diff --git a/apparmor.d/abstractions/bwrap-app b/apparmor.d/abstractions/bwrap-app index d2823e40..a4a64a1a 100644 --- a/apparmor.d/abstractions/bwrap-app +++ b/apparmor.d/abstractions/bwrap-app @@ -24,7 +24,6 @@ include include include - include include include include diff --git a/apparmor.d/groups/_full/default b/apparmor.d/groups/_full/default index 6eafed4a..379653a5 100644 --- a/apparmor.d/groups/_full/default +++ b/apparmor.d/groups/_full/default @@ -20,7 +20,6 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include diff --git a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent index 62a1ce53..35839f63 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent +++ b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent @@ -13,7 +13,6 @@ profile akonadi_maildispatcher_agent @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/apps/calibre b/apparmor.d/groups/apps/calibre index 7e4dc17e..0a413626 100644 --- a/apparmor.d/groups/apps/calibre +++ b/apparmor.d/groups/apps/calibre @@ -29,7 +29,6 @@ profile calibre @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/apps/dropbox b/apparmor.d/groups/apps/dropbox index 073d2ce4..9853bd50 100644 --- a/apparmor.d/groups/apps/dropbox +++ b/apparmor.d/groups/apps/dropbox @@ -22,7 +22,6 @@ profile dropbox @{exec_path} { include include include - include include ptrace peer=@{profile_name}, diff --git a/apparmor.d/groups/apps/flameshot b/apparmor.d/groups/apps/flameshot index 4fddb4db..14177cce 100644 --- a/apparmor.d/groups/apps/flameshot +++ b/apparmor.d/groups/apps/flameshot @@ -22,7 +22,6 @@ profile flameshot @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/groups/apps/telegram-desktop b/apparmor.d/groups/apps/telegram-desktop index 2d82e433..a5b69e2e 100644 --- a/apparmor.d/groups/apps/telegram-desktop +++ b/apparmor.d/groups/apps/telegram-desktop @@ -27,7 +27,6 @@ profile telegram-desktop @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 791ae428..6fa95238 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -17,7 +17,6 @@ profile apt @{exec_path} flags=(attach_disconnected) { include include include - include include include diff --git a/apparmor.d/groups/apt/apt-listbugs b/apparmor.d/groups/apt/apt-listbugs index 4c3451b7..8c011a5b 100644 --- a/apparmor.d/groups/apt/apt-listbugs +++ b/apparmor.d/groups/apt/apt-listbugs @@ -13,7 +13,6 @@ profile apt-listbugs @{exec_path} { include include include - include #capability sys_tty_config, diff --git a/apparmor.d/groups/apt/debsecan b/apparmor.d/groups/apt/debsecan index 3338af32..75774918 100644 --- a/apparmor.d/groups/apt/debsecan +++ b/apparmor.d/groups/apt/debsecan @@ -13,7 +13,6 @@ profile debsecan @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/groups/apt/querybts b/apparmor.d/groups/apt/querybts index ebf18c0f..d4e4f7a8 100644 --- a/apparmor.d/groups/apt/querybts +++ b/apparmor.d/groups/apt/querybts @@ -16,7 +16,6 @@ profile querybts @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index 026ff7ba..2e5d0c2c 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -17,7 +17,6 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { include include include - include include capability chown, diff --git a/apparmor.d/groups/browsers/firefox-crashreporter b/apparmor.d/groups/browsers/firefox-crashreporter index 8138faed..a4932d89 100644 --- a/apparmor.d/groups/browsers/firefox-crashreporter +++ b/apparmor.d/groups/browsers/firefox-crashreporter @@ -19,7 +19,6 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) { include include include - include signal (receive) set=(term, kill) peer=firefox, diff --git a/apparmor.d/groups/browsers/firefox-pingsender b/apparmor.d/groups/browsers/firefox-pingsender index 751f1e9f..7476fc7c 100644 --- a/apparmor.d/groups/browsers/firefox-pingsender +++ b/apparmor.d/groups/browsers/firefox-pingsender @@ -15,7 +15,6 @@ include profile firefox-pingsender @{exec_path} { include include - include include network inet stream, diff --git a/apparmor.d/groups/browsers/opera-crashreporter b/apparmor.d/groups/browsers/opera-crashreporter index d4dc936f..6a5bd447 100644 --- a/apparmor.d/groups/browsers/opera-crashreporter +++ b/apparmor.d/groups/browsers/opera-crashreporter @@ -18,7 +18,6 @@ profile opera-crashreporter @{exec_path} { include include include - include include ptrace (trace, read) peer=opera, diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index cc54bd17..aba1d3a6 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -15,7 +15,6 @@ profile colord @{exec_path} flags=(attach_disconnected) { include include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index a08b0fe0..3dd30628 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -27,7 +27,6 @@ profile pulseaudio @{exec_path} { include include include - include include ptrace (trace) peer=@{profile_name}, diff --git a/apparmor.d/groups/gnome/chrome-gnome-shell b/apparmor.d/groups/gnome/chrome-gnome-shell index ff46d981..11008377 100644 --- a/apparmor.d/groups/gnome/chrome-gnome-shell +++ b/apparmor.d/groups/gnome/chrome-gnome-shell @@ -11,7 +11,6 @@ profile chrome-gnome-shell @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/gnome/evolution-alarm-notify b/apparmor.d/groups/gnome/evolution-alarm-notify index 2cec7f15..883b5fe9 100644 --- a/apparmor.d/groups/gnome/evolution-alarm-notify +++ b/apparmor.d/groups/gnome/evolution-alarm-notify @@ -17,7 +17,6 @@ profile evolution-alarm-notify @{exec_path} { include include include - include network netlink raw, diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession index 33c1908d..5bcedbcf 100644 --- a/apparmor.d/groups/gnome/gdm-xsession +++ b/apparmor.d/groups/gnome/gdm-xsession @@ -13,7 +13,6 @@ profile gdm-xsession @{exec_path} { include include include - include @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index db4a703f..acf2bfc5 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -23,7 +23,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { include include include - include network netlink raw, diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index ab255a07..3ae77c40 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -21,7 +21,6 @@ profile gnome-calendar @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/gnome/gnome-contacts b/apparmor.d/groups/gnome/gnome-contacts index 