mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-20 17:05:36 +01:00
feat(profile): add support for plasma 6.
This commit is contained in:
parent
3d425c7fdd
commit
4ab5e99a6f
38 changed files with 141 additions and 120 deletions
|
@ -49,16 +49,16 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
@{bin}/* rPUx,
|
||||
@{bin}/dbus-launch rix,
|
||||
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rix, # See #74, #80 & #235
|
||||
@{lib}/{,kf6/}kauth/{,libexec/}* rPx,
|
||||
@{lib}/@{multiarch}/libexec/ksmserver-logout-greeter rPx,
|
||||
@{lib}/@{multiarch}/tumbler-1/tumblerd rPUx,
|
||||
@{lib}/@{multiarch}/xfce[0-9]/xfconf/xfconfd rPx,
|
||||
@{lib}/@{multiarch}/libexec/ksmserver-logout-greeter rPx,
|
||||
@{lib}/* rPUx,
|
||||
@{lib}/atril/atrild rPx,
|
||||
@{lib}/dbus-1*/dbus-daemon-launch-helper rPx,
|
||||
@{lib}/gnome-shell/gnome-shell-calendar-server rPx,
|
||||
@{lib}/ibus/ibus-* rPx,
|
||||
@{lib}/kauth/{,libexec/}* rPx,
|
||||
@{lib}/kf5/kiod5 rPUx,
|
||||
@{lib}/kf{5,6}/kiod{5,6} rPx,
|
||||
@{lib}/telepathy/mission-control-5 rPx,
|
||||
@{lib}/xfce[0-9]/xfconf/xfconfd rPx,
|
||||
/usr/share/gnome-documents/org.gnome.Documents rPx,
|
||||
|
|
|
@ -9,10 +9,9 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/xdg-desktop-portal-kde
|
||||
profile xdg-desktop-portal-kde @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/kde-strict>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
@ -24,29 +23,13 @@ profile xdg-desktop-portal-kde @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/icu/@{int}.@{int}/*.dat r,
|
||||
/usr/share/qt5/qtlogging.ini r,
|
||||
|
||||
/etc/xdg/kdeglobals r,
|
||||
/etc/xdg/kwinrc r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
owner @{user_cache_dirs}/*.kcache r,
|
||||
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
|
||||
owner @{user_config_dirs}/autostart/org.kde.*.desktop r,
|
||||
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
|
||||
owner @{user_config_dirs}/kdedefaults/kwinrc r,
|
||||
owner @{user_config_dirs}/kdeglobals r,
|
||||
owner @{user_config_dirs}/kwinrc r,
|
||||
owner @{user_config_dirs}/xdg-desktop-portal-kderc r,
|
||||
|
||||
owner /tmp/xauth_@{rand6} r,
|
||||
|
||||
@{run}/user/@{uid}/xauth_@{rand6} rl,
|
||||
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/dev/tty r,
|
||||
|
|
|
@ -6,13 +6,15 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/baloo_file @{lib}/baloo_file
|
||||
@{exec_path} = @{bin}/baloo_file @{lib}/{,kf6/}baloo_file
|
||||
profile baloo @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-sensitive-home>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/kde-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/private-files-strict>
|
||||
|
||||
network netlink raw,
|
||||
|
@ -21,7 +23,7 @@ profile baloo @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib}/baloo_file_extractor rix,
|
||||
@{lib}/{,kf6/}baloo_file_extractor rix,
|
||||
|
||||
/usr/share/poppler/{,**} r,
|
||||
|
||||
|
|
|
@ -22,14 +22,16 @@ profile dolphin @{exec_path} {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
signal (send) set=(term) peer=kioslave5,
|
||||
signal (send) set=(term) peer=kioworker,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/ldd rix,
|
||||
@{lib}/kf5/kioslave5 rPx,
|
||||
@{lib}/@{multiarch}/kf5/kioslave5 rPx,
|
||||
@{lib}/@{multiarch}/libexec/kf5/kioslave5 rPx,
|
||||
|
||||
@{lib}/@{multiarch}/{,libexec/}kf5/kioslave5 rPx,
|
||||
@{lib}/@{multiarch}/{,libexec/}kf6/kioworker rPx,
|
||||
@{lib}/kf5/kioslave5 rPx,
|
||||
@{lib}/kf6/kioworker rPx,
|
||||
|
||||
# Share functions
|
||||
@{lib}/thunderbird/thunderbird.sh rPx,
|
||||
|
|
21
