mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-29 22:35:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat(profile): rewrite the child-open* profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2024-05-11 12:12:21 +01:00
parent 60ba9ae965
commit 4d29127d57
Failed to generate hash of commit
12 changed files with 28 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
apparmor.d/abstractions/app/open Normal file
View file

@ -0,0 +1,15 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Full set of rules for child-open-* profiles.
include <abstractions/desktop>
@{open_path} mrix,
@{sh_path} r,
/dev/tty rw,
include if exists <abstractions/app/open.d>

17
apparmor.d/groups/children/child-open
View file

@ -13,29 +13,16 @@
# Note: This profile does not specify an attachment path because it is
# intended to be used only via "Px -> child-open" exec transitions
# from other profiles.
# from other profiles.
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/exo-open @{bin}/xdg-open
@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop
profile child-open {
include <abstractions/base>
include <abstractions/app-open>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/vulkan>
include <abstractions/xdg-open>
@{exec_path} mrix,
@{sh_path} rix,
@{bin}/{,m,g}awk rix,
@{bin}/basename rix,
@{bin}/env rix,
@{bin}/readlink rix,
include <abstractions/app/open>
include if exists <usr/child-open.d>
include if exists <local/child-open>

5
apparmor.d/groups/children/child-open-browsers
View file

@ -17,11 +17,8 @@ include <tunables/global>
profile child-open-browsers {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/app/open>
@{open_path} mrix,
@{bin}/chromium rPx,
@{browsers_path} rPx,
include if exists <usr/child-open-browsers.d>

6
apparmor.d/groups/children/child-open-help
View file

@ -8,13 +8,9 @@ include <tunables/global>
profile child-open-help {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/app/open>
@{open_path} mrix,
@{bin}/chromium rPx,
@{browsers_path} rPx,
@{bin}/yelp rPUx,
include if exists <usr/child-open-help.d>

14
apparmor.d/groups/children/child-open-strict
View file

@ -13,20 +13,10 @@ include <tunables/global>
profile child-open-strict {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/app/open>
@{open_path} mrix,
@{sh_path} r,
# Browsers
@{bin}/chromium rPx,
@{browsers_path} rPx,
# Files explorer
@{bin}/nautilus rPx,
@{bin}/dolphin rPx,
/dev/tty rw,
@{file_explorers_path} rPx,
include if exists <usr/child-open-strict.d>
include if exists <local/child-open-strict>

2
apparmor.d/groups/freedesktop/polkitd
View file

@ -36,7 +36,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
# System rules
/etc/polkit-1/rules.d/ r,
/etc/polkit-1/rules.d/[0-9][0-9]-*.rules r,
/etc/polkit-1/rules.d/@{int2}-*.rules r,
/etc/polkit-1/localauthority/{,**} r,
/etc/polkit-1/localauthority.conf.d/{,**} r,
/etc/polkit-1/actions/{,*.policy} r,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -198,7 +198,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/usr/share/gdm/greeter/applications/{,**} r,
/usr/share/libgweather/Locations.xml r,
/usr/share/libinput*/ r,
/usr/share/libinput*/{,**/}[0-9][0-9]-*.quirks r,
/usr/share/libinput*/{,**/}@{int2}-*.quirks r,
/usr/share/libinput*/libinput/ r,
/usr/share/libwacom/{,*.stylus,*.tablet} r,
/usr/share/wallpapers/** r,

2
apparmor.d/groups/systemd/systemd-udevd
View file

@ -104,7 +104,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
/etc/modprobe.d/*.conf r,
/etc/systemd/network/ r,
/etc/systemd/network/[0-9][0-9]-*.link r,
/etc/systemd/network/@{int2}-*.link r,
@{run}/udev/ rw,
@{run}/udev/** rwk,

2
apparmor.d/profiles-g-l/kernel-install
View file

@ -28,7 +28,7 @@ profile kernel-install @{exec_path} {
@{bin}/kmod rCx -> kmod,
@{lib}/kernel/install.d/ r,
@{lib}/kernel/install.d/[0-9][0-9]-*.install rix,
@{lib}/kernel/install.d/@{int2}-*.install rix,
/etc/kernel/install.d/ r,
/etc/kernel/install.d/*.install rix,

2
apparmor.d/profiles-m-r/monitorix
View file

@ -51,7 +51,7 @@ profile monitorix @{exec_path} {
/etc/monitorix/monitorix.conf r,
/etc/monitorix/conf.d/ r,
/etc/monitorix/conf.d/[0-9][0-9]-*.conf r,
/etc/monitorix/conf.d/@{int2}-*.conf r,
/var/log/monitorix w,
/var/log/monitorix-* w,

2
apparmor.d/profiles-s-z/steam
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9][0-9]_{32,64}
@{lib_dirs} = @{user_share_dirs}/Steam/ubuntu@{int2}_{32,64}
@{exec_path} = @{user_share_dirs}/Steam/steam.sh
profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) {

2
apparmor.d/profiles-s-z/steam-gameoverlayui
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9][0-9]_{32,64}
@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu@{int2}_{32,64}
@{exec_path} = @{steam_lib_dirs}/gameoverlayui
profile steam-gameoverlayui @{exec_path} {