feat(profile): ensure compatibility with userspace tools.

2024-11-14 23:43:56 +01:00 · 2023-01-27 22:00:10 +00:00 · 2023-01-27 22:00:10 +00:00 · 23312c1640
commit 23312c1640
parent 603491a02e
23 changed files with 23 additions and 135 deletions
--- a/apparmor.d/groups/bus/ibus-portal
+++ b/apparmor.d/groups/bus/ibus-portal
@ -20,7 +20,7 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) {
       member={RequestName,ReleaseName}
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/freedesktop/xdg-document-portal
+++ b/apparmor.d/groups/freedesktop/xdg-document-portal
@ -36,7 +36,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
       member=GetMountPoint
       peer=(name=:*, label="{snap,xdg-desktop-portal}"),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/freedesktop/xdg-permission-store
+++ b/apparmor.d/groups/freedesktop/xdg-permission-store
@ -31,7 +31,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
       member=Lookup
       peer=(name=:*, label="{gnome-shell,xdg-desktop-portal}"),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/gjs-console
+++ b/apparmor.d/groups/gnome/gjs-console
@ -61,7 +61,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
       member={ActiveChanged,WakeUpScreen,GetActive}
       peer=(name=:*, label="{gnome-shell,gnome-session-binary,xdg-desktop-portal-*}"),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/gnome-session-binary
+++ b/apparmor.d/groups/gnome/gnome-session-binary
@ -123,7 +123,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
       member=GetAddress
       peer=(name=org.a11y.Bus), # all peer's labels

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/gnome-shell
+++ b/apparmor.d/groups/gnome/gnome-shell
@ -229,7 +229,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
       member={GetAll,GetResources,Set}
       peer=(name=:*, label="{gsd-power,gsd-color,xdg-desktop-portal-*}"),

-  dbus receive bus=session path={/org/gnome/Shell/Screenshot,/org/gnome/Shell/Introspect,/org/gtk/Notifications,/org/gnome/Mutter/RemoteDesktop,/org/gnome/Mutter/ScreenCast}
+  dbus receive bus=session path=/org/{gnome/Shell/Screenshot,gnome/Shell/Introspect,gtk/Notifications,gnome/Mutter/RemoteDesktop,gnome/Mutter/ScreenCast}
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:* label=xdg-desktop-portal-*),
@ -334,7 +334,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
       member=Introspect
       peer=(name=:*), # all paths and peer's labels

-  dbus receive bus=session path={/,/org,/StatusNotifierWatcher}
+  dbus receive bus=session path=/{,org,StatusNotifierWatcher}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell), # itself
--- a/apparmor.d/groups/gnome/goa-daemon
+++ b/apparmor.d/groups/gnome/goa-daemon
@ -48,7 +48,7 @@ profile goa-daemon @{exec_path} {
       member=GetManagedObjects
       peer=(name=:*, label="{gvfs-goa-volume-monitor,goa-daemon,goa-identity-service,unconfined}"),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/goa-identity-service
+++ b/apparmor.d/groups/gnome/goa-identity-service
@ -27,7 +27,7 @@ profile goa-identity-service @{exec_path} {
       member=GetManagedObjects
       peer=(name=:*, label=goa-daemon),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/gsd-housekeeping
+++ b/apparmor.d/groups/gnome/gsd-housekeeping
@ -47,7 +47,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
       member={CancelEndSession,QueryEndSession,EndSession,Stop}
       peer=(name=:*, label=gnome-session-binary),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/gsd-rfkill
+++ b/apparmor.d/groups/gnome/gsd-rfkill
@ -76,7 +76,7 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
       member=PropertiesChanged
       peer=(name=org.freedesktop.DBus, label=gnome-shell),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/gsd-screensaver-proxy
+++ b/apparmor.d/groups/gnome/gsd-screensaver-proxy
@ -43,7 +43,7 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
       peer=(name=:*, label=gnome-session-binary),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/gsd-sharing
+++ b/apparmor.d/groups/gnome/gsd-sharing
@ -91,7 +91,7 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
       member=StopUnit
       peer=(name=org.freedesktop.systemd[0-9]*), # all peer's labels