apparmor.d/groups/kde/drkonqi-coredump-processor
Normal file
21
apparmor.d/groups/kde/drkonqi-coredump-processor
Normal file
|
@ -0,0 +1,21 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/drkonqi-coredump-processor
|
||||
profile drkonqi-coredump-processor @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{run,var}/log/journal/ r,
|
||||
/{run,var}/log/journal/@{md5}/ r,
|
||||
/{run,var}/log/journal/@{md5}/user-@{uid}.journal r,
|
||||
/{run,var}/log/journal/@{md5}/user-@{uid}@@{uuid}.journal r,
|
||||
|
||||
include if exists <local/drkonqi-coredump-processor>
|
||||
}
|
|
@ -13,7 +13,7 @@ profile gmenudbusmenuproxy @{exec_path} {
|
|||
include <abstractions/kde-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
ptrace (read) peer=kded5,
|
||||
ptrace (read) peer=kded,
|
||||
|
||||
signal (receive) set=(cont, term) peer=@{systemd_user},
|
||||
|
||||
|
|
|
@ -27,6 +27,8 @@ profile kaccess @{exec_path} {
|
|||
|
||||
owner @{user_share_dirs}/mime/generic-icons r,
|
||||
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/dev/tty r,
|
||||
|
||||
include if exists <local/kaccess>
|
||||
|
|
|
@ -9,17 +9,18 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/kactivitymanagerd
|
||||
profile kactivitymanagerd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/kde-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/recent-documents-write>
|
||||
include <abstractions/user-read>
|
||||
include <abstractions/kde-strict>
|
||||
|
||||
signal (receive) set=(cont, term) peer=@{systemd_user},
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/xdg/menus/{,*/} r,
|
||||
/usr/share/kf5/kactivitymanagerd/{,**} r,
|
||||
/usr/share/kf{5,6}/kactivitymanagerd/{,**} r,
|
||||
/usr/share/kservices5/{,**} r,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
@ -27,7 +28,7 @@ profile kactivitymanagerd @{exec_path} {
|
|||
owner @{HOME}/@{XDG_DESKTOP_DIR}/ r,
|
||||
owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r,
|
||||
|
||||
owner @{user_cache_dirs}/ksycoca5_* r,
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* r,
|
||||
|
||||
owner @{user_config_dirs}/#@{int} rw,
|
||||
owner @{user_config_dirs}/kactivitymanagerdrc.lock rwk,
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kauth/{,libexec/}backlighthelper
|
||||
@{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}backlighthelper
|
||||
profile kauth-backlighthelper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kauth/{,libexec/}chargethresholdhelper
|
||||
@{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}chargethresholdhelper
|
||||
profile kauth-chargethresholdhelper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kauth/{,libexec/}discretegpuhelper
|
||||
@{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}discretegpuhelper
|
||||
profile kauth-discretegpuhelper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kauth/{,libexec/}fontinst
|
||||
@{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}fontinst
|
||||
profile kauth-fontinst @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/qt5>
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kauth/{,libexec/}kded-smart-helper
|
||||
@{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}kded-smart-helper
|
||||
profile kauth-kded-smart-helper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kauth/{,libexec/}kinfocenter-dmidecode-helper
|
||||
@{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}kinfocenter-dmidecode-helper
|
||||
profile kauth-kinfocenter-dmidecode-helper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
|
@ -20,15 +20,12 @@ profile kcminit @{exec_path} {
|
|||
|
||||
/etc/machine-id r,
|
||||
/etc/xdg/kcmdisplayrc r,
|
||||
