mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(tunable): add @{editor_path} & @{pager_path}.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-09-08 13:25:49 +01:00
parent 4f310b8802
commit 2af1d06f18
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
35 changed files with 63 additions and 124 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apparmor.d/groups/_full/default
View File

@ -45,9 +45,7 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{coreutils_path} rix,
@{shells_path} rix,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
# @{open_path} rPx -> child-open,

8
apparmor.d/groups/apt/apt
View File

@ -99,11 +99,10 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/usr/share/language-tools/language-options rPx,
# For editing the sources.list file
@{bin}/sensible-editor rCx -> editor,
@{bin}/vim.* rCx -> editor,
@{editor_path} rCx -> editor,
# For changelogs
@{bin}/sensible-pager rCx -> pager,
@{pager_path} rCx -> pager,
#aa:only whonix
@{lib}/uwt/uwtwrapper rix,
@ -168,8 +167,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
@{bin}/ r,
@{sh_path} rix,
@{bin}/less rix,
@{bin}/sensible-pager mr,
@{pager_path} rmix,
@{bin}/which{,.debianutils} rix,
/root/ r, # For shell pwd

6
apparmor.d/groups/apt/apt-listchanges
View File

@ -28,7 +28,7 @@ profile apt-listchanges @{exec_path} {
# shared object file): ignored.
@{bin}/dpkg-deb rpx,
#
@{bin}/sensible-pager rCx -> pager,
@{pager_path} rCx -> pager,
# Send results using email
@{bin}/exim4 rPx,
@ -83,12 +83,11 @@ profile apt-listchanges @{exec_path} {
capability dac_read_search,
#capability sys_tty_config,
@{bin}/sensible-pager mr,
@{pager_path} mrix,
@{bin}/ r,
@{sh_path} rix,
@{bin}/which{,.debianutils} rix,
@{bin}/less rix,
owner @{HOME}/.less* rw,
@ -98,6 +97,7 @@ profile apt-listchanges @{exec_path} {
/tmp/ r,
owner @{tmp}/apt-listchanges-tmp*.txt r,
include if exists <local/apt-listchanges_pager>
}
include if exists <local/apt-listchanges>

7
apparmor.d/groups/apt/aptitude
View File

@ -105,7 +105,7 @@ profile aptitude @{exec_path} flags=(complain) {
owner @{user_cache_dirs}/aptitude/ rw,
owner @{user_cache_dirs}/aptitude/metadata-download{,-journal} rw,
owner @{user_cache_dirs}/aptitude/metadata-download rwk,
@{bin}/sensible-pager rCx -> pager,
@{pager_path} rCx -> pager,
# For aptitude-run-state-bundle
owner @{tmp}/aptitudebug.*/ r,
@ -172,19 +172,18 @@ profile aptitude @{exec_path} flags=(complain) {
include <abstractions/consoles>
@{bin}/ r,
@{bin}/sensible-pager mr,
@{editor_path} mrix,
@{sh_path} rix,
@{bin}/which{,.debianutils} rix,
@{bin}/less rix,
owner @{HOME}/.less* rw,
owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
# For shell pwd
/root/ r,
include if exists <local/aptitude_pager>
}
include if exists <local/aptitude>

5
apparmor.d/groups/apt/dpkg
View File

@ -34,10 +34,7 @@ profile dpkg @{exec_path} {
@{lib}/needrestart/dpkg-status rPx,
/usr/share/debian-security-support/check-support-status.hook rPx,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/diff rPx -> child-pager,
@{pager_path} rPx -> child-pager,
# Package maintainer's scripts
# Move it to a child profile once more transitions will be available

4
apparmor.d/groups/apt/dpkg-query
View File

@ -16,9 +16,7 @@ profile dpkg-query @{exec_path} {
@{sh_path} rix,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/var/lib/dpkg/** r,

4
apparmor.d/groups/apt/reportbug
View File

@ -47,10 +47,8 @@ profile reportbug @{exec_path} {
@{bin}/dlocate rPx,
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/dpkg-query rpx,
@{bin}/less rPx -> child-pager,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{bin}/systemctl rCx -> systemctl,
@{lib}/firefox/firefox rPUx, # App allowed to open
/usr/share/bug/* rPUx,

6
apparmor.d/groups/cron/crontab
View File

@ -22,11 +22,7 @@ profile crontab @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
# When editing the crontab file
@{bin}/sensible-editor rCx -> editor,
@{bin}/vim.* rCx -> editor,
@{bin}/nvim rCx -> editor,
@{editor_path} rCx -> editor,
/etc/cron.{allow,deny} r,
/etc/environment r,