94cf0e77..1ba46a7a 100644 --- a/apparmor.d/groups/gnome/gnome-contacts +++ b/apparmor.d/groups/gnome/gnome-contacts @@ -18,7 +18,6 @@ profile gnome-contacts @{exec_path} { include include include - include include network netlink raw, diff --git a/apparmor.d/groups/gnome/gnome-contacts-search-provider b/apparmor.d/groups/gnome/gnome-contacts-search-provider index 39d55dd5..5250d516 100644 --- a/apparmor.d/groups/gnome/gnome-contacts-search-provider +++ b/apparmor.d/groups/gnome/gnome-contacts-search-provider @@ -13,7 +13,6 @@ profile gnome-contacts-search-provider @{exec_path} { include include include - include signal (send) set=(term) peer=unconfined, diff --git a/apparmor.d/groups/gnome/gnome-control-center-goa-helper b/apparmor.d/groups/gnome/gnome-control-center-goa-helper index 740c189e..fe93b16d 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-goa-helper +++ b/apparmor.d/groups/gnome/gnome-control-center-goa-helper @@ -19,7 +19,6 @@ profile gnome-control-center-goa-helper @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index f945ad57..a7be9c98 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -21,7 +21,6 @@ profile gnome-extension-gsconnect @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index a2829ee6..fd3c08cd 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -15,7 +15,6 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { include include include - include capability ipc_lock, diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index 9206d5d8..4a277ce0 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -15,7 +15,6 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon index 0924bbc2..54499336 100644 --- a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon +++ b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon @@ -12,7 +12,6 @@ profile gnome-remote-desktop-daemon @{exec_path} { include include include - include network inet stream, network inet6 stream, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index cff45ca7..bfd78620 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -14,7 +14,6 @@ profile gnome-software @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/gnome/goa-daemon b/apparmor.d/groups/gnome/goa-daemon index 68a49045..17a8ae37 100644 --- a/apparmor.d/groups/gnome/goa-daemon +++ b/apparmor.d/groups/gnome/goa-daemon @@ -15,7 +15,6 @@ profile goa-daemon @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 2e7e4af6..85c88881 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -24,7 +24,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { include include include - include include # userns, diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index 0dbd3e0d..2970f9da 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -18,7 +18,6 @@ profile org.gnome.NautilusPreviewer @{exec_path} { include include include - include network netlink raw, diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index 58584914..76dfccd7 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -18,7 +18,6 @@ profile seahorse @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index b41f0731..9f00a3d8 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -21,7 +21,6 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { include include include - include network netlink raw, diff --git a/apparmor.d/groups/kde/kiod b/apparmor.d/groups/kde/kiod index bf55dcbf..13ad20f2 100644 --- a/apparmor.d/groups/kde/kiod +++ b/apparmor.d/groups/kde/kiod @@ -12,7 +12,6 @@ profile kiod @{exec_path} { include include include - include network netlink raw, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 8d995ab5..88cc7f7a 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -14,7 +14,6 @@ profile kioworker @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/kde/plasma-discover b/apparmor.d/groups/kde/plasma-discover index 2b91d0cc..1e3d63fa 100644 --- a/apparmor.d/groups/kde/plasma-discover +++ b/apparmor.d/groups/kde/plasma-discover @@ -14,7 +14,6 @@ profile plasma-discover @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession index bff35d60..35c94f61 100644 --- a/apparmor.d/groups/kde/sddm-xsession +++ b/apparmor.d/groups/kde/sddm-xsession @@ -93,7 +93,6 @@ profile sddm-xsession @{exec_path} { profile gpg { include include - include include capability dac_read_search, diff --git a/apparmor.d/groups/kde/xdm-xsession b/apparmor.d/groups/kde/xdm-xsession index 4f3aa753..5633bbfb 100644 --- a/apparmor.d/groups/kde/xdm-xsession +++ b/apparmor.d/groups/kde/xdm-xsession @@ -12,7 +12,6 @@ profile xdm-xsession @{exec_path} { include include include - include include @{exec_path} mr, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 84d87f09..c19ef9b4 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -18,7 +18,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { include include include - include include capability audit_write, diff --git a/apparmor.d/groups/network/networkd-dispatcher b/apparmor.d/groups/network/networkd-dispatcher index d0ca4473..15758333 100644 --- a/apparmor.d/groups/network/networkd-dispatcher +++ b/apparmor.d/groups/network/networkd-dispatcher @@ -11,7 +11,6 @@ profile networkd-dispatcher @{exec_path} { include include include - include include dbus receive bus=system path=/org/freedesktop/network1{,/link/*} diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index f6967a10..e8b9ba0f 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -26,7 +26,6 @@ include profile openvpn @{exec_path} flags=(attach_disconnected) { include include - include # Needed to remove the following errors: # ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1) diff --git a/apparmor.d/groups/pacman/arch-audit b/apparmor.d/groups/pacman/arch-audit index 7d505e39..730c0c84 100644 --- a/apparmor.d/groups/pacman/arch-audit +++ b/apparmor.d/groups/pacman/arch-audit @@ -10,7 +10,6 @@ include profile arch-audit @{exec_path} { include include - include include capability dac_read_search, diff --git a/apparmor.d/groups/pacman/aurpublish b/apparmor.d/groups/pacman/aurpublish index 8fe36e3d..511d7604 100644 --- a/apparmor.d/groups/pacman/aurpublish +++ b/apparmor.d/groups/pacman/aurpublish @@ -11,7 +11,6 @@ profile aurpublish @{exec_path} { include include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/groups/pacman/paccache b/apparmor.d/groups/pacman/paccache