/etc/xdg/kcminputrc r,
|
||||
|
||||
owner @{HOME}/.Xdefaults r,
|
||||
|
||||
owner @{user_config_dirs}/#@{int} rw,
|
||||
owner @{user_config_dirs}/gtkrc-2.0{,.@{rand6}} rwl,
|
||||
owner @{user_config_dirs}/gtkrc{,.@{rand6}} rwl,
|
||||
owner @{user_config_dirs}/kcminputrc r,
|
||||
owner @{user_config_dirs}/kdedefaults/kcminputrc r,
|
||||
owner @{user_config_dirs}/kgammarc r,
|
||||
owner @{user_config_dirs}/touchpadrc r,
|
||||
owner @{user_config_dirs}/touchpadxlibinputrc r,
|
||||
|
@ -43,6 +40,7 @@ profile kcminit @{exec_path} {
|
|||
|
||||
@{run}/user/@{uid}/xauth_@{rand6} rl,
|
||||
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
/dev/tty r,
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kf5/kconf_update
|
||||
@{exec_path} = @{lib}/kf{5,6}/kconf_update @{lib}/{,@{multiarch}/}libexec/kf{5,6}/kconf_update
|
||||
profile kconf_update @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
|
|
|
@ -12,6 +12,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted)
|
|||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/kde-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability wake_alarm,
|
||||
|
||||
|
@ -29,7 +30,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted)
|
|||
@{bin}/xargs rix,
|
||||
@{lib}/drkonqi rPx,
|
||||
|
||||
/usr/share/knotifications5/*.notifyrc r,
|
||||
/usr/share/knotifications{5,6}/*.notifyrc r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/machine-id r,
|
||||
|
|
|
@ -6,8 +6,8 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/kded5
|
||||
profile kded5 @{exec_path} {
|
||||
@{exec_path} = @{bin}/kded5 @{bin}/kded6
|
||||
profile kded @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/bus-system>
|
||||
|
@ -68,15 +68,15 @@ profile kded5 @{exec_path} {
|
|||
@{bin}/xrdb rPx,
|
||||
@{bin}/xsettingsd rPx,
|
||||
@{lib}/drkonqi rPx,
|
||||
@{lib}/kf5/kconf_update rPx,
|
||||
@{lib}/{,@{multiarch}/}libexec/kf5/kconf_update rPx,
|
||||
@{lib}/kf{5,6}/kconf_update rPx,
|
||||
@{lib}/{,@{multiarch}/}libexec/kf{5,6}/kconf_update rPx,
|
||||
@{lib}/{,@{multiarch}/}utempter/utempter rPx,
|
||||
|
||||
/usr/share/kconf_update/ r,
|
||||
/usr/share/kded5/{,**} r,
|
||||
/usr/share/kf5/kcookiejar/* r,
|
||||
/usr/share/kded{5,6}/{,**} r,
|
||||
/usr/share/kf{5,6}/kcookiejar/* r,
|
||||
/usr/share/khotkeys/{,**} r,
|
||||
/usr/share/knotifications5/{,**} r,
|
||||
/usr/share/knotifications{5,6}/{,**} r,
|
||||
/usr/share/kservices5/{,**} r,
|
||||
/usr/share/kservicetypes5/{,**} r,
|
||||
|
||||
|
@ -90,7 +90,7 @@ profile kded5 @{exec_path} {
|
|||
|
||||
owner @{HOME}/.gtkrc-2.0 rw,
|
||||
|
||||
@{user_cache_dirs}/ksycoca5_* rwlk -> @{user_cache_dirs}/#@{int},
|
||||
@{user_cache_dirs}/ksycoca{5,6}_* rwlk -> @{user_cache_dirs}/#@{int},
|
||||
owner @{user_cache_dirs}/#@{int} rw,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/plasmashell/ rw,
|
||||
|
@ -107,8 +107,8 @@ profile kded5 @{exec_path} {
|
|||
owner @{user_config_dirs}/kconf_updaterc rw,
|
||||
owner @{user_config_dirs}/kconf_updaterc.lock rwk,
|
||||
owner @{user_config_dirs}/kdebugrc r,
|
||||
owner @{user_config_dirs}/kded5rc.lock rwk,
|
||||
owner @{user_config_dirs}/kded5rc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/kded{5,6}rc.lock rwk,
|
||||
owner @{user_config_dirs}/kded{5,6}rc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/kdedefaults/{,**} r,
|
||||
owner @{user_config_dirs}/khotkeysrc.lock rwk,
|
||||
owner @{user_config_dirs}/khotkeysrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
|
||||
|
@ -124,6 +124,7 @@ profile kded5 @{exec_path} {
|
|||
owner @{user_config_dirs}/menus/{,**} r,
|
||||
owner @{user_config_dirs}/networkmanagement.notifyrc r,
