mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-09 16:14:22 +00:00
parent 386402ed70
commit 29b0e3e2e3
Failed to generate hash of commit
10 changed files with 34 additions and 64 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/abstractions/video.d/complete Normal file
View file

@ -0,0 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
@{sys}/devices/@{pci}/video4linux/video@{int}/uevent r,

46
apparmor.d/groups/browsers/firefox
View file

@ -59,42 +59,28 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
dbus bind bus=session name=org.mozilla.firefox_beta.*,
deny dbus send bus=system path=/org/freedesktop/hostname1,
dbus send bus=session path=/ScreenSaver
interface=org.freedesktop.ScreenSaver
peer=(name=org.freedesktop.ScreenSaver),
dbus send bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.UPower
member=EnumerateDevices
peer=(name=org.freedesktop.UPower),
dbus send bus=session path=/org/freedesktop/PowerManagement/Inhibit
interface=org.freedesktop.PowerManagement.Inhibit
member=Inhibit
peer=(name=org.freedesktop.PowerManagement),
dbus bind bus=session name=org.mozilla.firefox.*,
dbus receive bus=session path=/org/mozilla/firefox/*
interface=org.mozilla.firefox
peer=(name=:*, label=@{profile_name}),
dbus send bus=session path=/org/mozilla/firefox/*
interface=org.mozilla.firefox
peer=(name=org.mozilla.firefox.*, label=@{profile_name}),
dbus bind bus=session name=org.mpris.MediaPlayer2.firefox.*,
dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name="{org.freedesktop.DBus,:*}"),
dbus receive bus=session path=/org/mpris/MediaPlayer2
interface=org.mpris.MediaPlayer2.Playlists
member=GetPlaylists
peer=(name=:*),
dbus send bus=session path=/org/gtk/vfs/metadata
interface=org.gtk.vfs.Metadata
member=GetTreeFromDevice
peer=(name=:*, label=gvfsd-metadata),
dbus send bus=session path=/org/mozilla/firefox/Remote
interface=org.mozilla.firefox
peer=(name=org.mozilla.firefox.*, label=@{profile_name}),
dbus receive bus=session path=/org/mozilla/firefox/Remote
interface=org.mozilla.firefox
peer=(name=:*, label=@{profile_name}),
dbus send bus=session path=/org/freedesktop/PowerManagement/Inhibit
interface=org.freedesktop.PowerManagement.Inhibit
member=Inhibit
peer=(name=org.freedesktop.PowerManagement),
@{exec_path} mrix,
@ -110,7 +96,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{lib_dirs}/pingsender rPx,
@{lib_dirs}/plugin-container rPx,
@{lib_dirs}/vaapitest rPx,
@{lib}/mozilla/kmozillahelper rPUx,
@{lib}/mozilla/kmozillahelper rPUx,
@{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr,
@{lib}/mozilla/plugins/ r,
@ -192,8 +178,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
/var/tmp/ r,
owner /tmp/user/@{uid}/ rw,
owner /tmp/user/@{uid}/* rwk,
owner /tmp/user/@{uid}/Temp-*/ rw,
owner /tmp/user/@{uid}/Temp-*/* rwk,
owner /tmp/user/@{uid}/Temp-@{uuid}/ rw,
owner /tmp/user/@{uid}/Temp-@{uuid}/* rwk,
owner /tmp/user/@{uid}/@{name}/ rw,
owner /tmp/user/@{uid}/@{name}/* rwk,
owner /tmp/@{name}/ rw,
@ -206,7 +192,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
owner /tmp/MozillaBackgroundTask-*-removeDirectory/ rw,
owner /tmp/MozillaBackgroundTask-*-removeDirectory/** rwk,
owner /tmp/Mozillato-be-removed-cachePurge-* k,
owner /tmp/Temp-*/ rw,
owner /tmp/Temp-@{uuid}/ rw,
@{run}/mount/utab r,

2
apparmor.d/groups/browsers/firefox-glxtest
View file

@ -25,7 +25,7 @@ profile firefox-glxtest @{exec_path} {
owner @{config_dirs}/firefox/*/.parentlock rw,
owner /tmp/firefox/.parentlock rw,
owner /tmp/@{name}/.parentlock rw,
@{sys}/bus/pci/devices/ r,
@{sys}/devices/@{pci}/class r,

2
apparmor.d/groups/browsers/firefox-vaapitest
View file

@ -25,7 +25,7 @@ profile firefox-vaapitest @{exec_path} {
/etc/igfx_user_feature{,_next}.txt w,
/etc/libva.conf r,
owner /tmp/firefox/.parentlock rw,
owner /tmp/@{name}/.parentlock rw,
@{sys}/devices/@{pci}/{irq,revision,resource} r,
@{sys}/devices/@{pci}/config r,

6
apparmor.d/groups/gnome/gnome-shell-calendar-server
View file

@ -17,6 +17,12 @@ profile gnome-shell-calendar-server @{exec_path} {
dbus receive bus=session path=/org/gnome/Shell/CalendarServer
interface=org.gnome.Shell.CalendarServer
peer=(name=:*, label=gnome-shell),
dbus (send receive) bus=session path=/org/gnome/Shell/CalendarServer
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=session path=/org/gnome/Shell/CalendarServer
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.DBus),
dbus (send receive) bus=session path=/org/gnome/evolution/dataserver/{,**}
interface=org.freedesktop.DBus.Properties

9
apparmor.d/groups/gnome/goa-daemon
View file

@ -13,8 +13,8 @@ profile goa-daemon @{exec_path} {
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/dconf-write>
include <abstractions/gnome-strict>
include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/openssl>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
@ -39,15 +39,8 @@ profile goa-daemon @{exec_path} {
member=GetAll
peer=(name=:*, label=goa-identity-service),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/var/lib/gdm{3,}/.config/dconf/user r,
owner @{user_config_dirs}/goa-1.0/ rw,

14
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -18,27 +18,17 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/gtk>
include <abstractions/gnome-strict>
include <abstractions/nameservice-strict>
include <abstractions/wayland>
signal (receive) set=(term, hup) peer=gdm*,
dbus bind bus=session name=org.gnome.SettingsDaemon.Keyboard,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/X11/xkb/** r,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
@ -47,8 +37,6 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/.gsd-keyboard.settings-ported* rw,
owner @{user_share_dirs}/gnome-settings-daemon/{,input-sources*} rw,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-keyboard>

12
apparmor.d/profiles-g-l/hw-probe
View file

@ -231,18 +231,8 @@ profile hw-probe @{exec_path} {
owner @{PROC}/@{pid}/net/if_inet6 r,
owner @{PROC}/@{pid}/net/dev r,
include if exists <local/hw-probe_netconfig>
}
profile curl {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/ssl_certs>
@{bin}/curl mr,
}
include if exists <local/hw-probe>
}

1
apparmor.d/profiles-m-r/mate-notification-daemon
View file

@ -11,6 +11,7 @@ profile mate-notification-daemon @{exec_path} {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/dconf-write>
include <abstractions/freedesktop.org>
@{exec_path} mr,

1
apparmor.d/profiles-s-z/torsocks
View file

@ -18,6 +18,7 @@ profile torsocks @{exec_path} {
@{bin}/{,ba,da}sh rix,
@{bin}/* rPUx,
@{lib}/uwt/uwtexec rPUx,
@{bin}/getcap rix,
/etc/tor/torsocks.conf r,