mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-30 14:55:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-05-03 18:16:12 +01:00
parent b636b4b3e9
commit 40abc98201
Failed to generate hash of commit
17 changed files with 31 additions and 48 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/abstractions/app/chromium
View file

@ -159,14 +159,14 @@
owner @{tmp}/tmp.*/ rw,
owner @{tmp}/tmp.*/** rwk,
owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw,
owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw,
/dev/shm/ r,
owner /dev/shm/.@{domain}* rw,
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw,
owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw,
@{sys}/bus/ r,
@{sys}/bus/**/devices/ r,
@{sys}/class/**/ r,

6
apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1
View file

@ -14,17 +14,17 @@
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
member={MakeThreadRealtime,MakeThreadHighPriority}
member=MakeThread*
peer=(name=:*, label=rtkit-daemon),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
member={MakeThreadRealtime,MakeThreadHighPriority}
member=MakeThread*
peer=(name=org.freedesktop.RealtimeKit1),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
member=MakeThreadRealtimeWithPID
member=MakeThread*
peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
include if exists <abstractions/bus/org.freedesktop.RealtimeKit1.d>

2
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -48,7 +48,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
unix (bind) type=stream addr=@@{hex}/bus/gdm-session-wor/system,
#aa:dbus talk bus=system name=org.freedesktop.Accounts.User label=accounts-daemon
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager

5
apparmor.d/groups/gnome/gjs-console
View file

@ -39,11 +39,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
member=GetActive
peer=(name=org.gnome.Shell.ScreenShield, label=gnome-shell),
dbus send bus=session path=/org/gnome/Shell
interface=org.freedesktop.DBus.Properties
member=GetAll

2
apparmor.d/groups/gnome/gnome-remote-desktop-daemon
View file

@ -11,6 +11,7 @@ profile gnome-remote-desktop-daemon @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.PolicyKit1>
include <abstractions/dconf-write>
include <abstractions/gnome-strict>
include <abstractions/graphics>
@ -19,6 +20,7 @@ profile gnome-remote-desktop-daemon @{exec_path} {
network inet6 stream,
#aa:dbus own bus=session name=org.gnome.RemoteDesktop.User
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
@{exec_path} mr,

7
apparmor.d/groups/gnome/gnome-shell
View file

@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = @{bin}/gnome-shell
profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio-client>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
@ -20,13 +19,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/bus/org.a11y>
include <abstractions/bus/org.freedesktop.Accounts>
include <abstractions/bus/org.freedesktop.background.Monitor>
include <abstractions/bus/org.freedesktop.ColorManager>
include <abstractions/bus/org.freedesktop.FileManager1>
include <abstractions/bus/org.freedesktop.GeoClue2>
include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore>
include <abstractions/bus/org.freedesktop.locale1>
include <abstractions/bus/org.freedesktop.login1.Session>
include <abstractions/bus/org.freedesktop.login1>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/bus/org.freedesktop.Notifications>
include <abstractions/bus/org.freedesktop.PackageKit>
@ -89,10 +86,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
# Talk with gnome-shell
#aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord
#aa:dbus talk bus=system name=org.freedesktop.login1.Manager label=systemd-logind
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
#aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding
#aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console
#aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary
#aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-*
@ -208,6 +206,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xml/iso-codes/{,**} r,
/ r,
/.flatpak-info r,
/etc/fstab r,
/etc/timezone r,

2
apparmor.d/groups/gnome/gnome-software
View file

@ -29,7 +29,7 @@ profile gnome-software @{exec_path} {
@{exec_path} mr,
@{bin}/baobab rPUx,
@{bin}/bwrap rPUx,
@{bin}/bwrap rPx -> flatpak-app,
@{bin}/fusermount{,3} rCx -> fusermount,
@{bin}/gpg{,2} rCx -> gpg,
@{bin}/gpgconf rCx -> gpg,