|
||||
owner @{user_config_dirs}/plasma-nm r,
|
||||
owner @{user_config_dirs}/plasma-welcomerc r,
|
||||
owner @{user_config_dirs}/touchpadrc r,
|
||||
owner @{user_config_dirs}/xsettingsd/{,**} rw,
|
||||
|
||||
|
@ -131,7 +132,7 @@ profile kded5 @{exec_path} {
|
|||
owner @{user_share_dirs}/icc/{,edid-*} r,
|
||||
owner @{user_share_dirs}/kcookiejar/#@{int} rw,
|
||||
owner @{user_share_dirs}/kcookiejar/cookies.lock rwk,
|
||||
owner @{user_share_dirs}/kded5/{,**} rw,
|
||||
owner @{user_share_dirs}/kded{5,6}/{,**} rw,
|
||||
owner @{user_share_dirs}/kscreen/{,**} rwl,
|
||||
owner @{user_share_dirs}/kservices5/{,**} r,
|
||||
owner @{user_share_dirs}/ktp/cache.db rwk,
|
||||
|
@ -142,7 +143,7 @@ profile kded5 @{exec_path} {
|
|||
@{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/**
|
||||
@{run}/user/@{uid}/gvfs/ r,
|
||||
owner @{run}/user/@{uid}/#@{int} rw,
|
||||
owner @{run}/user/@{uid}/kded5*kioworker.socket rwl,
|
||||
owner @{run}/user/@{uid}/kded{5,6}*kioworker.socket rwl,
|
||||
|
||||
owner /tmp/plasma-csd-generator.@{rand6}/{,**} rw,
|
||||
|
||||
|
@ -159,7 +160,7 @@ profile kded5 @{exec_path} {
|
|||
|
||||
/dev/disk/by-label/ r,
|
||||
/dev/ptmx rw,
|
||||
/dev/rfkill r,
|
||||
/dev/rfkill rw,
|
||||
|
||||
profile pgrep {
|
||||
include <abstractions/base>
|
||||
|
@ -182,8 +183,8 @@ profile kded5 @{exec_path} {
|
|||
@{PROC}/tty/drivers r,
|
||||
@{PROC}/uptime r,
|
||||
|
||||
include if exists <local/kded5_pgrep>
|
||||
include if exists <local/kded_pgrep>
|
||||
}
|
||||
|
||||
include if exists <local/kded5>
|
||||
include if exists <local/kded>
|
||||
}
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kf5/kio_http_cache_cleaner
|
||||
@{exec_path} = @{lib}/kf{5,6}/kio_http_cache_cleaner
|
||||
profile kio_http_cache_cleaner @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
|
|
|
@ -6,8 +6,8 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kf5/kiod5
|
||||
profile kiod5 @{exec_path} {
|
||||
@{exec_path} = @{lib}/kf{5,6}/kiod{5,6}
|
||||
profile kiod @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/kde-strict>
|
||||
|
@ -32,5 +32,5 @@ profile kiod5 @{exec_path} {
|
|||
|
||||
/dev/tty r,
|
||||
|
||||
include if exists <local/kiod5>
|
||||
include if exists <local/kiod>
|
||||
}
|
|
@ -6,9 +6,9 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/@{multiarch}/kf5/kioslave5
|
||||
@{exec_path} += @{lib}/kf5/kioslave5
|
||||
profile kioslave5 @{exec_path} {
|
||||
@{exec_path} = @{lib}/kf6/kioworker @{lib}/@{multiarch}/{,libexec/}kf6/kioworker
|
||||
@{exec_path} += @{lib}/kf5/kioslave5 @{lib}/@{multiarch}/{,libexec/}kf5/kioslave5
|
||||
profile kioworker @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-sensitive-home>
|
||||
include <abstractions/graphics>
|
||||
|
@ -35,11 +35,11 @@ profile kioslave5 @{exec_path} {
|
|||
|
||||
@{lib}/libheif/ r,
|
||||
@{lib}/libheif/*.so* rm,
|
||||
@{lib}/kf5/kio_http_cache_cleaner rPx,
|
||||
@{lib}/kf{5,6}/kio_http_cache_cleaner rPx,
|
||||
|
||||
/usr/share/kio_desktop/directory.desktop r,
|
||||
/usr/share/kservices5/{,**} r,
|
||||
/usr/share/kservicetypes5/*.desktop r,
|
||||
/usr/share/kservices{5,6}/{,**} r,
|
||||
/usr/share/kservicetypes{5,6}/*.desktop r,
|
||||
/usr/share/remoteview/* r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
@ -71,7 +71,7 @@ profile kioslave5 @{exec_path} {
|
|||
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/kio_http/* rwl,
|
||||
owner @{user_cache_dirs}/ksycoca5_* r,
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* r,
|
||||
|
||||
owner @{user_config_dirs}/kio_httprc r,
|
||||
owner @{user_config_dirs}/menus/{,**} r,
|
||||
|
