 @@ profile wireplumber @{exec_path} {
/opt/intel/oneapi/{compiler,lib,mkl}/**/ r, /opt/intel/oneapi/{compiler,lib,mkl}/**/ r,
/opt/intel/oneapi/{compiler,lib,mkl}/**.so* mr, /opt/intel/oneapi/{compiler,lib,mkl}/**.so* mr,
/usr/share/alsa/{,**} r,
/usr/share/alsa-card-profile/{,**} r, /usr/share/alsa-card-profile/{,**} r,
/usr/share/spa-*/bluez@{int}/{,*} r, /usr/share/spa-*/bluez@{int}/{,*} r,
/usr/share/wireplumber/{,**} r, /usr/share/wireplumber/{,**} r,
/etc/alsa/conf.d/{,**} r,
/etc/machine-id r, /etc/machine-id r,
owner @{desktop_local_dirs}/ w, owner @{desktop_local_dirs}/ w,
@ -49,6 +52,8 @@ profile wireplumber @{exec_path} {
owner @{user_state_dirs}/ w, owner @{user_state_dirs}/ w,
owner @{user_state_dirs}/wireplumber/{,**} rw, owner @{user_state_dirs}/wireplumber/{,**} rw,
owner @{run}/user/@{uid}/pipewire-@{int} rw,
@{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{uid} r,
@{run}/udev/data/c14:@{int} r, # Open Sound System (OSS) @{run}/udev/data/c14:@{int} r, # Open Sound System (OSS)
@ -69,7 +74,6 @@ profile wireplumber @{exec_path} {
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,
/dev/media@{int} rw, /dev/media@{int} rw,
/dev/snd/ r,
include if exists <local/wireplumber> include if exists <local/wireplumber>
} }

13
apparmor.d/profiles-s-z/yadifad
View file

@ -1,9 +1,10 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
include <tunables/global> include <tunables/global>
@{exec_path} = /{,usr/}{,s}bin/yadifad @{exec_path} = @{bin}/yadifad
profile yadifad @{exec_path} { profile yadifad @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -22,16 +23,12 @@ profile yadifad @{exec_path} {
/etc/yadifa/yadifad.conf r, /etc/yadifa/yadifad.conf r,
/var/lib/yadifa/** r, /var/log/yadifa/{,**} rw,
owner /var/lib/yadifa/ydf.@{rand6} rw,
owner /var/lib/yadifa/keys/ydf.@{rand6} rw,
owner /var/lib/yadifa/xfr/ydf.@{rand6} rw,
/var/log/yadifa/*.log rw, owner /var/lib/yadifa/{,**} rw,
/var/log/yadifa/ydf.@{rand6} rw,
owner @{run}/yadifa/{,*} rw,
owner @{run}/yadifa/yadifad.pid rwk, owner @{run}/yadifa/yadifad.pid rwk,
owner @{run}/yadifa/ydf.@{rand6} rw,
include if exists <local/yadifad> include if exists <local/yadifad>
} }