2
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -25,7 +25,7 @@ profile gnome-terminal-server @{exec_path} {
ptrace (read) peer=htop,
ptrace (read) peer=unconfined,
#aa:dbus own bus=session name=org.gnome.Terminal
#aa:dbus own bus=session name=org.gnome.Terminal interface=org.gtk.Actions
dbus receive bus=session path=/org/gnome/Terminal/SearchProvider
interface=org.gnome.Shell.SearchProvider2

2
apparmor.d/groups/gnome/mutter-x11-frames
View file

@ -18,7 +18,7 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
include <abstractions/graphics>
include <abstractions/nameservice-strict>
signal (receive) set=(term) peer=gdm,
signal (receive) set=(hup term) peer=gdm{,-session-worker},
@{exec_path} mr,

2
apparmor.d/groups/gvfs/gvfsd-trash
View file

@ -24,7 +24,7 @@ profile gvfsd-trash @{exec_path} {
dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=:*, label=gnome-shell),
peer=(name=:*, label="{gnome-shell,nautilus}"),
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable

4
apparmor.d/groups/pacman/archlinux-keyring-wkd-sync
View file

@ -20,11 +20,11 @@ profile archlinux-keyring-wkd-sync @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,
@{bin}/bash rix,
@{bin}/dirmngr rix,
@{bin}/gpg{,2} rix,
@{bin}/gpg-agent rix,
@{bin}/gpg{,2} rix,
@{bin}/pacman-conf rix,
/etc/pacman.conf r,

1
apparmor.d/profiles-g-l/kanyremote
View file

@ -101,6 +101,7 @@ profile kanyremote @{exec_path} {
/usr/share/anyremote/{,**} r,
include if exists <local/kanyremote_pgrep>
}
include if exists <local/kanyremote>

2
apparmor.d/profiles-m-r/passimd
View file

@ -29,6 +29,8 @@ profile passimd @{exec_path} flags=(attach_disconnected) {
/var/lib/passim/{,**} r,
/var/lib/passim/data/{,**} rw,
owner /var/log/passim/* rw,
@{PROC}/@{pid}/cmdline r,
include if exists <local/passimd>

14
apparmor.d/profiles-s-z/snap
View file

@ -31,19 +31,7 @@ profile snap @{exec_path} {
#aa:dbus own bus=session name=io.snapcraft.Launcher
#aa:dbus own bus=session name=io.snapcraft.Settings
dbus send bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
member=StartTransientUnit
peer=(name=org.freedesktop.systemd1, label="@{p_systemd_user}"),
dbus receive bus=system path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
member=JobRemoved
peer=(name=:*, label="@{p_systemd}"),
dbus receive bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
member=JobRemoved
peer=(name=:*, label="@{p_systemd_user}"),
#aa:dbus talk bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}"
dbus send bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.portal.Documents

6
apparmor.d/profiles-s-z/spice-vdagent
View file

@ -19,12 +19,10 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.RealtimeKit1>
include <abstractions/bus/org.gnome.Mutter.DisplayConfig>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dri>
include <abstractions/graphics>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
include <abstractions/gtk>
include <abstractions/desktop>
include <abstractions/nameservice-strict>
include <abstractions/X-strict>
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Realtime

2
apparmor.d/profiles-s-z/ssurl
View file

@ -14,7 +14,7 @@ profile ssurl @{exec_path} {
include <abstractions/consoles>
capability dac_read_search,
deny capability dac_override,
capability dac_override,
@{exec_path} mr,

10
apparmor.d/profiles-s-z/vsftpd
View file

@ -10,13 +10,10 @@ include <tunables/global>
@{exec_path} = @{bin}/vsftpd
profile vsftpd @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice>
# Only for local users authentication
include <abstractions/authentication>
# For libwrap (TCP Wrapper) support (tcp_wrappers=YES)
include <abstractions/hosts_access>
include <abstractions/nameservice>
include <abstractions/wutmp>
# To be able to listen on ports < 1024
capability net_bind_service,
@ -43,7 +40,8 @@ profile vsftpd @{exec_path} {
capability net_admin,
capability dac_read_search,
# If session_support=YES, vsftpd will also try and update utmp and wtmp
include <abstractions/wutmp>
@{exec_path} mr,
# To validate allowed users shells
/etc/shells r,