4
apparmor.d/groups/network/nmcli
View File

@ -15,9 +15,7 @@ profile nmcli @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
owner @{HOME}/.nm-vpngate/*.ovpn r,
owner @{HOME}/.cert/nm-openvpn/*.pem rw,

5
apparmor.d/groups/pacman/pacman
View File

@ -196,10 +196,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
signal send set=cont peer=child-pager,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/diff rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/etc/machine-id r,

4
apparmor.d/groups/systemd/bootctl
View File

@ -22,9 +22,7 @@ profile bootctl @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/{boot,efi}/ r,
/{boot,efi}/EFI/{,**} r,

4
apparmor.d/groups/systemd/busctl
View File

@ -37,9 +37,7 @@ profile busctl @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/comm r,

4
apparmor.d/groups/systemd/coredumpctl
View File

@ -22,9 +22,7 @@ profile coredumpctl @{exec_path} flags=(complain) {
@{bin}/gdb rCx -> gdb,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/var/lib/dbus/machine-id r,
/etc/machine-id r,

4
apparmor.d/groups/systemd/journalctl
View File

@ -25,9 +25,7 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/var/lib/dbus/machine-id r,
/etc/machine-id r,

4
apparmor.d/groups/systemd/localectl
View File

@ -15,9 +15,7 @@ profile localectl @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/usr/share/kbd/keymaps/{,**} r,

4
apparmor.d/groups/systemd/loginctl
View File

@ -19,9 +19,7 @@ profile loginctl @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
include if exists <local/loginctl>
}

4
apparmor.d/groups/systemd/networkctl
View File

@ -35,9 +35,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/etc/udev/hwdb.bin r,
/var/lib/dbus/machine-id r,

4
apparmor.d/groups/systemd/systemd-analyze
View File

@ -28,9 +28,7 @@ profile systemd-analyze @{exec_path} {
@{lib}/systemd/system-environment-generators/* rix,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{bin}/man rPx,
/usr/ r,

4
apparmor.d/groups/systemd/systemd-cgls
View File

@ -14,9 +14,7 @@ profile systemd-cgls @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{sys}/fs/cgroup/{,**} r,

4
apparmor.d/groups/systemd/systemd-cgtop
View File

@ -14,9 +14,7 @@ profile systemd-cgtop @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{sys}/fs/cgroup/{,**} r,

4
apparmor.d/groups/systemd/systemd-dissect
View File

@ -25,9 +25,7 @@ profile systemd-dissect @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/fsck rPx,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
# Location of file system OS images
@{user_build_dirs}/{,**} r,

4
apparmor.d/groups/systemd/systemd-mount
View File

@ -13,9 +13,7 @@ profile systemd-mount @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{sys}/bus/ r,
@{sys}/class/ r,

4
apparmor.d/groups/systemd/systemd-udevd
View File

@ -37,6 +37,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
@{sh_path} rix,
@{coreutils_path} rix,
@{pager_path} rPx -> child-pager,
@{bin}/*-print-pci-ids rix,
@{bin}/alsactl rPUx,
@{bin}/ddcutil rPx,
@ -44,16 +45,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
@{bin}/ethtool rix,
@{bin}/issue-generator rPx,
@{bin}/kmod rPx,
@{bin}/less rPx -> child-pager,
@{bin}/logger rix,
@{bin}/ls rix,
@{bin}/lvm rPx,
@{bin}/mknod rix,
@{bin}/more rPx -> child-pager,
@{bin}/multipath rPx,
@{bin}/nfsrahead rix,
@{bin}/nvidia-modprobe rPx -> child-modprobe-nvidia,
@{bin}/pager rPx -> child-pager,
@{bin}/perl rix,
@{bin}/setfacl rix,
@{bin}/sg_inq rix,

4
apparmor.d/groups/systemd/userdbctl
View File

@ -16,9 +16,7 @@ profile userdbctl @{exec_path} {
@{exec_path} mr,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/etc/shadow r,
/etc/gshadow r,

4
apparmor.d/profiles-a-f/dmesg
View File

@ -18,9 +18,7 @@ profile dmesg @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/usr/share/terminfo/** r,

8
apparmor.d/profiles-g-l/git
View File

@ -62,9 +62,7 @@ profile git @{exec_path} flags=(attach_disconnected) {
@{bin}/wc rix,
@{bin}/whoami rix,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{bin}/man rPx,
@{bin}/meld rPUx,
@ -74,9 +72,7 @@ profile git @{exec_path} flags=(attach_disconnected) {
@{bin}/gpg{,2} rCx -> gpg,
@{bin}/ssh rCx -> ssh,
@{bin}/sensible-editor rCx -> editor,
@{bin}/vim rCx -> editor,
@{bin}/vim.* rCx -> editor,
@{editor_path} rCx -> editor,
/usr/share/git{,-core}/{,**} r,
/usr/share/libalternatives/{,**} r,

