mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(dbus): rewrite some dbus rules (3).

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-02 16:05:40 +00:00
parent 92ebab604a
commit 2af165403a
Failed to generate hash of commit
26 changed files with 117 additions and 191 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
apparmor.d/groups/browsers/firefox
View file

@ -17,6 +17,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/atspi>
include <abstractions/bus/rtkit>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -84,10 +85,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
member=Inhibit
peer=(name=org.freedesktop.PowerManagement),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
member={Get,MakeThreadHighPriority,MakeThreadRealtime,MakeThreadRealtimeWithPID}
peer=(name=org.freedesktop.RealtimeKit1*),
dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
@ -106,7 +103,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/gtk/vfs/metadata
interface=org.gtk.vfs.Metadata
member=GetTreeFromDevice
peer=(name=:*),
peer=(name=:*, label=gvfsd-metadata),
dbus send bus=session path=/org/mozilla/firefox/Remote
interface=org.mozilla.firefox

5
apparmor.d/groups/bus/ibus-x11
View file

@ -28,6 +28,11 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
network inet6 dgram,
network netlink raw,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,
/var/lib/gdm{3,}/.config/ibus/bus/ r,

11
apparmor.d/groups/freedesktop/pipewire
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile pipewire @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/rtkit>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
@ -24,16 +25,6 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
dbus bind bus=session name=org.pulseaudio.Server,
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
member=MakeThread*
peer=(name=org.freedesktop.RealtimeKit1),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.RealtimeKit1),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixUser,GetConnectionUnixProcessID}

11
apparmor.d/groups/freedesktop/pipewire-media-session
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile pipewire-media-session @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/rtkit>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>
@ -22,16 +23,6 @@ profile pipewire-media-session @{exec_path} {
network bluetooth stream,
network netlink raw,
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.RealtimeKit1),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
member=MakeThreadRealtime
peer=(name=org.freedesktop.RealtimeKit1),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect

5
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -12,6 +12,7 @@ include <tunables/global>
profile pulseaudio @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/rtkit>
include <abstractions/consoles>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -73,10 +74,6 @@ profile pulseaudio @{exec_path} {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
member={Get,MakeThreadHighPriority,MakeThreadRealtime}
peer=(name=org.freedesktop.RealtimeKit1),
dbus send bus=system path=/
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects

5
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -24,10 +24,13 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
dbus bind bus=session name=org.freedesktop.portal.Desktop,
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Settings
peer=(name=:*, label=nautilus),
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Settings
peer=(name=:*),
dbus bind bus=session name=org.freedesktop.background.Monitor,
dbus receive bus=session path=/org/freedesktop/background/monitor

22
apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/xdg-desktop-portal-gnome
profile xdg-desktop-portal-gnome @{exec_path} {
include <abstractions/base>
include <abstractions/bus/account-daemon>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -28,18 +29,6 @@ profile xdg-desktop-portal-gnome @{exec_path} {
dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gnome,
dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.Accounts.User
member=Changed,
dbus send bus=session path=/org/gnome/Shell/Screenshot
interface=org.freedesktop.DBus.Properties
member=GetAll
@ -85,15 +74,12 @@ profile xdg-desktop-portal-gnome @{exec_path} {
member=Read
peer=(name=:*, label=xdg-desktop-portal),
dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig
interface=org.gnome.Mutter.DisplayConfig
member=GetCurrentState
dbus (send, receive) bus=session path=/org/gnome/Mutter/*
interface=org.gnome.Mutter.*
peer=(name=:*, label="{gnome-shell,gsd-xsettings}"),
dbus send bus=session path=/org/gnome/Mutter/*
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-shell),
peer=(name=:*, label="{gnome-shell,gsd-xsettings}"),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker

31
apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/xdg-desktop-portal-gtk
profile xdg-desktop-portal-gtk @{exec_path} {
include <abstractions/base>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/dbus-accessibility-strict>
@ -32,31 +33,6 @@ profile xdg-desktop-portal-gtk @{exec_path} {
dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gtk,
dbus send bus=system path=/org/freedesktop/Accounts/User@{int}
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus receive bus=system path=/org/freedesktop/Accounts/User@{int}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/Accounts/User@{int}
interface=org.freedesktop.Accounts.User
member=Changed,
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=CheckPermissions,
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus send bus=session path=/org/gtk/Settings
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gsd-xsettings),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
@ -121,6 +97,11 @@ profile xdg-desktop-portal-gtk @{exec_path} {
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,
/usr/share/X11/xkb/{,**} r,

18
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/authentication>
include <abstractions/bus/account-daemon>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
@ -46,18 +47,15 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
interface=org.freedesktop.{DBus.Properties,Accounts*}
member={GetAll,FindUserByName,SetLanguage,Changed,PropertiesChanged},
dbus receive bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts
member=UserAdded
peer=(name=:*, label=accounts-daemon),
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={CreateSession,ReleaseSession},
member=*Session
peer=(name=org.freedesktop.login1, label=systemd-logind),
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User
member=SetLanguage
peer=(name=:*, label=accounts-daemon),
@{exec_path} mrix,