@ -81,7 +81,7 @@ profile kioslave5 @{exec_path} {
|
|||
owner @{user_share_dirs}/kactivitymanagerd/resources/database rk,
|
||||
owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk,
|
||||
owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw,
|
||||
owner @{user_share_dirs}/kservices5/{,**} r,
|
||||
owner @{user_share_dirs}/kservices{5,6}/{,**} r,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
|
||||
|
@ -95,5 +95,5 @@ profile kioslave5 @{exec_path} {
|
|||
|
||||
/dev/tty r,
|
||||
|
||||
include if exists <local/kioslave5>
|
||||
include if exists <local/kioworker>
|
||||
}
|
|
@ -29,7 +29,8 @@ profile konsole @{exec_path} flags=(attach_disconnected) {
|
|||
@{lib}/{,@{multiarch}/}utempter/utempter rPx,
|
||||
|
||||
/usr/share/color-schemes/{,**} r,
|
||||
/usr/share/knotifications5/plasma_workspace.notifyrc r,
|
||||
/usr/share/kf6/{,**} r,
|
||||
/usr/share/knotifications{5,6}/plasma_workspace.notifyrc r,
|
||||
/usr/share/konsole/{,**} r,
|
||||
/usr/share/sounds/** r,
|
||||
|
||||
|
@ -48,7 +49,7 @@ profile konsole @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
|
||||
owner @{user_share_dirs}/konsole/{,**} rw,
|
||||
owner @{user_share_dirs}/konsole/{,**} rwlk,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
owner /tmp/konsole.@{rand6} rw,
|
||||
|
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/kf5/kscreen_backend_launcher
|
||||
@{exec_path} = @{lib}/kf{5,6}/kscreen_backend_launcher
|
||||
profile kscreen_backend_launcher @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/kde-strict>
|
||||
|
|
|
@ -34,9 +34,9 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
@{user_bin_dirs}/** rPUx,
|
||||
|
||||
/usr/share/color-schemes/{,**} r,
|
||||
/usr/share/knotifications5/*.notifyrc r,
|
||||
/usr/share/kservices5/{,**} r,
|
||||
/usr/share/kservicetypes5/{,**} r,
|
||||
/usr/share/knotifications{5,6}/*.notifyrc r,
|
||||
/usr/share/kservices{5,6}/{,**} r,
|
||||
/usr/share/kservicetypes{5,6}/{,**} r,
|
||||
|
||||
/etc/xdg/menus/applications-merged/ r,
|
||||
/etc/machine-id r,
|
||||
|
@ -51,7 +51,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{user_cache_dirs}/#@{int} rw,
|
||||
owner @{user_cache_dirs}/fontconfig/*-le64.cache-* r,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/ksycoca5_* rwlk,
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* rwlk,
|
||||
|
||||
owner @{user_config_dirs}/#@{int} rw,
|
||||
owner @{user_config_dirs}/kscreenlockerrc r,
|
||||
|
|
|
@ -18,12 +18,11 @@ profile ksplashqml @{exec_path} {
|
|||
|
||||
/usr/share/plasma/** r,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/ksplash/ rw,
|
||||
owner @{user_cache_dirs}/ksplash/qmlcache/ rw,
|
||||
owner @{user_cache_dirs}/ksplash/qmlcache/*.qmlc rwl -> @{user_cache_dirs}/ksplash/qmlcache/#@{int},
|
||||
owner @{user_cache_dirs}/ksplash/qmlcache/*.qmlc.@{rand6} rwl -> @{user_cache_dirs}/ksplash/qmlcache/#@{int},
|
||||
owner @{user_cache_dirs}/ksplash/qmlcache/#@{int} rw,
|
||||
owner @{user_cache_dirs}/ksplash/** rwlk -> @{user_cache_dirs}/ksplash/**,
|
||||
|
||||
owner @{user_config_dirs}/kdedefaults/ksplashrc r,
|
||||
owner @{user_config_dirs}/kdedefaults/plasmarc r,
|
||||
|
|
|
@ -7,8 +7,8 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/kwalletd5
|
||||
profile kwalletd5 @{exec_path} {
|
||||
@{exec_path} = @{bin}/kwalletd{5,6}
|
||||
profile kwalletd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/consoles>
|
||||
|
@ -27,7 +27,7 @@ profile kwalletd5 @{exec_path} {
|
|||
|
||||
/usr/share/color-schemes/{,**} r,
|
||||
/usr/share/qt/translations/*.qm r,
|
||||
/usr/share/qt5/qtlogging.ini r,
|
||||
/usr/share/qt{5,6}/qtlogging.ini r,
