From 17806e9ee7a2263a6ed91930de468425691f0fc1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 9 Apr 2021 14:47:06 +0100 Subject: [PATCH] Profiles update and general fixes. --- apparmor.d/abstractions/mesa.d/complete | 11 +++++++++++ apparmor.d/groups/browsers/chrome-gnome-shell | 9 ++++++--- apparmor.d/groups/desktop/blueman | 1 + apparmor.d/groups/desktop/colord | 2 ++ apparmor.d/groups/desktop/dbus-daemon | 1 + apparmor.d/groups/desktop/xwayland | 7 ------- apparmor.d/groups/gnome/evolution-source-registry | 2 +- apparmor.d/groups/gnome/gjs-console | 8 ++++---- apparmor.d/groups/gnome/gnome-contacts | 3 +++ apparmor.d/groups/gnome/gnome-shell | 12 ++++++++++++ apparmor.d/profiles-a-l/aa-notify | 4 ++-- 11 files changed, 43 insertions(+), 17 deletions(-) create mode 100644 apparmor.d/abstractions/mesa.d/complete diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete new file mode 100644 index 00000000..57004a65 --- /dev/null +++ b/apparmor.d/abstractions/mesa.d/complete @@ -0,0 +1,11 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + # Extra Mesa rules for GDM + /var/lib/gdm/.cache/ w, + /var/lib/gdm/.cache/mesa_shader_cache/ rw, + /var/lib/gdm/.cache/mesa_shader_cache/index rw, + /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw, + /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* rw, + /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]*.tmp rwk, diff --git a/apparmor.d/groups/browsers/chrome-gnome-shell b/apparmor.d/groups/browsers/chrome-gnome-shell index 5514c9bc..e968d823 100644 --- a/apparmor.d/groups/browsers/chrome-gnome-shell +++ b/apparmor.d/groups/browsers/chrome-gnome-shell @@ -9,11 +9,10 @@ include @{exec_path} = /{usr/,}bin/chrome-gnome-shell profile chrome-gnome-shell @{exec_path} { include - include include - include - include include + include + include network inet dgram, network inet6 dgram, @@ -25,6 +24,10 @@ profile chrome-gnome-shell @{exec_path} { /usr/share/glib-2.0/schemas/gschemas.compiled r, + include + owner @{run}/user/[0-9]*/dconf/ rw, + owner @{run}/user/[0-9]*/dconf/user rw, + owner @{PROC}/@{pid}/mounts r, include if exists diff --git a/apparmor.d/groups/desktop/blueman b/apparmor.d/groups/desktop/blueman index 9f9f7a92..027f633e 100644 --- a/apparmor.d/groups/desktop/blueman +++ b/apparmor.d/groups/desktop/blueman @@ -34,6 +34,7 @@ profile blueman @{exec_path} { /{usr/,}bin/xdg-open rCx -> open, /usr/share/blueman/{,**} r, + /usr/share/X11/xkb/{,**} r, owner @{user_cache_dirs}/blueman-tray-[0-9]* rw, owner @{user_cache_dirs}/blueman-services-[0-9]* rw, diff --git a/apparmor.d/groups/desktop/colord b/apparmor.d/groups/desktop/colord index d5ec5480..aee44656 100644 --- a/apparmor.d/groups/desktop/colord +++ b/apparmor.d/groups/desktop/colord @@ -45,5 +45,7 @@ profile colord @{exec_path} flags=(attach_disconnected) { @{user_share_dirs}/icc/edid-*.icc r, + @{run}/systemd/sessions/[0-9] r, + include if exists } diff --git a/apparmor.d/groups/desktop/dbus-daemon b/apparmor.d/groups/desktop/dbus-daemon index 78f0bf68..0bd32093 100644 --- a/apparmor.d/groups/desktop/dbus-daemon +++ b/apparmor.d/groups/desktop/dbus-daemon @@ -37,6 +37,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) { /usr/share/defaults/**.conf r, owner @{user_share_dirs}/dbus-1/{,**} r, + owner @{user_share_dirs}/icc/{,edid-*.icc} r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_score_adj rw, diff --git a/apparmor.d/groups/desktop/xwayland b/apparmor.d/groups/desktop/xwayland index 4875c470..cea447ad 100644 --- a/apparmor.d/groups/desktop/xwayland +++ b/apparmor.d/groups/desktop/xwayland @@ -31,13 +31,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) { /dev/tty[0-9]* rw, /dev/tty rw, - # Extra Mesa rules for GDM - owner /var/lib/gdm/.cache/ w, - owner /var/lib/gdm/.cache/mesa_shader_cache/ r, - owner /var/lib/gdm/.cache/mesa_shader_cache/index rw, - owner /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ r, - owner /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* r, - # Needed for Mutter owner @{run}/user/@{pid}/.mutter-Xwaylandauth.[a-zA-z0-9]* rw, diff --git a/apparmor.d/groups/gnome/evolution-source-registry b/apparmor.d/groups/gnome/evolution-source-registry index dd9e07a3..56278204 100644 --- a/apparmor.d/groups/gnome/evolution-source-registry +++ b/apparmor.d/groups/gnome/evolution-source-registry @@ -22,7 +22,7 @@ profile evolution-source-registry @{exec_path} { @{exec_path} mr, /usr/share/glib-2.0/schemas/gschemas.compiled r, - owner @{user_config_dirs}/evolution/sources/{,*} r, + owner @{user_config_dirs}/evolution/sources/{,*} rw, owner @{user_share_dirs}/evolution/{,**} r, owner @{user_share_dirs}/gvfs-metadata/{,*} r, owner @{user_cache_dirs}/evolution/{,**} rwk, diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index 8b2581a7..6a3cc7e0 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -9,9 +9,12 @@ include @{exec_path} = /{usr/,}bin/gjs-console profile gjs-console @{exec_path} flags=(attach_disconnected) { include + include + include include include include + include include network netlink raw, @@ -24,6 +27,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, /usr/share/glib-2.0/schemas/gschemas.compiled r, + /usr/share/glvnd/egl_vendor.d/{,*.json} r, /usr/share/gnome-shell/{,**} r, /usr/share/themes/*/gtk-3.0/{,**} r, /usr/share/X11/xkb/** r, @@ -49,12 +53,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { @{run}/user/[0-9]*/gdm/Xauthority r, /dev/ r, - /dev/dri/ r, /dev/tty rw, /dev/tty[0-9]* rw, - @{sys}/bus/ r, - @{sys}/class/ r, - include if exists } diff --git a/apparmor.d/groups/gnome/gnome-contacts b/apparmor.d/groups/gnome/gnome-contacts index 53a29afa..d2d9e241 100644 --- a/apparmor.d/groups/gnome/gnome-contacts +++ b/apparmor.d/groups/gnome/gnome-contacts @@ -22,6 +22,9 @@ profile gnome-contacts @{exec_path} { /usr/share/glib-2.0/schemas/gschemas.compiled r, + owner @{user_cache_dirs}/evolution/addressbook/{,**} r, + owner @{user_cache_dirs}/gstreamer*/{,**} r, + owner @{user_config_dirs}/gnome-contacts/{,**} rw, owner @{user_share_dirs}/folks/relationships.ini r, include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 5cd29603..bee8598a 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -36,8 +36,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { /{usr/,}{lib,libexec}/polkit-1/polkit* rPx, /{usr/,}{lib,libexec}/* rPUx, + /usr/share/backgrounds/{,**} r, /usr/share/desktop-directories/{,*.directory} r, + /usr/share/gdm/greeter-dconf-defaults r, + /usr/share/gdm/greeter/applications/{,**} r, /usr/share/glib-2.0/schemas/gschemas.compiled r, + /usr/share/glvnd/egl_vendor.d/{,*.json} r, /usr/share/gnome-shell/{,**} r, /usr/share/libgweather/Locations.xml r, /usr/share/libinput/ r, @@ -47,9 +51,13 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { /usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r, /usr/share/xsessions/{,*.desktop} r, + /etc/fstab r, /etc/machine-id r, /var/lib/dbus/machine-id r, + /var/lib/gdm/.config/pulse/client.conf r, + /var/lib/gdm/.local/share/applications/{,**} r, + owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r, @@ -64,11 +72,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { include owner @{run}/user/[0-9]*/dconf/ rw, owner @{run}/user/[0-9]*/dconf/user rw, + /usr/share/dconf/profile/gdm r, + /var/lib/gdm/.config/dconf/user r, owner @{run}/user/[0-9]*/gnome-shell/{,**} rw, owner @{run}/user/[0-9]*/gnome-shell-disable-extensions rw, owner @{run}/user/[0-9]*/wayland-[0-9].lock rwk, owner @{run}/user/[0-9]*/gdm/Xauthority r, + owner @{run}/user/[0-9]*/.mutter-Xwaylandauth.[0-9A-Z]* rw, @{run}/systemd/users/[0-9]* r, @{run}/systemd/sessions/[0-9] r, @@ -111,6 +122,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { owner @{PROC}/[0-9]*/fd/ r, owner @{PROC}/[0-9]*/cgroup r, owner @{PROC}/[0-9]*/mounts r, + owner @{PROC}/[0-9]*/mountinfo r, owner @{PROC}/[0-9]*/attr/current r, @{PROC}/[0-9]*/stat r, @{PROC}/[0-9]*/task/[0-9]*/stat r, diff --git a/apparmor.d/profiles-a-l/aa-notify b/apparmor.d/profiles-a-l/aa-notify index 96aeb9a6..82001b15 100644 --- a/apparmor.d/profiles-a-l/aa-notify +++ b/apparmor.d/profiles-a-l/aa-notify @@ -23,8 +23,8 @@ profile aa-notify @{exec_path} flags=(complain) { /usr/share/terminfo/d/dumb r, /var/log/audit/audit.log r, - owner /tmp/[a-z0-9]* r, - owner /tmp/apparmor-bugreport-[a-z0-9]*.txt rw, + owner /tmp/[a-z0-9]* rw, + owner /tmp/apparmor-bugreport-*.txt rw, @{PROC}/ r, @{PROC}/@{pid}/stat r,