4
apparmor.d/profiles-g-l/gpo
View File

@ -27,9 +27,7 @@ profile gpo @{exec_path} {
@{bin}/ r,
@{sh_path} rix,
@{bin}/uname rix,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/etc/inputrc r,

13
apparmor.d/profiles-m-r/mutt
View File

@ -37,13 +37,8 @@ profile mutt @{exec_path} {
@{bin}/w3m rCx -> html-renderer,
@{bin}/lynx rCx -> html-renderer,
@{bin}/vim rCx -> editor,
@{bin}/vim.* rCx -> editor,
@{bin}/sensible-editor rCx -> editor,
@{bin}/less rCx -> pager,
@{bin}/more rCx -> pager,
@{bin}/pager rCx -> pager,
@{editor_path} rCx -> editor,
@{pager_path} rCx -> pager,
@{bin}/gpg{2,} rCx -> gpg,
@{bin}/gpgconf rCx -> gpg,
@ -118,9 +113,7 @@ profile mutt @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{bin}/less mr,
@{bin}/more mr,
@{bin}/pager mr,
@{pager_path} mr,
/usr/share/terminfo/** r,
/usr/share/file/misc/magic.mgc r,

7
apparmor.d/profiles-m-r/pass
View File

@ -46,7 +46,7 @@ profile pass @{exec_path} {
@{bin}/gpg{2,} rCx -> gpg,
@{bin}/pkill rCx -> pkill,
@{bin}/qdbus rCx -> qdbus,
@{bin}/vim{,.*} rCx -> editor,
@{editor_path} rCx -> editor,
@{lib}/git{,-core}/git rCx -> git,
@{bin}/wl-{copy,paste} rPx,
@{bin}/xclip rPx,
@ -112,10 +112,7 @@ profile pass @{exec_path} {
@{bin}/git* mrix,
@{lib}/git{,-core}/git* mrix,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{pager_path} rPx -> child-pager,
@{bin}/gpg{2,} rPx -> pass//gpg,
/usr/share/git{,-core}/{,**} r,

5
apparmor.d/profiles-s-z/task
View File

@ -23,10 +23,7 @@ profile task @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/vim rCx -> editor,
@{bin}/vim.* rCx -> editor,
@{bin}/sensible-editor rCx -> editor,
@{editor_path} rCx -> editor,
/usr/share/{doc/,}task{warrior,}/** r,

4
apparmor.d/profiles-s-z/udisksctl
View File

@ -15,9 +15,7 @@ profile udisksctl @{exec_path} {
@{sh_path} rix,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{pager_path} rPx -> child-pager,
/dev/tty rw,

4
apparmor.d/profiles-s-z/vipw-vigr
View File

@ -16,9 +16,7 @@ profile vipw-vigr @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/sensible-editor rCx -> editor,
@{bin}/vim.* rCx -> editor,
@{editor_path} rCx -> editor,
/etc/login.defs r,

10
apparmor.d/tunables/multiarch.d/paths
View File

@ -34,10 +34,16 @@
@{emails_path} = @{thunderbird_path} @{bin}/@{emails_names}
# Open
@{open_path} = @{bin}/exo-open @{bin}/xdg-open @{bin}/gio @{bin}/kde-open
@{open_path} += @{bin}/gio-launch-desktop @{lib}/gio-launch-desktop
@{open_path} = @{bin}/@{open_names}
@{open_path} += @{lib}/gio-launch-desktop
@{open_path} += @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop
# Editor
@{editor_path} = @{bin}/@{editor_names}
# Pager
@{pager_path} = @{bin}/@{pager_names}
# File explorers
@{file_explorers_path} = @{bin}/@{file_explorers_names}

9
apparmor.d/tunables/multiarch.d/programs
View File

@ -28,6 +28,15 @@
# Python interpreters
@{python_name} = python{,3,3.[0-9],3.1[0-9]}
# Open
@{open_names} = exo-open xdg-open gio kde-open gio-launch-desktop
# Editor
@{editor_names} = sensible-editor vim{,.*} nvim nano
# Pager
@{pager_names} = sensible-pager pager less more
# Browsers
@{brave_name} = brave{,-beta,-dev,-bin}

4
docs/install.md
View File

@ -148,9 +148,7 @@ The following desktop environments are supported:
@{bin}/wl-{copy,paste} rPx,
@{bin}/xclip rPx,
@{bin}/python3.@{int} rPx -> pass-import, # pass-import
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
@{pager_path} rPx -> child-pager,
'.build/apparmor.d/pass' -> '/etc/apparmor.d/pass'
```
So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired.