mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(dbus): add more dbus abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-04 18:58:03 +00:00
parent 2432414ae2
commit 16c2bf5662
Failed to generate hash of commit
24 changed files with 60 additions and 76 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/abstractions/bus/vfs/daemon Normal file
View file

@ -0,0 +1,10 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member={ListMonitorImplementations,ListMountableInfo}
peer=(name=:*, label=gvfsd),
include if exists <abstractions/bus/vfs/daemon.d>

15
apparmor.d/abstractions/bus/vfs/metadata Normal file
View file

@ -0,0 +1,15 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
dbus send bus=session path=/org/gtk/vfs/metadata
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gvfsd-metadata),
dbus receive bus=session path=/org/gtk/vfs/metadata
interface=org.gtk.vfs.Metadata
member=AttributeChanged
peer=(name=:*, label=gvfsd-metadata),
include if exists <abstractions/bus/vfs/metadata.d>

7
apparmor.d/abstractions/bus/vfs → apparmor.d/abstractions/bus/vfs/mount
View file

@ -12,9 +12,4 @@
member=ListMounts2
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=ListMonitorImplementations
peer=(name=:*, label=gvfsd),
include if exists <abstractions/bus/vfs.d>
include if exists <abstractions/bus/vfs/mount.d>

6
apparmor.d/groups/apps/calibre
View file

@ -16,6 +16,7 @@ include <tunables/global>
profile calibre @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs/mount>
include <abstractions/chromium-common>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
@ -48,11 +49,6 @@ profile calibre @{exec_path} {
unix (bind, listen) type=stream addr="@*-calibre-gui.socket",
unix (bind) type=stream addr="@calibre-*",
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*),
@{exec_path} mrix,
@{bin}/python3.[0-9]* r,

19
apparmor.d/groups/apt/apt
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile apt @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/apt-common>
include <abstractions/bus/login>
include <abstractions/bus/polkit>
include <abstractions/consoles>
include <abstractions/dbus-strict>
@ -36,6 +37,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
unix (send, receive) type=stream peer=(label=apt-esm-json-hook),
unix (send, receive) type=stream peer=(label=snapd),
dbus bind bus=system name=org.debian.apt,
dbus (send, receive) bus=system path=/org/debian/apt{,/transaction/@{hex}}
interface=org.{debian.apt*,freedesktop.DBus.{Properties,Introspectable}},
@ -44,22 +47,6 @@ profile apt @{exec_path} flags=(attach_disconnected) {
member={StateHasChanged,Introspect}
peer=(name=org.freedesktop.PackageKit),
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Inhibit
peer=(name=org.freedesktop.login1),
dbus send bus=system path=/org/freedesktop/DBus{,/Bus}
interface=org.freedesktop.DBus{,.Introspectable}
member={RequestName,GetConnectionUnixProcessID,Introspect}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.{DBus.Introspectable,PolicyKit1.Authority}
member={CheckAuthorization,Introspect},
dbus bind bus=system name=org.debian.apt,
@{exec_path} mr,
@{bin}/ r,

1
apparmor.d/groups/apt/unattended-upgrade
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/apt-common>
include <abstractions/bus/login>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>

5
apparmor.d/groups/apt/unattended-upgrade-shutdown
View file

@ -15,11 +15,6 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
include <abstractions/nameservice-strict>
include <abstractions/python>
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=PrepareForShutdown
peer=(name=:*, label=systemd-logind),
@{exec_path} mr,
@{bin}/ischroot rix,

9
apparmor.d/groups/bus/ibus-daemon
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/ibus-daemon
profile ibus-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/ibus>
include <abstractions/nameservice-strict>
@ -21,6 +21,9 @@ profile ibus-daemon @{exec_path} flags=(attach_disconnected) {
unix (send, receive, accept) type=stream addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????" peer=(label=ibus-*),
unix (send, receive, accept) type=stream addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????" peer=(label=gnome-shell),
dbus bind bus=session name=org.freedesktop.portal.IBus,
dbus bind bus=session name=org.freedesktop.IBus,
dbus send bus=session path=/org/freedesktop/IBus
interface=org.freedesktop.DBus.Peer
peer=(name=org.freedesktop.portal.IBus), # all members, all peer's labels
@ -30,10 +33,6 @@ profile ibus-daemon @{exec_path} flags=(attach_disconnected) {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session name=org.freedesktop.portal.IBus,
dbus bind bus=session name=org.freedesktop.IBus,
@{exec_path} mrix,
@{bin}/{,ba,da}sh rix,