index fa3589f3..460e9b7e 100644 --- a/apparmor.d/groups/pacman/paccache +++ b/apparmor.d/groups/pacman/paccache @@ -10,7 +10,6 @@ include profile paccache @{exec_path} flags=(attach_disconnected) { include include - include capability dac_read_search, capability mknod, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 6cb3ed79..e86c7737 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -12,7 +12,6 @@ profile pacman @{exec_path} { include include include - include include capability audit_write, @@ -169,7 +168,6 @@ profile pacman @{exec_path} { profile gpg { include include - include include capability dac_read_search, diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio index 90309ee6..93473768 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio @@ -50,7 +50,6 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) { profile pacman { include - include capability dac_read_search, diff --git a/apparmor.d/groups/pacman/reflector b/apparmor.d/groups/pacman/reflector index 46e2ed80..8aceff71 100644 --- a/apparmor.d/groups/pacman/reflector +++ b/apparmor.d/groups/pacman/reflector @@ -10,7 +10,6 @@ include profile reflector @{exec_path} flags=(attach_disconnected) { include include - include include include diff --git a/apparmor.d/groups/ssh/sftp-server b/apparmor.d/groups/ssh/sftp-server index 1f4470d5..f00e32df 100644 --- a/apparmor.d/groups/ssh/sftp-server +++ b/apparmor.d/groups/ssh/sftp-server @@ -10,7 +10,6 @@ include @{exec_path} += @{lib}/ssh/sftp-server profile sftp-server @{exec_path} { include - include include capability dac_read_search, diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 796a405a..0ea99782 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -12,7 +12,6 @@ profile ssh @{exec_path} { include include include - include signal (receive) set=(term) peer=gnome-keyring-daemon, diff --git a/apparmor.d/groups/ssh/ssh-agent b/apparmor.d/groups/ssh/ssh-agent index 0070d955..cd30a18b 100644 --- a/apparmor.d/groups/ssh/ssh-agent +++ b/apparmor.d/groups/ssh/ssh-agent @@ -11,7 +11,6 @@ include profile ssh-agent @{exec_path} { include include - include signal (receive) set=term peer=cockpit-bridge, signal (receive) set=term peer=gnome-keyring-daemon, diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index 38793877..c642a562 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -13,7 +13,6 @@ profile ssh-keygen @{exec_path} { include include include - include @{exec_path} mr, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 74ad46b8..57030ccd 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -23,7 +23,6 @@ profile sshd @{exec_path} flags=(attach_disconnected) { include include include - include include include diff --git a/apparmor.d/groups/systemd/coredumpctl b/apparmor.d/groups/systemd/coredumpctl index 52d6374a..f6696140 100644 --- a/apparmor.d/groups/systemd/coredumpctl +++ b/apparmor.d/groups/systemd/coredumpctl @@ -47,7 +47,6 @@ profile coredumpctl @{exec_path} flags=(complain) { profile gdb { include - include include ptrace (trace), diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index b283e9cc..25d5c0a8 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -11,7 +11,6 @@ include profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include - include include # userns, diff --git a/apparmor.d/groups/systemd/systemd-cryptsetup b/apparmor.d/groups/systemd/systemd-cryptsetup index 0eb79e50..6f749483 100644 --- a/apparmor.d/groups/systemd/systemd-cryptsetup +++ b/apparmor.d/groups/systemd/systemd-cryptsetup @@ -11,7 +11,6 @@ profile systemd-cryptsetup @{exec_path} { include include include - include capability ipc_lock, capability net_admin, diff --git a/apparmor.d/groups/systemd/systemd-homed b/apparmor.d/groups/systemd/systemd-homed index 1593502e..20401421 100644 --- a/apparmor.d/groups/systemd/systemd-homed +++ b/apparmor.d/groups/systemd/systemd-homed @@ -12,7 +12,6 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { include include include - include include capability chown, diff --git a/apparmor.d/groups/systemd/systemd-resolved b/apparmor.d/groups/systemd/systemd-resolved index 8b7a3765..e0e113c6 100644 --- a/apparmor.d/groups/systemd/systemd-resolved +++ b/apparmor.d/groups/systemd/systemd-resolved @@ -12,7 +12,6 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index dbc08c1f..db297ba3 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -13,7 +13,6 @@ profile apport @{exec_path} flags=(attach_disconnected) { include include include - include include capability chown, diff --git a/apparmor.d/groups/ubuntu/apport-checkreports b/apparmor.d/groups/ubuntu/apport-checkreports index 05869638..96154c84 100644 --- a/apparmor.d/groups/ubuntu/apport-checkreports +++ b/apparmor.d/groups/ubuntu/apport-checkreports @@ -10,7 +10,6 @@ include profile apport-checkreports @{exec_path} flags=(attach_disconnected) { include include - include include @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 52ae40f4..ebaeb956 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -17,7 +17,6 @@ profile apport-gtk @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index 920e74f9..7d7bc961 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -16,7 +16,6 @@ profile check-new-release-gtk @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/ubuntu/do-release-upgrade b/apparmor.d/groups/ubuntu/do-release-upgrade index d3badbbf..519cf655 100644 --- a/apparmor.d/groups/ubuntu/do-release-upgrade +++ b/apparmor.d/groups/ubuntu/do-release-upgrade @@ -12,7 +12,6 @@ profile do-release-upgrade @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/ubuntu/hwe-support-status b/apparmor.d/groups/ubuntu/hwe-support-status index ad2436cb..8f6ca752 100644 --- a/apparmor.d/groups/ubuntu/hwe-support-status +++ b/apparmor.d/groups/ubuntu/hwe-support-status @@ -11,7 +11,6 @@ profile hwe-support-status @{exec_path} { include include include - include @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/list-oem-metapackages b/apparmor.d/groups/ubuntu/list-oem-metapackages index 5ada34c1..fdd3eba3 100644 --- a/apparmor.d/groups/ubuntu/list-oem-metapackages +++ b/apparmor.d/groups/ubuntu/list-oem-metapackages @@ -10,7 +10,6 @@ include profile list-oem-metapackages @{exec_path} { include include - include include @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index