feat(profile): general update.

This commit is contained in:
Alexandre Pujol 2024-03-11 22:47:22 +00:00
parent 0a9021bcf1
commit 0eeefb5f09
Failed to generate hash of commit
11 changed files with 36 additions and 61 deletions

View file

@ -14,10 +14,17 @@ profile apt-helper @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/nm-online rPx, @{bin}/nm-online rPx,
@{bin}/systemctl rPx -> child-systemctl, @{bin}/systemctl rCx -> systemctl,
@{lib}/systemd/systemd-networkd-wait-online rPx, @{lib}/systemd/systemd-networkd-wait-online rPx,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include if exists <local/apt-helper_systemctl>
}
include if exists <local/apt-helper> include if exists <local/apt-helper>
} }

View file

@ -15,6 +15,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup kill) peer=dbus-daemon, signal (receive) set=(term hup kill) peer=dbus-daemon,
signal (receive) set=(term hup kill) peer=gdm*, signal (receive) set=(term hup kill) peer=gdm*,
signal (receive) set=(kill) peer=gdm-wayland-session//dbus,
# dbus: own bus=session name=org.freedesktop.impl.portal.PermissionStore # dbus: own bus=session name=org.freedesktop.impl.portal.PermissionStore

View file

@ -87,6 +87,8 @@ profile gdm-xsession @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/systemctl> include <abstractions/systemctl>
owner /dev/tty@{int} rw,
include if exists <local/gdm-xsession_systemctl> include if exists <local/gdm-xsession_systemctl>
} }

View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/gnome-shell @{exec_path} = @{bin}/gnome-shell
profile gnome-shell @{exec_path} flags=(attach_disconnected) { profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app-launcher-user> include <abstractions/app-launcher-user>
include <abstractions/audio> include <abstractions/audio>

View file

@ -27,8 +27,6 @@ profile gnome-software @{exec_path} {
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/, mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/, umount /var/tmp/flatpak-cache-*/*/,
signal (receive) set=(cont, term) peer=systemd-user,
@{exec_path} mr, @{exec_path} mr,
@{bin}/baobab rPUx, @{bin}/baobab rPUx,

View file

@ -17,6 +17,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/private-files-strict> include <abstractions/private-files-strict>
include <abstractions/video> include <abstractions/video>
include <abstractions/openssl>
network netlink raw, network netlink raw,
@ -28,6 +29,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
/usr/share/poppler/{,**} r, /usr/share/poppler/{,**} r,
/usr/share/sushi/org.gnome.NautilusPreviewer.*.gresource r, /usr/share/sushi/org.gnome.NautilusPreviewer.*.gresource r,
/usr/share/ladspa/rdf/{,**} r,
/etc/machine-id r, /etc/machine-id r,

View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-logind @{exec_path} = @{lib}/systemd/systemd-logind
profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) { profile systemd-logind @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.PolicyKit1> include <abstractions/bus/org.freedesktop.PolicyKit1>

View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-networkd @{exec_path} = @{lib}/systemd/systemd-networkd
profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) { profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.hostname1> include <abstractions/bus/org.freedesktop.hostname1>

View file

@ -66,6 +66,7 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/@{pci}/**/{uevent,name} r, @{sys}/devices/@{pci}/**/{uevent,name} r,
@{sys}/devices/platform/**/rfkill/**/name r, @{sys}/devices/platform/**/rfkill/**/name r,
@{sys}/devices/virtual/dmi/id/chassis_type r, @{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/virtual/misc/uhid/**/uevent r,
@{PROC}/sys/kernel/hostname r, @{PROC}/sys/kernel/hostname r,

View file

@ -10,14 +10,12 @@ include <tunables/global>
@{exec_path} = @{bin}/utox @{exec_path} = @{bin}/utox
profile utox @{exec_path} { profile utox @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/user-download-strict>
include <abstractions/nameservice-strict>
include <abstractions/audio> include <abstractions/audio>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/video> include <abstractions/video>
network inet dgram, network inet dgram,
@ -28,43 +26,16 @@ profile utox @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/xdg-open rCx -> open, @{open_path} rCx -> child-open,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{HOME}/ r, owner @{HOME}/ r,
owner @{user_config_dirs}/tox/ rw, owner @{user_config_dirs}/tox/ rw,
owner @{user_config_dirs}/tox/** rw, owner @{user_config_dirs}/tox/** rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
deny owner @{PROC}/@{pid}/cmdline r, deny owner @{PROC}/@{pid}/cmdline r,
profile open {
include <abstractions/base>
include <abstractions/xdg-open>
@{bin}/xdg-open mr,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,
@{bin}/readlink rix,
@{bin}/basename rix,
owner @{HOME}/ r,
owner @{run}/user/@{uid}/ r,
# Allowed apps to open
@{lib}/firefox/firefox rPUx,
@{bin}/viewnior rPUx,
# file_inherit
owner @{HOME}/.xsession-errors w,
owner @{user_config_dirs}/tox/[0-9A-F].ftinfo w,
owner @{user_config_dirs}/tox/[0-9A-F].ftoutfo w,
deny /dev/video@{int} rw,
}
include if exists <local/utox> include if exists <local/utox>
} }

View file

@ -10,35 +10,28 @@ include <tunables/global>
@{exec_path} = @{bin}/volumeicon @{exec_path} = @{bin}/volumeicon
profile volumeicon @{exec_path} { profile volumeicon @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/X>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/audio> include <abstractions/audio>
include <abstractions/dri-enumerate> include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/desktop>
include <abstractions/mesa> include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/wayland>
@{exec_path} mr, @{exec_path} mr,
# Volumeicon files
/usr/share/volumeicon/** r,
# Volumeicon config files
owner @{user_config_dirs}/volumeicon/ rw,
owner @{user_config_dirs}/volumeicon/volumeicon* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
# Start the PulseAudio sound mixer # Start the PulseAudio sound mixer
@{sh_path} rix, @{sh_path} rix,
@{bin}/pavucontrol rPUx, @{bin}/pavucontrol rPUx,
@{bin}/pulseeffects rPUx, @{bin}/pulseeffects rPUx,
# file_inherit /usr/share/volumeicon/** r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{user_config_dirs}/volumeicon/ rw,
owner @{user_config_dirs}/volumeicon/volumeicon* rw,
owner /dev/tty@{int} rw, owner /dev/tty@{int} rw,
include if exists <local/volumeicon> include if exists <local/volumeicon>