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
@ -62,8 +62,8 @@ profile kwalletd5 @{exec_path} {
|
|||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
include if exists <local/kwalletd5_gpg>
|
||||
include if exists <local/kwalletd_gpg>
|
||||
}
|
||||
|
||||
include if exists <local/kwalletd5>
|
||||
include if exists <local/kwalletd>
|
||||
}
|
|
@ -7,8 +7,8 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/kwalletmanager5
|
||||
profile kwalletmanager5 @{exec_path} {
|
||||
@{exec_path} = @{bin}/kwalletmanager{5,6}
|
||||
profile kwalletmanager @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/consoles>
|
||||
|
@ -53,5 +53,5 @@ profile kwalletmanager5 @{exec_path} {
|
|||
/dev/shm/ r,
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
include if exists <local/kwalletmanager5>
|
||||
include if exists <local/kwalletmanager>
|
||||
}
|
|
@ -28,6 +28,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/kcminit rPx,
|
||||
@{bin}/plasmashell r,
|
||||
@{bin}/Xwayland rPx,
|
||||
@{lib}/kscreenlocker_greet rPx,
|
||||
|
@ -36,7 +37,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
|
|||
/usr/share/color-schemes/*.colors r,
|
||||
/usr/share/desktop-directories/*.directory r,
|
||||
/usr/share/kglobalaccel/{,**} r,
|
||||
/usr/share/knotifications5/ksmserver.notifyrc r,
|
||||
/usr/share/knotifications{5,6}/ksmserver.notifyrc r,
|
||||
/usr/share/kservices5/{,**} r,
|
||||
/usr/share/kservicetypes5/{,*.desktop} r,
|
||||
/usr/share/kwin/{,**} r,
|
||||
|
@ -55,7 +56,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
|
|||
owner /var/lib/sddm/.cache/fontconfig/*-le64.cache-@{int}.LCK l -> /var/lib/sddm/.cache/fontconfig/*-le64.cache-@{int}.TMP-@{rand6},
|
||||
owner /var/lib/sddm/.cache/mesa_shader_cache/** r,
|
||||
owner /var/lib/sddm/.cache/mesa_shader_cache/index rw,
|
||||
owner /var/lib/sddm/.cache/ksycoca5_* rwkl -> /var/lib/sddm/.cache/#@{int},
|
||||
owner /var/lib/sddm/.cache/ksycoca{5,6}_* rwkl -> /var/lib/sddm/.cache/#@{int},
|
||||
|
||||
owner /var/lib/sddm/.config/#@{int} rw,
|
||||
owner /var/lib/sddm/.config/kcminputrc r,
|
||||
|
@ -68,8 +69,8 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
|
|||
owner @{user_cache_dirs}/ r,
|
||||
owner @{user_cache_dirs}/#@{int} rw,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/ksycoca5_* r,
|
||||
owner @{user_cache_dirs}/ksycoca5_* rwkl -> @{user_cache_dirs}/#@{int},
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* r,
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int},
|
||||
owner @{user_cache_dirs}/kwin/qmlcache/*.qmlc rw,
|
||||
owner @{user_cache_dirs}/kwin/qmlcache/*.qmlc.@{rand6} rwl -> @{user_cache_dirs}/kwin/qmlcache/#@{int},
|
||||
owner @{user_cache_dirs}/kwin/qmlcache/#@{int} rw,
|
||||
|
@ -84,6 +85,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
|
|||
owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk,
|
||||
owner @{user_config_dirs}/kglobalshortcutsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/kscreenlockerrc r,
|
||||
owner @{user_config_dirs}/kwinoutputconfig.json rw,
|
||||
owner @{user_config_dirs}/kwinrc.lock rwk,
|
||||
owner @{user_config_dirs}/kwinrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/kwinrulesrc r,
|
||||
|
|
|
@ -14,7 +14,7 @@ profile pam_kwallet_init @{exec_path} {
|
|||
|
||||
@{sh_path} rix,
|
||||
@{bin}/env rix,
|
||||
@{bin}/socat rix,
|
||||
@{bin}/socat{,1} rix,
|
||||
|
||||
/dev/tty rw,
|
||||
|
||||
|
|
|
@ -31,7 +31,7 @@ profile plasma-browser-integration-host @{exec_path} {
|
|||
/var/lib/flatpak/exports/share/mime/ r,
|
||||
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/ksycoca5_* r,
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* r,