c7a14399..d43d71f5 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -12,7 +12,6 @@ profile software-properties-dbus @{exec_path} { include include include - include include # dbus: own bus=system name=com.ubuntu.SoftwareProperties diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index d9a20be5..2e17c64c 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -18,7 +18,6 @@ profile software-properties-gtk @{exec_path} { include include include - include include dbus bind bus=session name=com.ubuntu.SoftwareProperties, diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index 3b6cbe22..519d46b4 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -12,7 +12,6 @@ profile subiquity-console-conf @{exec_path} { include include include - include capability chown, capability fsetid, diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index 9f33e251..d0aa8d9d 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -12,7 +12,6 @@ profile ubuntu-advantage @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index a79ba5d5..5dd723b3 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -23,7 +23,6 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include - include include include diff --git a/apparmor.d/groups/ubuntu/update-motd-updates-available b/apparmor.d/groups/ubuntu/update-motd-updates-available index 387afb69..c20464fe 100644 --- a/apparmor.d/groups/ubuntu/update-motd-updates-available +++ b/apparmor.d/groups/ubuntu/update-motd-updates-available @@ -12,7 +12,6 @@ profile update-motd-updates-available @{exec_path} { include include include - include include capability dac_read_search, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 0be2616e..c8d3b678 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -19,7 +19,6 @@ profile update-notifier @{exec_path} { include include include - include include unix (bind) type=stream addr=@@{hex}/bus/systemd/bus-api-user, diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index f3f9bca3..4bad61ee 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -12,7 +12,6 @@ profile cockpit-bridge @{exec_path} { include include include - include include capability dac_read_search, diff --git a/apparmor.d/groups/virt/cockpit-certificate-helper b/apparmor.d/groups/virt/cockpit-certificate-helper index 5d37ce71..2979a847 100644 --- a/apparmor.d/groups/virt/cockpit-certificate-helper +++ b/apparmor.d/groups/virt/cockpit-certificate-helper @@ -10,7 +10,6 @@ include profile cockpit-certificate-helper @{exec_path} { include include - include @{exec_path} mr, diff --git a/apparmor.d/groups/virt/libvirt-dbus b/apparmor.d/groups/virt/libvirt-dbus index 83ea8158..79ca92d0 100644 --- a/apparmor.d/groups/virt/libvirt-dbus +++ b/apparmor.d/groups/virt/libvirt-dbus @@ -10,7 +10,6 @@ include profile libvirt-dbus @{exec_path} { include include - include @{exec_path} mr, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index cccb08de..dc5f7787 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -22,7 +22,6 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { include include include - include capability audit_write, capability bpf, diff --git a/apparmor.d/groups/virt/virt-aa-helper b/apparmor.d/groups/virt/virt-aa-helper index 9a5c9700..e784b9cf 100644 --- a/apparmor.d/groups/virt/virt-aa-helper +++ b/apparmor.d/groups/virt/virt-aa-helper @@ -10,7 +10,6 @@ include @{exec_path} = @{lib}/libvirt/virt-aa-helper profile virt-aa-helper @{exec_path} { include - include capability dac_override, capability dac_read_search, diff --git a/apparmor.d/groups/virt/virtinterfaced b/apparmor.d/groups/virt/virtinterfaced index 3989b792..918933e5 100644 --- a/apparmor.d/groups/virt/virtinterfaced +++ b/apparmor.d/groups/virt/virtinterfaced @@ -10,7 +10,6 @@ include profile virtinterfaced @{exec_path} flags=(attach_disconnected) { include include - include network netlink raw, diff --git a/apparmor.d/groups/virt/virtlogd b/apparmor.d/groups/virt/virtlogd index 393e26ef..e8c0271a 100644 --- a/apparmor.d/groups/virt/virtlogd +++ b/apparmor.d/groups/virt/virtlogd @@ -10,7 +10,6 @@ include profile virtlogd @{exec_path} flags=(attach_disconnected) { include include - include ptrace (read) peer=libvirtd, ptrace (read) peer=unconfined, diff --git a/apparmor.d/groups/virt/virtnetworkd b/apparmor.d/groups/virt/virtnetworkd index cbf19612..c9849bcb 100644 --- a/apparmor.d/groups/virt/virtnetworkd +++ b/apparmor.d/groups/virt/virtnetworkd @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/virtnetworkd profile virtnetworkd @{exec_path} flags=(attach_disconnected) { include - include include network netlink raw, diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index 0f34b03f..658213f5 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -13,7 +13,6 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { include include include - include capability net_admin, capability sys_admin, diff --git a/apparmor.d/groups/virt/virtsecretd b/apparmor.d/groups/virt/virtsecretd index 1fa92a4b..af18409a 100644 --- a/apparmor.d/groups/virt/virtsecretd +++ b/apparmor.d/groups/virt/virtsecretd @@ -10,7 +10,6 @@ include profile virtsecretd @{exec_path} flags=(attach_disconnected) { include include - include network netlink raw, diff --git a/apparmor.d/groups/virt/virtstoraged b/apparmor.d/groups/virt/virtstoraged index d9b2ec5c..c7e5fb2c 100644 --- a/apparmor.d/groups/virt/virtstoraged +++ b/apparmor.d/groups/virt/virtstoraged @@ -12,7 +12,6 @@ include profile virtstoraged @{exec_path} flags=(attach_disconnected) { include include - include capability dac_read_search, diff --git a/apparmor.d/profiles-a-f/anyremote b/apparmor.d/profiles-a-f/anyremote index ab167755..b24b6c13 100644 --- a/apparmor.d/profiles-a-f/anyremote +++ b/apparmor.d/profiles-a-f/anyremote @@ -141,7 +141,6 @@ profile anyremote @{exec_path} { profile curl { include include - include include @{bin}/curl mr, diff --git a/apparmor.d/profiles-a-f/appstreamcli b/apparmor.d/profiles-a-f/appstreamcli index e9e8bf6e..03c56699 100644 --- a/apparmor.d/profiles-a-f/appstreamcli +++ b/apparmor.d/profiles-a-f/appstreamcli @@ -65,7 +65,6 @@ profile appstreamcli @{exec_path} flags=(complain) { profile curl { include include - include include @{bin}/curl mr, diff --git a/apparmor.d/profiles-a-f/birdtray