mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-31 07:17:22 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-11 22:47:22 +00:00
parent 0a9021bcf1
commit 0eeefb5f09
Failed to generate hash of commit
11 changed files with 36 additions and 61 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/apt/apt-helper
View file

@ -14,10 +14,17 @@ profile apt-helper @{exec_path} {
@{exec_path} mr,
@{bin}/nm-online rPx,
@{bin}/systemctl rPx -> child-systemctl,
@{bin}/systemctl rCx -> systemctl,
@{lib}/systemd/systemd-networkd-wait-online rPx,
owner @{PROC}/@{pid}/fd/ r,
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include if exists <local/apt-helper_systemctl>
}
include if exists <local/apt-helper>
}

1
apparmor.d/groups/freedesktop/xdg-permission-store
View file

@ -15,6 +15,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup kill) peer=dbus-daemon,
signal (receive) set=(term hup kill) peer=gdm*,
signal (receive) set=(kill) peer=gdm-wayland-session//dbus,
# dbus: own bus=session name=org.freedesktop.impl.portal.PermissionStore

2
apparmor.d/groups/gnome/gdm-xsession
View file

@ -87,6 +87,8 @@ profile gdm-xsession @{exec_path} {
include <abstractions/base>
include <abstractions/systemctl>
owner /dev/tty@{int} rw,
include if exists <local/gdm-xsession_systemctl>
}

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/gnome-shell
profile gnome-shell @{exec_path} flags=(attach_disconnected) {
profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio>

2
apparmor.d/groups/gnome/gnome-software
View file

@ -27,8 +27,6 @@ profile gnome-software @{exec_path} {
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/,
signal (receive) set=(cont, term) peer=systemd-user,
@{exec_path} mr,
@{bin}/baobab rPUx,

2
apparmor.d/groups/gnome/org.gnome.NautilusPreviewer
View file

@ -17,6 +17,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/private-files-strict>
include <abstractions/video>
include <abstractions/openssl>
network netlink raw,
@ -28,6 +29,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
/usr/share/poppler/{,**} r,
/usr/share/sushi/org.gnome.NautilusPreviewer.*.gresource r,
/usr/share/ladspa/rdf/{,**} r,
/etc/machine-id r,

2
apparmor.d/groups/systemd/systemd-logind
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-logind
profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
profile systemd-logind @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.PolicyKit1>

2
apparmor.d/groups/systemd/systemd-networkd
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-networkd
profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.hostname1>

1
apparmor.d/profiles-a-f/bluetoothd
View file

@ -66,6 +66,7 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/@{pci}/**/{uevent,name} r,
@{sys}/devices/platform/**/rfkill/**/name r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/virtual/misc/uhid/**/uevent r,
@{PROC}/sys/kernel/hostname r,

47
apparmor.d/profiles-s-z/utox
View file

@ -10,14 +10,12 @@ include <tunables/global>
@{exec_path} = @{bin}/utox
profile utox @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/user-download-strict>
include <abstractions/nameservice-strict>
include <abstractions/audio>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/video>
network inet dgram,
@ -28,43 +26,16 @@ profile utox @{exec_path} {
@{exec_path} mr,
@{bin}/xdg-open rCx -> open,
@{open_path} rCx -> child-open,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{HOME}/ r,
owner @{user_config_dirs}/tox/ rw,
owner @{user_config_dirs}/tox/** rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
deny owner @{PROC}/@{pid}/cmdline r,
profile open {
include <abstractions/base>
include <abstractions/xdg-open>
@{bin}/xdg-open mr,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,
@{bin}/readlink rix,
@{bin}/basename rix,
owner @{HOME}/ r,
owner @{run}/user/@{uid}/ r,
# Allowed apps to open
@{lib}/firefox/firefox rPUx,
@{bin}/viewnior rPUx,
# file_inherit
owner @{HOME}/.xsession-errors w,
owner @{user_config_dirs}/tox/[0-9A-F].ftinfo w,
owner @{user_config_dirs}/tox/[0-9A-F].ftoutfo w,
deny /dev/video@{int} rw,
}
include if exists <local/utox>
}

27
apparmor.d/profiles-s-z/volumeicon
View file

@ -10,35 +10,28 @@ include <tunables/global>
@{exec_path} = @{bin}/volumeicon
profile volumeicon @{exec_path} {
include <abstractions/base>
include <abstractions/X>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/audio>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/desktop>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/wayland>
@{exec_path} mr,
# Volumeicon files
/usr/share/volumeicon/** r,
# Volumeicon config files
owner @{user_config_dirs}/volumeicon/ rw,
owner @{user_config_dirs}/volumeicon/volumeicon* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
# Start the PulseAudio sound mixer
@{sh_path} rix,
@{bin}/pavucontrol rPUx,
@{bin}/pulseeffects rPUx,
# file_inherit
/usr/share/volumeicon/** r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{user_config_dirs}/volumeicon/ rw,
owner @{user_config_dirs}/volumeicon/volumeicon* rw,
owner /dev/tty@{int} rw,
include if exists <local/volumeicon>