2
apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
View file

@ -11,7 +11,7 @@ profile xdg-desktop-portal-gtk @{exec_path} {
include <abstractions/base>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>

2
apparmor.d/groups/gnome/evolution-addressbook-factory
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile evolution-addressbook-factory @{exec_path} {
include <abstractions/base>
include <abstractions/bus/network-manager>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>

2
apparmor.d/groups/gnome/evolution-source-registry
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,evolution-data-server/}evolution-source-registry
profile evolution-source-registry @{exec_path} {
include <abstractions/base>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>

18
apparmor.d/groups/gnome/gnome-extension-ding
View file

@ -10,7 +10,9 @@ include <tunables/global>
profile gnome-extension-ding @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/daemon>
include <abstractions/bus/vfs/metadata>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -52,20 +54,6 @@ profile gnome-extension-ding @{exec_path} {
member=GetAll
peer=(name=:*, label=nautilus),
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=ListMonitorImplementations
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/metadata
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gvfsd-metadata),
dbus receive bus=session path=/org/gtk/vfs/metadata
interface=org.gtk.vfs.Metadata
member=AttributeChanged
peer=(name=:*, label=gvfsd-metadata),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus.Introspectable
member=Introspect

5
apparmor.d/groups/gnome/gnome-shell
View file

@ -13,10 +13,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/audio>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/bus/upower>
include <abstractions/bus/network-manager>
include <abstractions/bus/polkit>
include <abstractions/bus/vfs>
include <abstractions/bus/upower>
include <abstractions/bus/vfs/metadata>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>

2
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -10,7 +10,9 @@ include <tunables/global>
profile gnome-terminal-server @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs/mount>
include <abstractions/consoles>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/fonts>

2
apparmor.d/groups/gnome/gsd-housekeeping
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/thumbnails-cache-read>

2
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>

2
apparmor.d/groups/gnome/gsd-wacom
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>

8
apparmor.d/groups/gnome/tracker-miner
View file

@ -10,7 +10,8 @@ include <tunables/global>
profile tracker-miner @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/upower>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/daemon>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -33,11 +34,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.{Peer,Properties}
peer=(name=:*),
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member={ListMonitorImplementations,ListMountableInfo}
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
interface=org.gtk.Private.RemoteVolumeMonitor
member={List,IsSupported}

7
apparmor.d/groups/gvfs/gvfsd-dnssd
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-dnssd
profile gvfsd-dnssd @{exec_path} {
include <abstractions/base>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -37,13 +37,12 @@ profile gvfsd-dnssd @{exec_path} {
member=Mount
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/[0-9]*
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=:*, label=gvfsd),
dbus bind bus=session
name=org.gtk.vfs.mountpoint_dnssd,
dbus bind bus=session name=org.gtk.vfs.mountpoint_dnssd,
@{exec_path} mr,

2
apparmor.d/groups/gvfs/gvfsd-fuse
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-fuse
profile gvfsd-fuse @{exec_path} {
include <abstractions/base>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse//fusermount),

2
apparmor.d/groups/gvfs/gvfsd-network
View file

@ -13,7 +13,7 @@ profile gvfsd-network @{exec_path} {
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/[0-9]*
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=:*, label=gvfsd),

4
apparmor.d/groups/gvfs/gvfsd-smb-browse
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-smb-browse
profile gvfsd-smb-browse @{exec_path} {
include <abstractions/base>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>
@ -33,7 +33,7 @@ profile gvfsd-smb-browse @{exec_path} {
member=Mount
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/[0-9]*
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=:*, label=gvfsd),

2
apparmor.d/profiles-a-f/atril
View file

@ -11,7 +11,7 @@ include <tunables/global>
profile atril @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>

2
apparmor.d/profiles-a-f/engrampa
View file

@ -11,7 +11,7 @@ include <tunables/global>
profile engrampa @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>