b/apparmor.d/profiles-a-f/birdtray index 96b786a6..087b83e4 100644 --- a/apparmor.d/profiles-a-f/birdtray +++ b/apparmor.d/profiles-a-f/birdtray @@ -19,7 +19,6 @@ profile birdtray @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-a-f/conky b/apparmor.d/profiles-a-f/conky index 48ce6cc0..2437212b 100644 --- a/apparmor.d/profiles-a-f/conky +++ b/apparmor.d/profiles-a-f/conky @@ -15,7 +15,6 @@ profile conky @{exec_path} { include include include - include include # To get the external IP address @@ -155,7 +154,6 @@ profile conky @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-a-f/cupsd b/apparmor.d/profiles-a-f/cupsd index faf803ee..785428b6 100644 --- a/apparmor.d/profiles-a-f/cupsd +++ b/apparmor.d/profiles-a-f/cupsd @@ -12,7 +12,6 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { include include include - include include capability audit_write, diff --git a/apparmor.d/profiles-a-f/ddclient b/apparmor.d/profiles-a-f/ddclient index 29a4ebbf..96e02b28 100644 --- a/apparmor.d/profiles-a-f/ddclient +++ b/apparmor.d/profiles-a-f/ddclient @@ -12,7 +12,6 @@ profile ddclient @{exec_path} { include include include - include include @{exec_path} r, diff --git a/apparmor.d/profiles-a-f/dhclient b/apparmor.d/profiles-a-f/dhclient index e38d0289..5925c638 100644 --- a/apparmor.d/profiles-a-f/dhclient +++ b/apparmor.d/profiles-a-f/dhclient @@ -11,7 +11,6 @@ include profile dhclient @{exec_path} { include include - include capability net_admin, capability net_bind_service, diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script index d1a86cfa..418caf38 100644 --- a/apparmor.d/profiles-a-f/dhclient-script +++ b/apparmor.d/profiles-a-f/dhclient-script @@ -11,7 +11,6 @@ include profile dhclient-script @{exec_path} { include include - include include capability net_admin, diff --git a/apparmor.d/profiles-a-f/dig b/apparmor.d/profiles-a-f/dig index a438e0a2..8d3d1e7d 100644 --- a/apparmor.d/profiles-a-f/dig +++ b/apparmor.d/profiles-a-f/dig @@ -12,7 +12,6 @@ profile dig @{exec_path} { include include include - include capability dac_override, capability dac_read_search, diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 85b87d2f..c54a16f0 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -13,7 +13,6 @@ profile dkms @{exec_path} flags=(attach_disconnected) { include include include - include capability dac_read_search, capability mknod, @@ -118,7 +117,6 @@ profile dkms @{exec_path} flags=(attach_disconnected) { profile kmod { include include - include @{bin}/kmod mr, diff --git a/apparmor.d/profiles-a-f/downloadhelper b/apparmor.d/profiles-a-f/downloadhelper index 49d88b22..1be45ad5 100644 --- a/apparmor.d/profiles-a-f/downloadhelper +++ b/apparmor.d/profiles-a-f/downloadhelper @@ -10,7 +10,6 @@ include profile downloadhelper @{exec_path} { include include - include include network inet dgram, diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index d6b73659..39dc1842 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -17,7 +17,6 @@ profile evince @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-a-f/fail2ban-server b/apparmor.d/profiles-a-f/fail2ban-server index 6b809406..e7b81e84 100644 --- a/apparmor.d/profiles-a-f/fail2ban-server +++ b/apparmor.d/profiles-a-f/fail2ban-server @@ -10,7 +10,6 @@ include profile fail2ban-server @{exec_path} flags=(attach_disconnected) { include include - include include capability dac_read_search, diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/profiles-a-f/firewalld index 5e820626..179e3650 100644 --- a/apparmor.d/profiles-a-f/firewalld +++ b/apparmor.d/profiles-a-f/firewalld @@ -14,7 +14,6 @@ profile firewalld @{exec_path} { include include include - include capability mknod, capability net_admin, diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index 11bf2a45..a5523785 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -16,7 +16,6 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain include include include - include include # userns, diff --git a/apparmor.d/profiles-a-f/flatpak-oci-authenticator b/apparmor.d/profiles-a-f/flatpak-oci-authenticator index b39a2a42..ba2af563 100644 --- a/apparmor.d/profiles-a-f/flatpak-oci-authenticator +++ b/apparmor.d/profiles-a-f/flatpak-oci-authenticator @@ -9,7 +9,6 @@ include @{exec_path} = @{lib}/flatpak-oci-authenticator profile flatpak-oci-authenticator @{exec_path} { include - include @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/flatpak-system-helper b/apparmor.d/profiles-a-f/flatpak-system-helper index b8d02d2f..ca14e9d0 100644 --- a/apparmor.d/profiles-a-f/flatpak-system-helper +++ b/apparmor.d/profiles-a-f/flatpak-system-helper @@ -10,7 +10,6 @@ include profile flatpak-system-helper @{exec_path} { include include - include include include diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index befd0b3d..a6708d4f 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -20,7 +20,6 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) { include include include - include capability dac_override, capability dac_read_search, diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index ae399b52..150aa9d6 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -13,7 +13,6 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) { include include include - include include capability sys_nice, diff --git a/apparmor.d/profiles-g-l/gajim b/apparmor.d/profiles-g-l/gajim index e662cf05..048fcbcf 100644 --- a/apparmor.d/profiles-g-l/gajim +++ b/apparmor.d/profiles-g-l/gajim @@ -18,7 +18,6 @@ profile gajim @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-g-l/gio-querymodules b/apparmor.d/profiles-g-l/gio-querymodules index 0cd342e9..a8ba53f4 100644 --- a/apparmor.d/profiles-g-l/gio-querymodules +++ b/apparmor.d/profiles-g-l/gio-querymodules @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/gio-querymodules profile gio-querymodules @{exec_path} flags=(attach_disconnected) { include - include capability dac_read_search, capability mknod, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index ad439cc8..93679ec1 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -16,7 +16,6 @@ profile git @{exec_path} { include include include - include include network inet dgram, @@ -130,7 +129,6 @@ profile git @{exec_path} { profile ssh { include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-g-l/gpo