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gnome/tracker-miner
+++ b/apparmor.d/groups/gnome/tracker-miner
@ -66,7 +66,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
       member=Query
       peer=(name=:*, label=tracker-extract),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor
@ -22,7 +22,7 @@ profile gvfs-afc-volume-monitor @{exec_path} {
       member={List,IsSupported}
       peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),

-  dbus receive bus=session path={/,/org/gtk/Private/RemoteVolumeMonitor}
+  dbus receive bus=session path=/{,org/gtk/Private/RemoteVolumeMonitor}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor
@ -22,7 +22,7 @@ profile gvfs-goa-volume-monitor @{exec_path} {
       member={List,IsSupported}
       peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),

-  dbus receive bus=session path={/,/org/gtk/Private/RemoteVolumeMonitor}
+  dbus receive bus=session path=/{,org/gtk/Private/RemoteVolumeMonitor}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor
@ -26,7 +26,7 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} {
       member={List,IsSupported}
       peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),

-  dbus receive bus=session path={/,/org,/org/gtk/Private/RemoteVolumeMonitor}
+  dbus receive bus=session path=/{,org/,org/gtk/Private/RemoteVolumeMonitor}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor
@ -25,7 +25,7 @@ profile gvfs-mtp-volume-monitor @{exec_path} {
       member={List,IsSupported}
       peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),

-  dbus receive bus=session path={/,/org,/org/gtk/Private/RemoteVolumeMonitor}
+  dbus receive bus=session path=/{,org/,org/gtk/Private/RemoteVolumeMonitor}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
@ -48,7 +48,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
       member={List,IsSupported}
       peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/gvfs/gvfsd
+++ b/apparmor.d/groups/gvfs/gvfsd
@ -43,7 +43,7 @@ profile gvfsd @{exec_path} {
       member=Spawned
       peer=(name=:*, label=gvfsd-*),

-  dbus receive bus=session path={/,/org}
+  dbus receive bus=session path=/{,org}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell),
--- a/apparmor.d/groups/network/mullvad-daemon
+++ b/apparmor.d/groups/network/mullvad-daemon
@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>

@{exec_path} = /{usr/,}bin/mullvad-daemon
-@{exec_path} += "/opt/Mullvad VPN/resources/mullvad-daemon"
+@{exec_path} += /opt/Mullvad*/resources/mullvad-daemon
 profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/nameservice-strict>
--- a/apparmor.d/groups/network/mullvad-gui
+++ b/apparmor.d/groups/network/mullvad-gui
@ -6,7 +6,7 @@ abi <abi/3.0>,

