mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-02-11 12:45:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(profiles): fix brave entry point.

Browse source
This commit is contained in:
Alexandre Pujol 2023-10-13 00:03:29 +01:00
parent 11ca694af7
commit 387f2f91fc
Failed to generate hash of commit
3 changed files with 46 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
apparmor.d/groups/browsers/brave
View file

@ -9,11 +9,11 @@ include <tunables/global>
@{name} = brave{,-beta,-dev,-bin} @{name} = brave{,-beta,-dev,-bin}
@{domain} = com.brave.Brave @{domain} = com.brave.Brave
@{lib_dirs} = /opt/brave{-bin,.com}/@{name} @{lib_dirs} = /opt/brave{-bin,.com}{,/@{name}}
@{config_dirs} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev} @{config_dirs} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{cache_dirs} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev} @{cache_dirs} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{exec_path} = @{lib_dirs}{,/@{name}} @{exec_path} = @{lib_dirs}/@{name}
profile brave @{exec_path} { profile brave @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/chromium> include <abstractions/chromium>
@ -22,14 +22,11 @@ profile brave @{exec_path} {
@{bin}/man rPUx, # For "brave --help" @{bin}/man rPUx, # For "brave --help"
@{lib_dirs}/swiftshader/libGLESv2.so mr,
@{lib_dirs}/swiftshader/libEGL.so mr,
/usr/share/chromium/extensions/ r, /usr/share/chromium/extensions/ r,
/etc/opt/chrome/ r, /etc/opt/chrome/ r,
owner @{user_config_dirs}/BraveSoftware/ w, owner @{user_config_dirs}/BraveSoftware/ rw,
owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu r, owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu r,
@ -38,6 +35,11 @@ profile brave @{exec_path} {
owner /tmp/net-export/ rw, # For brave://net-export/ owner /tmp/net-export/ rw, # For brave://net-export/
owner /tmp/.org.chromium.Chromium.* rwk,
owner /tmp/.org.chromium.Chromium*/{,**} rw,
owner /dev/shm/.org.chromium.Chromium.* rw,
# Silencer # Silencer
deny /etc/opt/chrome/ w, deny /etc/opt/chrome/ w,

36
apparmor.d/groups/browsers/brave-crashpad-handler Normal file
View file

@ -0,0 +1,36 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{name} = brave{,-beta,-dev,-bin}
@{lib_dirs} = /opt/brave{-bin,.com}{,/@{name}}
@{config_dirs} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{exec_path} = @{lib_dirs}/chrome_crashpad_handler
profile brave-crashpad-handler @{exec_path} {
include <abstractions/base>
capability sys_ptrace,
ptrace peer=brave,
signal (send) peer=brave,
@{exec_path} mrix,
owner "@{config_dirs}/Crash Reports/**" rwk,
@{PROC}/sys/kernel/yama/ptrace_scope r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pids}/mem r,
owner @{PROC}/@{pids}/stat r,
owner @{PROC}/@{pids}/task/ r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_max_freq r,
include if exists <local/brave-crashpad-handler>
}

3
apparmor.d/groups/browsers/brave-wrapper
View file

@ -7,7 +7,8 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{lib_dirs} = /opt/brave.com/brave{,-beta,-dev} /opt/brave-bin/brave{,-beta,-dev} @{name} = brave{,-beta,-dev,-bin}
@{lib_dirs} = /opt/brave{-bin,.com}{,/@{name}}
@{exec_path} = @{lib_dirs}/brave-browser{,-beta,-dev} @{exec_path} = @{lib_dirs}/brave-browser{,-beta,-dev}
profile brave-wrapper @{exec_path} { profile brave-wrapper @{exec_path} {