b/apparmor.d/profiles-g-l/gpo index 819eccd3..da33f7bc 100644 --- a/apparmor.d/profiles-g-l/gpo +++ b/apparmor.d/profiles-g-l/gpo @@ -14,7 +14,6 @@ profile gpo @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-g-l/gpodder b/apparmor.d/profiles-g-l/gpodder index dd5a648b..60fe931f 100644 --- a/apparmor.d/profiles-g-l/gpodder +++ b/apparmor.d/profiles-g-l/gpodder @@ -17,7 +17,6 @@ profile gpodder @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-g-l/gtk-youtube-viewer b/apparmor.d/profiles-g-l/gtk-youtube-viewer index 3219a327..9f3e50df 100644 --- a/apparmor.d/profiles-g-l/gtk-youtube-viewer +++ b/apparmor.d/profiles-g-l/gtk-youtube-viewer @@ -16,7 +16,6 @@ profile gtk-youtube-viewer @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-g-l/hexchat b/apparmor.d/profiles-g-l/hexchat index cdbe1b99..a802ea63 100644 --- a/apparmor.d/profiles-g-l/hexchat +++ b/apparmor.d/profiles-g-l/hexchat @@ -17,7 +17,6 @@ profile hexchat @{exec_path} { include include include - include include # For python/perl plugins include diff --git a/apparmor.d/profiles-g-l/host b/apparmor.d/profiles-g-l/host index 680ea961..d063bf16 100644 --- a/apparmor.d/profiles-g-l/host +++ b/apparmor.d/profiles-g-l/host @@ -11,7 +11,6 @@ profile host @{exec_path} { include include include - include capability ipc_lock, diff --git a/apparmor.d/profiles-g-l/hugo b/apparmor.d/profiles-g-l/hugo index 724c1784..78fc78f9 100644 --- a/apparmor.d/profiles-g-l/hugo +++ b/apparmor.d/profiles-g-l/hugo @@ -11,7 +11,6 @@ include profile hugo @{exec_path} { include include - include include network inet dgram, diff --git a/apparmor.d/profiles-g-l/hypnotix b/apparmor.d/profiles-g-l/hypnotix index f3430dbf..4a0679f5 100644 --- a/apparmor.d/profiles-g-l/hypnotix +++ b/apparmor.d/profiles-g-l/hypnotix @@ -17,7 +17,6 @@ profile hypnotix @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-g-l/inxi b/apparmor.d/profiles-g-l/inxi index 7544a119..2d200377 100644 --- a/apparmor.d/profiles-g-l/inxi +++ b/apparmor.d/profiles-g-l/inxi @@ -12,7 +12,6 @@ profile inxi @{exec_path} { include include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index f493b28a..d8063718 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -18,7 +18,6 @@ profile keepassxc @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index d7748fac..5872ac5d 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -12,7 +12,6 @@ profile kmod @{exec_path} flags=(attach_disconnected) { include include include - include capability dac_read_search, capability dac_override, diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo b/apparmor.d/profiles-g-l/landscape-sysinfo index 34f4ae1c..28c44f93 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo +++ b/apparmor.d/profiles-g-l/landscape-sysinfo @@ -10,7 +10,6 @@ include profile landscape-sysinfo @{exec_path} { include include - include include capability dac_override, diff --git a/apparmor.d/profiles-g-l/lynx b/apparmor.d/profiles-g-l/lynx index 8f77c79e..6026b822 100644 --- a/apparmor.d/profiles-g-l/lynx +++ b/apparmor.d/profiles-g-l/lynx @@ -12,7 +12,6 @@ profile lynx @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/megasync b/apparmor.d/profiles-m-r/megasync index 72820bbf..b619dfd5 100644 --- a/apparmor.d/profiles-m-r/megasync +++ b/apparmor.d/profiles-m-r/megasync @@ -22,7 +22,6 @@ profile megasync @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/merkaartor b/apparmor.d/profiles-m-r/merkaartor index ec4e960c..a0f5d310 100644 --- a/apparmor.d/profiles-m-r/merkaartor +++ b/apparmor.d/profiles-m-r/merkaartor @@ -20,7 +20,6 @@ profile merkaartor @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/minitube b/apparmor.d/profiles-m-r/minitube index 6bcef8b9..e01f2c30 100644 --- a/apparmor.d/profiles-m-r/minitube +++ b/apparmor.d/profiles-m-r/minitube @@ -22,7 +22,6 @@ profile minitube @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index f3dd9094..304b5834 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -160,7 +160,6 @@ profile mkinitramfs @{exec_path} { profile kmod { include include - include @{bin}/kmod mr, diff --git a/apparmor.d/profiles-m-r/mkvtoolnix-gui b/apparmor.d/profiles-m-r/mkvtoolnix-gui index 1d29f350..95d9ac8f 100644 --- a/apparmor.d/profiles-m-r/mkvtoolnix-gui +++ b/apparmor.d/profiles-m-r/mkvtoolnix-gui @@ -17,7 +17,6 @@ profile mkvtoolnix-gui @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/mpsyt b/apparmor.d/profiles-m-r/mpsyt index 2f912943..a4aaf531 100644 --- a/apparmor.d/profiles-m-r/mpsyt +++ b/apparmor.d/profiles-m-r/mpsyt @@ -13,7 +13,6 @@ profile mpsyt @{exec_path} { include include include - include include signal (send) set=(term, kill) peer=mpv, diff --git a/apparmor.d/profiles-m-r/mpv b/apparmor.d/profiles-m-r/mpv index 825786b7..9cb3c796 100644 --- a/apparmor.d/profiles-m-r/mpv +++ b/apparmor.d/profiles-m-r/mpv @@ -17,7 +17,6 @@ profile mpv @{exec_path} { include include include - include include include diff --git a/apparmor.d/profiles-m-r/mumble b/apparmor.d/profiles-m-r/mumble index f332a164..6608498b 100644 --- a/apparmor.d/profiles-m-r/mumble +++ b/apparmor.d/profiles-m-r/mumble @@ -15,7 +15,6 @@ profile mumble @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/murmurd b/apparmor.d/profiles-m-r/murmurd index d548660b..f9ee4427 100644 --- a/apparmor.d/profiles-m-r/murmurd +++ b/apparmor.d/profiles-m-r/murmurd @@ -10,7 +10,6 @@ profile murmurd @{exec_path} { include include include - include include capability chown, diff --git a/apparmor.d/profiles-m-r/mutt b/apparmor.d/profiles-m-r/mutt index 2f0724f3..0bc43c8e 100644 --- a/apparmor.d/profiles-m-r/mutt +++ b/apparmor.d/profiles-m-r/mutt @@ -11,7 +11,6 @@ profile mutt @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/nmap b/apparmor.d/profiles-m-r/nmap index 58ee3d78..8366426b 100644 --- a/apparmor.d/profiles-m-r/nmap +++ b/apparmor.d/profiles-m-r/nmap @@ -12,7 +12,6 @@ profile nmap @{exec_path} { include include include - include capability net_bind_service, capability net_raw, diff --git a/apparmor.d/profiles-m-r/nslookup b/apparmor.d/profiles-m-r/nslookup index 91cdda34..1cf1ec1f 100644 --- a/apparmor.d/profiles-m-r/nslookup +++ b/apparmor.d/profiles-m-r/nslookup @@ -11,7 +11,6 @@ profile nslookup @{exec_path} { include include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-m-r/onefetch b/apparmor.d/profiles-m-r/onefetch index a60e0188..02618d16 100644 --- a/apparmor.d/profiles-m-r/onefetch +++ b/apparmor.d/profiles-m-r/onefetch @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/onefetch profile onefetch @{exec_path} { include - include include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index aa3c0f83..dc720a99 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -14,7 +14,6 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { include include include - include include include if exists diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index b91ab9b2..929b96a8 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -100,7 +100,6 @@ profile pass @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/pass-import b/apparmor.d/profiles-m-r/pass-import index 8d09b9a3..f14cf3a1 100644 --- a/apparmor.d/profiles-m-r/pass-import +++ b/apparmor.d/profiles-m-r/pass-import @@ -10,7 +10,6 @@ include profile pass-import @{exec_path} { include include - include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index ac654bb1..7b951185 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -19,7 +19,6 @@ profile psi @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index ba29d2ca..b2ba57c2 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -19,7 +19,6 @@ profile psi-plus @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/qbittorrent b/apparmor.d/profiles-m-r/qbittorrent index c176a3b6..579a2dc5 100644 --- a/apparmor.d/profiles-m-r/qbittorrent +++ b/apparmor.d/profiles-m-r/qbittorrent @@ -22,7 +22,6 @@ profile qbittorrent @{exec_path} { include include include - include include include include @@ -122,7 +121,6 @@ profile qbittorrent @{exec_path} { profile python { include include - include include include diff --git a/apparmor.d/profiles-m-r/qbittorrent-nox b/apparmor.d/profiles-m-r/qbittorrent-nox index 65b2ffe2..7d820645 100644 --- a/apparmor.d/profiles-m-r/qbittorrent-nox +++ b/apparmor.d/profiles-m-r/qbittorrent-nox @@ -11,7 +11,6 @@ include profile qbittorrent-nox @{exec_path} { include include - include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/quiterss b/apparmor.d/profiles-m-r/quiterss index 2979a06e..12425d52 100644 --- a/apparmor.d/profiles-m-r/quiterss +++ b/apparmor.d/profiles-m-r/quiterss @@ -22,7 +22,6 @@ profile quiterss @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index 681c5307..78dc3cef 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -22,7 +22,6 @@ profile remmina @{exec_path} { include include include - include include include diff --git a/apparmor.d/profiles-m-r/repo b/apparmor.d/profiles-m-r/repo index 26b7c107..38a3c0f6 100644 --- a/apparmor.d/profiles-m-r/repo +++ b/apparmor.d/profiles-m-r/repo @@ -14,7 +14,6 @@ profile repo @{exec_path} { include include include - include include network inet dgram, @@ -67,7 +66,6 @@ profile repo @{exec_path} { profile curl { include include - include include @{bin}/curl mr, diff --git a/apparmor.d/profiles-m-r/rngd b/apparmor.d/profiles-m-r/rngd index e2fff81b..00820b5a 100644 --- a/apparmor.d/profiles-m-r/rngd +++ b/apparmor.d/profiles-m-r/rngd @@ -12,7 +12,6 @@ profile rngd @{exec_path} flags=(attach_disconnected) { include include include - include capability dac_read_search, capability net_admin, diff --git a/apparmor.d/profiles-m-r/rpi-imager b/apparmor.d/profiles-m-r/rpi-imager index dbc9eae8..75e855f9 100644 --- a/apparmor.d/profiles-m-r/rpi-imager +++ b/apparmor.d/profiles-m-r/rpi-imager @@ -21,7 +21,6 @@ profile rpi-imager @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/rustdesk b/apparmor.d/profiles-m-r/rustdesk index ac91bc2d..12edc295 100644 --- a/apparmor.d/profiles-m-r/rustdesk +++ b/apparmor.d/profiles-m-r/rustdesk @@ -15,7 +15,6 @@ profile rustdesk @{exec_path} { include include include - include capability dac_read_search, capability dac_override, @@ -110,7 +109,6 @@ profile rustdesk_pynput_service /usr/share/rustdesk/files/pynput_service.py { profile rustdesk_python { include include - include capability dac_read_search, capability dac_override, diff --git a/apparmor.d/profiles-s-z/s3fs b/apparmor.d/profiles-s-z/s3fs index 384feee1..721a1b46 100644 --- a/apparmor.d/profiles-s-z/s3fs +++ b/apparmor.d/profiles-s-z/s3fs @@ -10,7 +10,6 @@ include profile s3fs @{exec_path} { include include - include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/smplayer b/apparmor.d/profiles-s-z/smplayer index ca687a5a..feec4824 100644 --- a/apparmor.d/profiles-s-z/smplayer +++ b/apparmor.d/profiles-s-z/smplayer @@ -19,7 +19,6 @@ profile smplayer @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/smtube b/apparmor.d/profiles-s-z/smtube index a6964141..ca01156c 100644 --- a/apparmor.d/profiles-s-z/smtube +++ b/apparmor.d/profiles-s-z/smtube @@ -19,7 +19,6 @@ profile smtube @{exec_path} { include include include - include include include diff --git a/apparmor.d/profiles-s-z/spectre-meltdown-checker b/apparmor.d/profiles-s-z/spectre-meltdown-checker index 37f4e55a..dc1f4d95 100644 --- a/apparmor.d/profiles-s-z/spectre-meltdown-checker +++ b/apparmor.d/profiles-s-z/spectre-meltdown-checker @@ -148,7 +148,6 @@ profile spectre-meltdown-checker @{exec_path} { include include include - include include deny capability net_admin, diff --git a/apparmor.d/profiles-s-z/speedtest b/apparmor.d/profiles-s-z/speedtest index a296333e..5c299fb8 100644 --- a/apparmor.d/profiles-s-z/speedtest +++ b/apparmor.d/profiles-s-z/speedtest @@ -11,7 +11,6 @@ include profile speedtest @{exec_path} { include include - include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 7931fb68..a9088dfd 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -21,7 +21,6 @@ profile spotify @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index 2717ecd4..c95eac75 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -22,7 +22,6 @@ profile strawberry @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/strawberry-tagreader b/apparmor.d/profiles-s-z/strawberry-tagreader index a70efd69..de4462c8 100644 --- a/apparmor.d/profiles-s-z/strawberry-tagreader +++ b/apparmor.d/profiles-s-z/strawberry-tagreader @@ -11,7 +11,6 @@ include profile strawberry-tagreader @{exec_path} { include include - include include signal (receive) set=(term, kill) peer=strawberry, diff --git a/apparmor.d/profiles-s-z/swtpm b/apparmor.d/profiles-s-z/swtpm index 35b83397..8b4fd09d 100644 --- a/apparmor.d/profiles-s-z/swtpm +++ b/apparmor.d/profiles-s-z/swtpm @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/swtpm profile swtpm @{exec_path} { include - include signal (receive) set=(term) peer=libvirtd, diff --git a/apparmor.d/profiles-s-z/system-config-printer b/apparmor.d/profiles-s-z/system-config-printer index 31c63fef..f6ff1f51 100644 --- a/apparmor.d/profiles-s-z/system-config-printer +++ b/apparmor.d/profiles-s-z/system-config-printer @@ -21,7 +21,6 @@ profile system-config-printer @{exec_path} flags=(complain) { include include include - include include include diff --git a/apparmor.d/profiles-s-z/system-config-printer-applet b/apparmor.d/profiles-s-z/system-config-printer-applet index 25bcb7d7..d39f94ee 100644 --- a/apparmor.d/profiles-s-z/system-config-printer-applet +++ b/apparmor.d/profiles-s-z/system-config-printer-applet @@ -12,7 +12,6 @@ profile system-config-printer-applet @{exec_path} { include include include - include network inet stream, network inet6 stream, diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index 096be4ff..d9c372ea 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -16,7 +16,6 @@ profile terminator @{exec_path} flags=(attach_disconnected) { include include include - include include capability sys_ptrace, diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index cbb5d244..9b82d3f6 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -27,7 +27,6 @@ profile thunderbird @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/transmission-gtk b/apparmor.d/profiles-s-z/transmission-gtk index 9e441613..2d1f2852 100644 --- a/apparmor.d/profiles-s-z/transmission-gtk +++ b/apparmor.d/profiles-s-z/transmission-gtk @@ -13,7 +13,6 @@ profile transmission-gtk @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/transmission-qt b/apparmor.d/profiles-s-z/transmission-qt index fb62c548..b8c68cd8 100644 --- a/apparmor.d/profiles-s-z/transmission-qt +++ b/apparmor.d/profiles-s-z/transmission-qt @@ -14,7 +14,6 @@ profile transmission-qt @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 5daa8fb1..55d30c2f 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -15,7 +15,6 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { include include include - include capability chown, capability dac_override, diff --git a/apparmor.d/profiles-s-z/update-ca-certificates b/apparmor.d/profiles-s-z/update-ca-certificates index e296541b..8d0f61b4 100644 --- a/apparmor.d/profiles-s-z/update-ca-certificates +++ b/apparmor.d/profiles-s-z/update-ca-certificates @@ -11,7 +11,6 @@ include profile update-ca-certificates @{exec_path} { include include - include include @{exec_path} rmix, diff --git a/apparmor.d/profiles-s-z/update-pciids b/apparmor.d/profiles-s-z/update-pciids index 4c54810e..75916646 100644 --- a/apparmor.d/profiles-s-z/update-pciids +++ b/apparmor.d/profiles-s-z/update-pciids @@ -45,7 +45,6 @@ profile update-pciids @{exec_path} { profile browse { include include - include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/update-smart-drivedb b/apparmor.d/profiles-s-z/update-smart-drivedb index 921f3d39..60c1de58 100644 --- a/apparmor.d/profiles-s-z/update-smart-drivedb +++ b/apparmor.d/profiles-s-z/update-smart-drivedb @@ -64,7 +64,6 @@ profile update-smart-drivedb @{exec_path} { include include include - include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/vidcutter b/apparmor.d/profiles-s-z/vidcutter index 788492cf..44a9be53 100644 --- a/apparmor.d/profiles-s-z/vidcutter +++ b/apparmor.d/profiles-s-z/vidcutter @@ -16,7 +16,6 @@ profile vidcutter @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index f27bc484..d4f8d403 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -19,7 +19,6 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/vlc-cache-gen b/apparmor.d/profiles-s-z/vlc-cache-gen index 3ae37366..7ac1306d 100644 --- a/apparmor.d/profiles-s-z/vlc-cache-gen +++ b/apparmor.d/profiles-s-z/vlc-cache-gen @@ -9,7 +9,6 @@ include @{exec_path} = @{lib}/vlc/vlc-cache-gen profile vlc-cache-gen @{exec_path} { include - include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/vsftpd b/apparmor.d/profiles-s-z/vsftpd index 90f38d67..727a1792 100644 --- a/apparmor.d/profiles-s-z/vsftpd +++ b/apparmor.d/profiles-s-z/vsftpd @@ -11,7 +11,6 @@ include profile vsftpd @{exec_path} { include include - include # Only for local users authentication include diff --git a/apparmor.d/profiles-s-z/wpa-supplicant b/apparmor.d/profiles-s-z/wpa-supplicant index a91cc3a4..070bae13 100644 --- a/apparmor.d/profiles-s-z/wpa-supplicant +++ b/apparmor.d/profiles-s-z/wpa-supplicant @@ -12,7 +12,6 @@ profile wpa-supplicant @{exec_path} flags=(attach_disconnected) { include include include - include capability chown, capability dac_override, diff --git a/apparmor.d/profiles-s-z/yadifad b/apparmor.d/profiles-s-z/yadifad index 7b0f8870..e24b45b0 100644 --- a/apparmor.d/profiles-s-z/yadifad +++ b/apparmor.d/profiles-s-z/yadifad @@ -7,7 +7,6 @@ include profile yadifad @{exec_path} { include include - include include capability dac_override, diff --git a/apparmor.d/profiles-s-z/youtube-dl b/apparmor.d/profiles-s-z/youtube-dl index e97010ee..23d6b16e 100644 --- a/apparmor.d/profiles-s-z/youtube-dl +++ b/apparmor.d/profiles-s-z/youtube-dl @@ -16,7 +16,6 @@ profile youtube-dl @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/youtube-viewer b/apparmor.d/profiles-s-z/youtube-viewer index 3a71104d..92c60e38 100644 --- a/apparmor.d/profiles-s-z/youtube-viewer +++ b/apparmor.d/profiles-s-z/youtube-viewer @@ -13,7 +13,6 @@ profile youtube-viewer @{exec_path} { include include include - include include signal (receive) set=(hup, winch) peer=gtk-youtube-viewer//xterm, diff --git a/apparmor.d/profiles-s-z/yt-dlp b/apparmor.d/profiles-s-z/yt-dlp index 7c69d1ee..d147f3a6 100644 --- a/apparmor.d/profiles-s-z/yt-dlp +++ b/apparmor.d/profiles-s-z/yt-dlp @@ -12,7 +12,6 @@ profile yt-dlp @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/ytdl b/apparmor.d/profiles-s-z/ytdl index c07cc23d..452eef3f 100644 --- a/apparmor.d/profiles-s-z/ytdl +++ b/apparmor.d/profiles-s-z/ytdl @@ -11,7 +11,6 @@ include profile ytdl @{exec_path} { include include - include include include include