 include <tunables/global>

-@{exec_path} = "/opt/Mullvad VPN/mullvad-gui"
+@{exec_path} = /opt/Mullvad*/mullvad-gui
 profile mullvad-gui @{exec_path} {
  include <abstractions/base>
  include <abstractions/chromium-common>
--- a/apparmor.d/profiles-a-f/appimage-beyond-all-reason
+++ b/apparmor.d/profiles-a-f/appimage-beyond-all-reason
@ -1,112 +0,0 @@
-# apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2021 Mikhail Morfikov
-# SPDX-License-Identifier: GPL-2.0-only
-
-abi <abi/3.0>,
-
-include <tunables/global>
-
-@{exec_path}  = "/home/*/@{XDG_DESKTOP_DIR}/Beyond All Reason.AppImage"
-@{exec_path} += /home/*/@{XDG_DESKTOP_DIR}/BeyondAllReason.AppImage
-profile appimage-beyond-all-reason @{exec_path} {
-  include <abstractions/base>
-  include <abstractions/consoles>
-  include <abstractions/X>
-  include <abstractions/gtk>
-  include <abstractions/freedesktop.org>
-  include <abstractions/fonts>
-  include <abstractions/fontconfig-cache-read>
-  include <abstractions/nameservice-strict>
-  include <abstractions/dri-common>
-  include <abstractions/dri-enumerate>
-  include <abstractions/mesa>
-  include <abstractions/ssl_certs>
-  include <abstractions/audio>
-  include <abstractions/chromium-common>
-
-  capability sys_ptrace,
-
-  network netlink raw,
-  network inet dgram,
-  network inet6 dgram,
-  network inet stream,
-  network inet6 stream,
-
-  @{exec_path} mr,
-
-  /{usr/,}bin/{,ba,da}sh                 rix,
-  /{usr/,}bin/xmessage                   rix,
-
-  /{usr/,}bin/x86_64-linux-gnu-addr2line rix,
-
-  /{usr/,}bin/fusermount{,3}             rCx -> fusermount,
-
-  mount fstype={fuse,fuse.*} -> /tmp/.mount_Beyond*/,
-
-  /tmp/.mount_Beyond*/  rw,
-  /tmp/.mount_Beyond*/beyond-all-reason rix,
-  /tmp/.mount_Beyond*/AppRun rix,
-  /tmp/.mount_Beyond*/bin/* rix,
-  /tmp/.mount_Beyond*/resources/app.asar.unpacked/node_modules/** rix,
-  /tmp/.mount_Beyond*/**  r,
-  /tmp/.mount_Beyond*/**.so{,.[0-9]*} mr,
-
-  owner @{user_config_dirs}/Beyond-All-Reason/ rw,
-  owner @{user_config_dirs}/Beyond-All-Reason/** rwk,
-
-  owner "@{HOME}/Beyond All Reason/" rw,
-  owner "@{HOME}/Beyond All Reason/**" rwkm,
-  owner "@{HOME}/Beyond All Reason/engine/**/spring" rix,
-
-  owner @{HOME}/.spring/ rw,
-  owner @{HOME}/.spring/** rw,
-
-             @{PROC}/ r,
-       owner @{PROC}/@{pid}/fd/ r,
-  deny owner @{PROC}/@{pid}/cmdline r,
-             @{PROC}/@{pids}/stat r,
-       owner @{PROC}/@{pids}/statm r,
-       owner @{PROC}/@{pids}/task/ r,
-       owner @{PROC}/@{pids}/task/@{tid}/status r,
-       owner @{PROC}/@{pid}/oom_{,score_}adj r,
-  deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
-             @{PROC}sys/fs/inotify/max_user_watches r,
-             @{PROC}/sys/kernel/yama/ptrace_scope r,
-
-  @{sys}/bus/pci/devices/ r,
-  @{sys}/devices/pci[0-9]*/**/class r,
-  @{sys}/devices/virtual/tty/tty0/active r,
-
-  /dev/fuse rw,
-
-  /var/lib/dbus/machine-id r,
-  /etc/machine-id r,
-
-
-  profile fusermount {
-    include <abstractions/base>
-    include <abstractions/nameservice-strict>
-
-    # To mount anything:
-    capability sys_admin,
-
-    capability dac_read_search,
-
-    /{usr/,}bin/fusermount{,3} mr,
-
-    mount fstype={fuse,fuse.*.AppImage} -> /tmp/.mount_*/,
-    umount /tmp/.mount_*/,
-
-    /dev/fuse rw,
-
-    /etc/fuse.conf r,
-
-    owner @{HOME}/**.AppImage r,
-    owner @{MOUNTS}/*/**.AppImage r,
-
-    @{PROC}/@{pid}/mounts r,
-
-  }
-
-  include if exists <local/appimage-beyond-all-reason>
-}
--- a/apparmor.d/profiles-m-r/nft
+++ b/apparmor.d/profiles-m-r/nft
@ -16,7 +16,7 @@ profile nft @{exec_path} {

  network netlink raw,

-  ptrace(read),
+  ptrace (read),

  @{exec_path} mr,