3
apparmor.d/groups/gnome/gjs-console
View file

@ -44,6 +44,9 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
peer=(name=:*), # all members
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
peer=(name=org.freedesktop.DBus),
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.freedesktop.DBus.Properties
peer=(name=:*), # all members

4
apparmor.d/groups/gnome/gnome-extension-ding
View file

@ -75,8 +75,8 @@ profile gnome-extension-ding @{exec_path} {
member=Introspect
peer=(name=:*, label=nautilus),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
dbus send bus={systemd,session} path=/org/freedesktop/DBus
interface=org.freedesktop.DBus{,.Properties}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -11,7 +11,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/bus/upower>
include <abstractions/bus/network-manager>
include <abstractions/bus/polkit>
include <abstractions/bus/vfs>

9
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -23,6 +23,15 @@ profile gnome-terminal-server @{exec_path} {
ptrace (read) peer=unconfined,
dbus bind bus=session name=org.gnome.Terminal,
dbus receive bus=session path=/org/gnome/Terminal{,/**}
interface=org.gnome.Terminal.*
peer=(name=:*),
dbus receive bus=session path=/org/gnome/Terminal{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=unconfined),
dbus receive bus=session path=/org/gnome/Terminal{,/**}
interface=org.gtk.Actions
peer=(name=:*),
@{exec_path} mr,

18
apparmor.d/groups/gnome/goa-daemon
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/goa-daemon
profile goa-daemon @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-network-manager-strict>
include <abstractions/bus/network-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -25,10 +25,10 @@ profile goa-daemon @{exec_path} {
network inet6 dgram,
network netlink raw,
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus bind bus=session name=org.gnome.OnlineAccounts,
dbus receive bus=session path=/org/gnome/OnlineAccounts
interface=org.freedesktop.DBus.ObjectManager
peer=(name=:*),
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
@ -52,14 +52,6 @@ profile goa-daemon @{exec_path} {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gnome/Identity/Manager
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=goa-identity-service),
dbus bind bus=session
name=org.gnome.OnlineAccounts,
@{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r,

1
apparmor.d/groups/gnome/gsd-power
View file

@ -11,6 +11,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/atspi>
include <abstractions/bus/upower>
include <abstractions/bus/vfs>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>

6
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-xsettings
profile gsd-xsettings @{exec_path} {
include <abstractions/base>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
@ -38,11 +39,6 @@ profile gsd-xsettings @{exec_path} {
member=GetAll
peer=(name=:*), # many peer's labels
dbus receive bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts
member={UserAdded,UserRemoved}
peer=(name=:*, label=accounts-daemon),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,ClientRemoved,SessionRunning}

7
apparmor.d/groups/gnome/tracker-miner
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/tracker-miner-fs-{,control-}3
profile tracker-miner @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/upower>
include <abstractions/bus/vfs>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -27,15 +28,11 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
dbus (send, receive) bus=session path=/org/freedesktop/Tracker3/**
interface=org.freedesktop.Tracker3.*
peer=(name=:*), # all members
peer=(name="{:*,org.freedesktop.DBus}"), # all members
dbus receive bus=session path=/org/freedesktop/Tracker3/**
interface=org.freedesktop.DBus.{Peer,Properties}
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member={ListMonitorImplementations,ListMountableInfo}

6
apparmor.d/groups/kde/plasmashell
View file

@ -11,6 +11,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio>
include <abstractions/bus/upower>
include <abstractions/consoles>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -45,11 +46,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
signal (send),
dbus (send,receive) bus=system path=/org/freedesktop/UPower/devices/{,DisplayDevice,battery_BAT[0-9]*,mouse_hidpp_battery_[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(label=upowerd),
@{exec_path} mr,
@{lib}/libheif/ r,

3
apparmor.d/groups/network/ModemManager
View file

@ -20,8 +20,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {
dbus bind bus=system name=org.freedesktop.ModemManager1,
dbus receive bus=system path=/org/freedesktop/ModemManager1
interface=org.freedesktop.DBus.Properties
member=GetManagedObjects
interface=org.freedesktop.DBus.{ObjectManager,Properties}
peer=(name=:*),
dbus (send, receive) bus=system path=/org/freedesktop/login1