|
||||
|
||||
owner @{user_config_dirs}/menus/ r,
|
||||
|
||||
|
|
|
@ -24,7 +24,7 @@ profile plasma-discover @{exec_path} {
|
|||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
signal (send) set=(term) peer=kioslave5,
|
||||
signal (send) set=(term) peer=kioworker,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
@ -34,8 +34,12 @@ profile plasma-discover @{exec_path} {
|
|||
@{bin}/gpg rCx -> gpg,
|
||||
@{bin}/gpgconf rCx -> gpg,
|
||||
@{bin}/gpgsm rCx -> gpg,
|
||||
@{lib}/kf5/kioslave5 rPx,
|
||||
@{lib}/kf5/kio_http_cache_cleaner rPx,
|
||||
|
||||
@{lib}/@{multiarch}/{,libexec/}kf5/kioslave5 rPx,
|
||||
@{lib}/@{multiarch}/{,libexec/}kf6/kioworker rPx,
|
||||
@{lib}/kf{5,6}/kio_http_cache_cleaner rPx,
|
||||
@{lib}/kf5/kioslave5 rPx,
|
||||
@{lib}/kf6/kioworker rPx,
|
||||
|
||||
/usr/share/knotifications5/plasma_workspace.notifyrc r,
|
||||
/usr/share/knsrcfiles/{,*} r,
|
||||
|
|
|
@ -17,7 +17,7 @@ profile plasma_session @{exec_path} {
|
|||
@{bin}/gmenudbusmenuproxy rPx,
|
||||
@{bin}/kaccess rPx,
|
||||
@{bin}/kcminit rPx,
|
||||
@{bin}/kded5 rPx,
|
||||
@{bin}/kded{5,6} rPx,
|
||||
@{bin}/ksmserver rPx,
|
||||
@{bin}/ksplashqml rPx,
|
||||
@{bin}/kwin_wayland_wrapper rPx,
|
||||
|
@ -38,7 +38,7 @@ profile plasma_session @{exec_path} {
|
|||
/etc/xdg/autostart/*.desktop r,
|
||||
/etc/xdg/menus/ r,
|
||||
|
||||
@{user_cache_dirs}/ksycoca5_* r,
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* r,
|
||||
|
||||
owner @{user_config_dirs}/baloofilerc r,
|
||||
owner @{user_config_dirs}/kdedefaults/ksplashrc r,
|
||||
|
|
|
@ -36,7 +36,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
|
|||
|
||||
ptrace (read) peer=akonadi*,
|
||||
ptrace (read) peer=kalendarac,
|
||||
ptrace (read) peer=kded5,
|
||||
ptrace (read) peer=kded,
|
||||
ptrace (read) peer=ksmserver-logout-greeter,
|
||||
ptrace (read) peer=kwin_x11,
|
||||
ptrace (read) peer=libreoffice*,
|
||||
|
@ -47,21 +47,24 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib}/libheif/ r,
|
||||
@{lib}/libheif/*.so* rm,
|
||||
@{lib}/kf5/kioslave5 rPx,
|
||||
@{lib}/kf5/kdesu{,d} rix,
|
||||
@{bin}/dolphin rPUx, # TODO: rPx,
|
||||
@{bin}/dolphin rPUx,
|
||||
@{bin}/ksysguardd rix,
|
||||
@{bin}/plasma-discover rPUx,
|
||||
@{bin}/xrdb rPx,
|
||||
@{lib}/@{multiarch}/libexec/kf5/kioslave5 rPx,
|
||||
@{lib}/kf{5,6}/kdesu{,d} rix,
|
||||
|
||||
@{lib}/@{multiarch}/{,libexec/}kf5/kioslave5 rPx,
|
||||
@{lib}/@{multiarch}/{,libexec/}kf6/kioworker rPx,
|
||||
@{lib}/kf5/kioslave5 rPx,
|
||||
@{lib}/kf6/kioworker rPx,
|
||||
|
||||
/usr/share/akonadi/firstrun/{,*} r,
|
||||
/usr/share/akonadi/plugins/serializer/{,*.desktop} r,
|
||||
/usr/share/desktop-directories/kf5-*.directory r,
|
||||
/usr/share/kf6/{,**} r,
|
||||
/usr/share/kio/servicemenus/{,*.desktop} r,
|
||||
/usr/share/knotifications5/*.notifyrc r,
|
||||
/usr/share/knotifications{5,6}/*.notifyrc r,
|
||||
|
||||
/usr/share/konsole/ r,
|
||||
/usr/share/krunner/{,**} r,
|
||||
/usr/share/kservices5/{,**} r,
|
||||
|
@ -100,7 +103,8 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
|
|||
owner @{user_cache_dirs}/bookmarksrunner/** rwkl -> @{user_cache_dirs}/bookmarksrunner/#@{int},
|
||||
owner @{user_cache_dirs}/event-sound-cache.tdb.@{md5}.x86_64-pc-linux-gnu rwk,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/ksycoca5_* rwlk -> @{user_cache_dirs}/#@{int},
|
||||
owner @{user_cache_dirs}/ksvg-elements* rwlk -> @{user_cache_dirs}/#@{int},
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* rwlk -> @{user_cache_dirs}/#@{int},
|
||||
owner @{user_cache_dirs}/org.kde.dirmodel-qml.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma-svgelements.lock rwk,
|
||||
|
@ -118,8 +122,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
|
|||
owner @{user_config_dirs}/baloofilerc r,
|
||||
owner @{user_config_dirs}/dolphinrc r,
|
||||
owner @{user_config_dirs}/eventviewsrc r,
|
||||
owner @{user_config_dirs}/kactivitymanagerd-*.lock rwk,
|
||||
owner @{user_config_dirs}/kactivitymanagerd-*{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/kactivitymanagerd* rwkl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/kcookiejarrc r,
|
||||
owner @{user_config_dirs}/kdedefaults/plasmarc r,
|
||||
owner @{user_config_dirs}/kdiff3fileitemactionrc r,
|
||||
|
@ -154,7 +157,8 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
|
|||
owner @{user_share_dirs}/ktp/cache.db rwk,
|
||||
owner @{user_share_dirs}/plasma_icons/*.desktop r,
|
||||
owner @{user_share_dirs}/plasma/plasmoids/{,**} r,
|
||||
owner @{user_share_dirs}/user-places.xbel{,*} rwl -> @{user_share_dirs}/#@{int},
|
||||
owner @{user_share_dirs}/plasmashell/** rwkl -> @{user_share_dirs}/plasmashell/**,
|
||||
owner @{user_share_dirs}/user-places.xbel{,*} rwl,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
/tmp/.mount_nextcl@{rand6}/{,*} r,
|
||||
|
|
|
@ -83,7 +83,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
|
||||
@{bin}/dbus-run-session rPx,
|
||||
@{bin}/kwin_wayland rPx,
|
||||
@{bin}/sddm-greeter rPx,
|
||||
@{bin}/sddm-greeter{,-qt6} rPx,
|
||||
@{bin}/Xorg rPx,
|
||||
/etc/sddm/Xsession rPx,
|
||||
|
||||
|
@ -94,7 +94,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
|
||||
@{bin}/dbus-update-activation-environment rCx -> dbus,
|
||||
@{bin}/gnome-keyring-daemon rPx,
|
||||
@{bin}/kwalletd5 rPx,
|
||||
@{bin}/kwalletd{5,6} rPx,
|
||||
@{bin}/startplasma-wayland rPx,
|
||||
@{bin}/startplasma-x11 rPx,
|
||||
@{bin}/systemctl rPx -> child-systemctl,
|
||||
|
|
|
@ -7,7 +7,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/sddm-greeter
|
||||
@{exec_path} = @{bin}/sddm-greeter{,-qt6}
|
||||
profile sddm-greeter @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-session>
|
||||
|
|
|
@ -24,7 +24,7 @@ profile startplasma @{exec_path} {
|
|||
|
||||
/usr/share/color-schemes/{,**} r,
|
||||
/usr/share/desktop-directories/{,**} r,
|
||||
/usr/share/knotifications5/{,**} r,
|
||||
/usr/share/knotifications{5,6}/{,**} r,
|
||||
/usr/share/kservices5/{,**} r,
|
||||
/usr/share/kservicetypes5/{,**} r,
|
||||
/usr/share/plasma/{,**} r,
|
||||
|
@ -33,7 +33,7 @@ profile startplasma @{exec_path} {
|
|||
/etc/xdg/kcminputrc r,
|
||||
/etc/xdg/menus/{,**} r,
|
||||
|
||||
@{user_cache_dirs}/ksycoca5_* rwkl -> @{user_cache_dirs}/#@{int},
|
||||
@{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int},
|
||||
owner @{user_cache_dirs}/#@{int} rwk,
|
||||
owner @{user_cache_dirs}/kcrash-metadata/ rw,
|
||||
owner @{user_cache_dirs}/plasma-svgelements rw,
|
||||
|
|
|
@ -36,9 +36,9 @@ profile systemsettings @{exec_path} {
|
|||
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/kinfocenter/{,**} rwl,
|
||||
owner @{user_cache_dirs}/ksycoca5_* r,
|
||||
owner @{user_cache_dirs}/ksycoca{5,6}_* r,
|
||||
owner @{user_cache_dirs}/systemsettings/ rw,
|
||||
owner @{user_cache_dirs}/systemsettings/** rwl -> @{user_cache_dirs}/systemsettings/**,
|
||||
owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**,
|
||||
|
||||
owner @{user_config_dirs}/#@{int} rw,
|
||||
owner @{user_config_dirs}/kde.org/{,**} rwlk,
|
||||
|
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile xsettingsd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
signal (receive) set=hup peer=kded5,
|
||||
signal (receive) set=hup peer=kded,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue