mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(dbus): rewrite some dbus rules (4).

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-03 16:53:25 +00:00
parent 2af165403a
commit 1edf507abf
Failed to generate hash of commit
16 changed files with 74 additions and 129 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/abstractions/bus/login Normal file
View file

@ -0,0 +1,10 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Inhibit
peer=(name=org.freedesktop.login1, label=systemd-logind),
include if exists <abstractions/bus/login.d>

2
apparmor.d/abstractions/bus/rtkit
View file

@ -10,6 +10,6 @@
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
member=MakeThread*
peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
peer=(name="{:*,org.freedesktop.RealtimeKit1}", label=rtkit-daemon),
include if exists <abstractions/bus/rtkit.d>

11
apparmor.d/abstractions/bus/udisk Normal file
View file

@ -0,0 +1,11 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
dbus send bus=system path=/org/freedesktop/UDisks2
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=udisksd),
include if exists <abstractions/bus/udisk.d>

18
apparmor.d/groups/apt/unattended-upgrade-shutdown
View file

@ -9,26 +9,16 @@ include <tunables/global>
@{exec_path} = /usr/share/unattended-upgrades/unattended-upgrade-shutdown
profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-network-manager-strict>
include <abstractions/bus/login>
include <abstractions/bus/network-manager>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
include <abstractions/python>
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Inhibit,
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.DBus.{Introspectable,Properties}
member={Introspect,Get},
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=PrepareForShutdown,
member=PrepareForShutdown
peer=(name=:*, label=systemd-logind),
@{exec_path} mr,

39
apparmor.d/groups/freedesktop/upowerd
View file

@ -10,43 +10,24 @@ include <tunables/global>
@{exec_path} = @{lib}/{,upower/}upowerd
profile upowerd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/login>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>
network netlink raw,
dbus (send,receive) bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.{DBus.Properties,DBus.Introspectable,UPower*},
dbus (send,receive) bus=system path=/org/freedesktop/login1
dbus bind bus=system name=org.freedesktop.UPower,
dbus receive bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.UPower{,.*}
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.DBus.Properties
member={PropertiesChanged,GetAll},
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Inhibit,
dbus send bus=system path=/
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=bluetoothd),
dbus receive bus=system path=/org/bluez/hci0
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=bluetoothd),
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={UserNew,UserRemoved,SessionNew,SessionRemoved,PrepareForShutdown,PrepareForSleep}
peer=(name=:*, label=systemd-logind),
dbus receive bus=system path=/org/bluez/hci*/**
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*),
dbus bind bus=system name=org.freedesktop.UPower,
dbus receive bus=system path=/org/bluez/hci@{int}{,/**}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=bluetoothd),
@{exec_path} mr,

15
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/xdg-desktop-portal
profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/rtkit>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -22,14 +23,17 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
ptrace (read),
dbus bind bus=session name=org.freedesktop.portal.Desktop,
dbus receive bus=session path=/org/freedesktop/portal/desktop
dbus (send, receive) bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Settings
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktop
dbus (send, receive) bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Settings
dbus (send, receive) bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.*
peer=(name=:*),
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Realtime
member=MakeThread*
peer=(name=:*),
dbus bind bus=session name=org.freedesktop.background.Monitor,
@ -44,7 +48,6 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=xdg-permission-store),
dbus send bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=xdg-document-portal),

1
apparmor.d/groups/gnome/evolution-calendar-factory
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,evolution-data-server/}evolution-calendar-factory
profile evolution-calendar-factory @{exec_path} {
include <abstractions/base>
include <abstractions/bus/network-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>

2
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -128,7 +128,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
dbus receive bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
member=ActiveChanged
member={ActiveChanged,WakeUpScreen}
peer=(name=:*, label=gjs-console),
dbus receive bus=session

7
apparmor.d/groups/gnome/nautilus
View file

@ -25,14 +25,11 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
include <abstractions/vulkan>
dbus bind bus=session name=org.gnome.Nautilus,
dbus send bus=session path=/org/gnome/Nautilus
dbus (send, receive) bus=session path=/org/gnome/Nautilus
interface=org.gtk.{Actions,Application},
dbus send bus=session path=/org/gnome/Nautilus{,/**}
dbus (send, receive) bus=session path=/org/gnome/Nautilus{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=session path=/org/gnome/Nautilus
interface=org.gtk.Application
peer=(name=org.gnome.Nautilus, label="{nautilus,gnome-shell}"),
dbus bind bus=session name=org.freedesktop.FileManager1,
dbus receive bus=session path=/org/freedesktop/FileManager1

1
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfs-udisks2-volume-monitor
profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/udisk>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>

1
apparmor.d/groups/systemd/systemd-logind
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-logind
profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>

24
apparmor.d/profiles-a-f/boltd
View file

@ -17,29 +17,15 @@ profile boltd @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=RequestName,
dbus receive bus=system path=/org/freedesktop/bolt
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=Changed
peer=(name=:*, label=polkitd),
dbus bind bus=system name=org.freedesktop.bolt,
dbus receive bus=system path=/org/freedesktop/bolt
interface=org.freedesktop.bolt1.Manager
member=ListDevices,
dbus bind bus=system
name=org.freedesktop.bolt,
dbus receive bus=system path=/org/freedesktop/bolt
interface=org.freedesktop.DBus.Properties
member=GetAll,
@{exec_path} mr,

17
apparmor.d/profiles-m-r/packagekitd
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/packagekitd
profile packagekitd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
@ -35,6 +36,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
signal send set=int peer=apt-methods-*,
dbus bind bus=system name=org.freedesktop.PackageKit,
dbus receive bus=system path=/org/freedesktop/PackageKit
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=gnome-shell),
@ -49,7 +51,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,GetConnectionUnixUser}
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/org/freedesktop/NetworkManager
@ -62,24 +64,11 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged}
peer=(name=:*, label=NetworkManager),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=polkitd),
dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=Changed
peer=(name=:*, label=polkitd),
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={SessionNew,PrepareForShutdown,SessionRemoved,UserNew,UserRemoved,PrepareForSleep}
peer=(name=:*, label=systemd-logind),
dbus bind bus=system
name=org.freedesktop.PackageKit,
@{exec_path} mr,
@{bin}/gpg{,2} rCx -> gpg,

10
apparmor.d/profiles-s-z/system-config-printer
View file

@ -28,15 +28,7 @@ profile system-config-printer @{exec_path} flags=(complain) {
network inet6 stream,
network netlink raw,
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization,
dbus send bus=system path=/org/freedesktop/hostname[0-9]
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member=GetAll,

36
apparmor.d/profiles-s-z/udisksd
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,udisks2/}udisksd
profile udisksd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/login>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict>
include <abstractions/disks-write>
@ -58,6 +59,14 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(int) peer=@{systemd},
dbus bind bus=system name=org.freedesktop.UDisks2,
dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.UDisks2.*
peer=(name="{:*,org.freedesktop.DBus}"),
dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.DBus.{Properties,ObjectManager}
peer=(name=:*),
dbus (send,receive) bus=system path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
@ -66,37 +75,16 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
member=Get,
dbus (send,receive) bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.{DBus*,UDisks2*},
dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=Changed
peer=(name=:*, label=polkitd),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={ReleaseName,GetConnectionUnixUser,RequestName},
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Inhibit,
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus receive bus=system path=/org/freedesktop/login1*
interface=org.freedesktop.login1*.Manager
interface=org.freedesktop.login1.Manager
member={PrepareForSleep,PrepareForShutdown}
peer=(name=:*, label=systemd-logind),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization,
dbus bind bus=system name=org.freedesktop.UDisks2,
@{exec_path} mr,
@{bin}/{,ba,da}sh rix,

9
apparmor.d/profiles-s-z/wpa-supplicant
View file

@ -26,16 +26,11 @@ profile wpa-supplicant @{exec_path} flags=(attach_disconnected) {
network packet raw,
network packet dgram,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=RequestName,
dbus receive bus=system path=/fi/w[0-9]/wpa_supplicant1
dbus bind bus=system name=fi.w1.wpa_supplicant1,
dbus receive bus=system path=/fi/w1/wpa_supplicant1
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus bind bus=system name=fi.w1.wpa_supplicant1,
@{exec_path} mr,
/etc/wpa_supplicant/wpa_supplicant.conf rw,