55
apparmor.d/groups/network/NetworkManager
View file

@ -39,43 +39,36 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term) peer=dnsmasq,
dbus bind bus=system name=org.freedesktop.NetworkManager,
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.{DBus.Properties,DBus.Introspectable,NetworkManager*}
dbus receive bus=system path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.NetworkManager{,.*}
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=org.freedesktop.DBus),
dbus (send,receive) bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={SessionRemoved,UserNew,SessionNew,Inhibit,PrepareForShutdown,UserRemoved,PrepareForSleep}
peer=(name=:*, label=systemd-logind),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/org/freedesktop
dbus receive bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member={InterfacesAdded,InterfacesRemoved}
peer=(name=org.freedesktop.DBus), # label="{gnome-shell,...}"
member=GetManagedObjects
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/nm_dispatcher
interface=org.freedesktop.nm_dispatcher
member=Action
peer=(name=org.freedesktop.nm_dispatcher),
dbus send bus=system path=/org/freedesktop/ModemManager1
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus send bus=system path=/org/freedesktop/resolve1
interface=org.freedesktop.resolve1.Manager
member={SetLink*,ResolveHostname},
# org.freedesktop.resolve1
member={SetLink*,ResolveHostname}
peer=(name=org.freedesktop.resolve1, label=systemd-resolved),
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member=GetAll,
member=GetAll
peer=(name=:*, label=systemd-hostnamed),
dbus send bus=system path=/org/freedesktop/ModemManager1
interface=org.freedesktop.DBus.ObjectManager
@ -86,13 +79,19 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
member=PropertiesChanged
peer=(name=:*, label=wpa-supplicant),
dbus receive bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
peer=(name=:*, label=systemd-logind),
dbus receive bus=system path=/org/bluez/hci*/**
dbus receive bus=system path=/org/bluez/hci@{int}{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
member=PropertiesChanged
peer=(name=:*, label=bluetoothd),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,

12
apparmor.d/groups/systemd/systemd-logind
View file

@ -27,18 +27,18 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
network netlink raw,
dbus bind bus=system name=org.freedesktop.login1,
dbus receive bus=system path=/org/freedesktop/login1{,/**}
interface=org.freedesktop.login1.Manager
dbus (send, receive) bus=system path=/org/freedesktop/login1{,/**}
interface=org.freedesktop.login1.*
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/login1{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus (send, receive) bus=system path=/org/freedesktop/login1{,/**}
interface=org.freedesktop.login1.*
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/login1{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
peer=(name=org.freedesktop.DBus),
dbus receive bus=system path=/org/freedesktop/systemd1/{unit,job}/**
interface=org.freedesktop.DBus.Properties
@ -56,7 +56,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetConnectionCredentials}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,

23
apparmor.d/profiles-a-f/fwupd
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/bus/upower>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/disks-read>
@ -34,6 +35,14 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
dbus receive bus=system path=/
interface=org.freedesktop.fwupd
peer=(name=:*, label=fwupdmgr),
dbus receive bus=system path=/
interface=org.freedesktop.DBus.Properties
member={GetAll,SetHints,GetPlugins,GetRemotes}
peer=(name=:*, label=fwupdmgr),
dbus send bus=system path=/
interface=org.freedesktop.DBus
member=Changed
peer=(name=:*, label=fwupdmgr),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
@ -52,20 +61,6 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
interface=org.freedesktop.{DBus.Properties,UDisks2.Manager}
member={GetAll,GetBlockDevices},
dbus send bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/
interface=org.freedesktop.DBus
member=Changed
peer=(label=fwupdmgr),
dbus receive bus=system path=/
interface=org.freedesktop.DBus.Properties
member={GetAll,SetHints,GetPlugins,GetRemotes}
peer=(name=:*, label=fwupdmgr),
@{exec_path} mr,
@{lib}/fwupd/fwupd-detect-cet rix,

11
apparmor.d/profiles-s-z/spice-vdagent
View file

@ -13,6 +13,7 @@ profile spice-vdagent @{exec_path} {
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dri-common>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
@ -25,6 +26,16 @@ profile spice-vdagent @{exec_path} {
member=GetCurrentState
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Realtime
member=MakeThreadRealtimeWithPID
peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal),
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect

6
apparmor.d/profiles-s-z/thermald
View file

@ -11,6 +11,7 @@ include <tunables/global>
@{exec_path} = @{bin}/thermald
profile thermald @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/upower>
include <abstractions/dbus-strict>
capability sys_boot,
@ -22,11 +23,6 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=power-profiles-daemon),
dbus send bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=upowerd),
@{exec_path} mr,
/etc/thermald/thermal-conf.xml r,

10
apparmor.d/profiles-s-z/thunderbird
View file

@ -17,6 +17,7 @@ profile thunderbird @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/atspi>
include <abstractions/bus/rtkit>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -50,15 +51,6 @@ profile thunderbird @{exec_path} {
dbus bind bus=session name=org.mozilla.thunderbird.*,
dbus send bus=system path=/org/freedesktop/RealtimeKit1
member={Get,MakeThreadHighPriority,MakeThreadRealtime}
peer=(name=org.freedesktop.RealtimeKit1*),
dbus send bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.UPower
member=EnumerateDevices
peer=(name=org.freedesktop.UPower),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
member=GetAll

17
apparmor.d/profiles-s-z/wireplumber
View file

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -10,6 +10,8 @@ include <tunables/global>
profile wireplumber @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/rtkit>
include <abstractions/bus/upower>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>
@ -23,19 +25,6 @@ profile wireplumber @{exec_path} {
dbus bind bus=session name=org.freedesktop.ReserveDevice1.Audio0,
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
dbus send bus=system path=/org/freedesktop/UPower/devices/DisplayDevice
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.UPower, label=upowerd),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect