mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-15 07:54:17 +01:00
rustdesk
This commit is contained in:
nobody43
Alex
parent
02ced44a5c
commit
4f3864a9b6
25
apparmor.d/profiles-g-l/hbbr
Normal file
25
apparmor.d/profiles-g-l/hbbr
Normal file
@ -0,0 +1,25 @@
|
||||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}{,local/}bin/hbbr
|
||||
profile hbbr @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
|
||||
owner /var/lib/rustdesk-server/ r,
|
||||
owner /var/lib/rustdesk-server/id_ed25519.pub r,
|
||||
# Unknown non-essential purpose
|
||||
# owner /var/lib/rustdesk-server/id_ed25519 r,
|
||||
|
||||
include if exists <local/hbbr>
|
||||
}
|
||||
30
apparmor.d/profiles-g-l/hbbs
Normal file
30
apparmor.d/profiles-g-l/hbbs
Normal file
@ -0,0 +1,30 @@
|
||||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}{,local/}bin/hbbs
|
||||
profile hbbs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
owner /var/lib/rustdesk-server/ rw,
|
||||
owner /var/lib/rustdesk-server/id_ed25519 rw,
|
||||
owner /var/lib/rustdesk-server/id_ed25519.pub rw,
|
||||
owner /var/lib/rustdesk-server/db_v2.sqlite3 rwk,
|
||||
owner /var/lib/rustdesk-server/db_v2.sqlite3-journal rw,
|
||||
owner /var/lib/rustdesk-server/db_v2.sqlite3-wal rw,
|
||||
owner /var/lib/rustdesk-server/db_v2.sqlite3-shm rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
|
||||
include if exists <local/hbbs>
|
||||
}
|
||||
143
apparmor.d/profiles-m-r/rustdesk
Normal file
143
apparmor.d/profiles-m-r/rustdesk
Normal file
@ -0,0 +1,143 @@
|
||||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}{,local/}bin/rustdesk
|
||||
profile rustdesk @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/X-strict>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-accessibility-strict>
|
||||
include <abstractions/dbus-gtk>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw, # discovery
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{,usr/}bin/ps rPx,
|
||||
/{,usr/}bin/whoami rPx,
|
||||
/{,usr/}bin/loginctl rPx,
|
||||
/{,usr/}bin/curl rix,
|
||||
|
||||
/{,usr/}bin/python3.[0-9]* rCx -> python,
|
||||
|
||||
dbus (send) bus=accessibility path=/org/a11y/atspi/accessible/root
|
||||
interface=org.a11y.atspi.Socket
|
||||
member=Embed
|
||||
peer=(name=org.a11y.atspi.Registry),
|
||||
|
||||
dbus (send) bus=accessibility path=/org/a11y/atspi/registry
|
||||
interface=org.a11y.atspi.Registry
|
||||
member=GetRegisteredEvents
|
||||
peer=(name=org.a11y.atspi.Registry),
|
||||
|
||||
dbus (send) bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
|
||||
interface=org.a11y.atspi.DeviceEventController
|
||||
member={GetKeystrokeListeners,GetDeviceEventListeners}
|
||||
peer=(name=org.a11y.atspi.Registry),
|
||||
|
||||
dbus (receive) bus=accessibility path=/org/a11y/atspi/accessible/root
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Set
|
||||
peer=(name=:*),
|
||||
|
||||
owner /tmp/[rR]ust[dD]esk/{,**} rw,
|
||||
|
||||
owner @{user_share_dirs}/logs/[rR]ust[dD]esk/{,**} rw,
|
||||
owner @{user_config_dirs}/[rR]ust[dD]esk/{,**} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw,
|
||||
|
||||
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_{cur,min,max}_freq r,
|
||||
|
||||
@{PROC}/uptime r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
# pulse
|
||||
/dev/shm/ r,
|
||||
/etc/pulse/client.conf r,
|
||||
/etc/pulse/client.conf.d/{,*} r,
|
||||
owner @{run}/user/@{uid}/pulse/ r,
|
||||
owner @{run}/user/@{uid}/pulse/native rw,
|
||||
owner @{user_config_dirs}/pulse/ rw,
|
||||
owner @{user_config_dirs}/pulse/cookie rwk,
|
||||
|
||||
# gtk-tiny
|
||||
/etc/gtk-3.0/settings.ini r,
|
||||
/usr/share/themes/*/gtk-3.0/gtk.css r,
|
||||
|
||||
# file transfer
|
||||
owner @{HOME}/ r, # fails otherwise
|
||||
owner @{HOME}/[rR]ust[dD]esk/{,**} rw,
|
||||
|
||||
# file_inherit, X-strict
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# excessive?
|
||||
deny @{PROC} r,
|
||||
# @{PROC} r,
|
||||
# capability sys_ptrace,
|
||||
# ptrace (read),
|
||||
# owner @{PROC}/@{pid}/stat r,
|
||||
# owner @{PROC}/@{pid}/environ r,
|
||||
# owner @{PROC}/@{pid}/io r,
|
||||
# owner @{PROC}/@{pid}/task/ r,
|
||||
# owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
# owner @{PROC}/@{pid}/task/@{tid}/io r,
|
||||
# owner @{PROC}/@{pid}/task/@{tid}/status r,
|
||||
|
||||
profile python {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
|
||||
/{,usr/}bin/python3.[0-9]* r,
|
||||
|
||||
/{,usr/}bin/{,ba,da}sh rix,
|
||||
/{,usr/}bin/chmod rix,
|
||||
/{,usr/}bin/uname rPx,
|
||||
/usr/share/rustdesk/files/pynput_service.py rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/usr/share/rustdesk/files/{,**} r,
|
||||
owner /tmp/[rR]ust[dD]esk/ w,
|
||||
owner /tmp/[rR]ust[dD]esk/pynput_service rw,
|
||||
|
||||
# X-tiny
|
||||
/tmp/.X11-unix/* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# python.d?
|
||||
/usr/share/dpkg/cputable r,
|
||||
|
||||
# Silencer
|
||||
deny /etc/apt/{,**} r,
|
||||
|
||||
include if exists <local/rustdesk_python>
|
||||
}
|
||||
|
||||
include if exists <local/rustdesk>
|
||||
}
|
||||
|
||||
profile rustdesk_pynput_service /usr/share/rustdesk/files/pynput_service.py {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
include if exists <local/rustdesk_pynput_service>
|
||||
}
|
||||
20
apparmor.d/profiles-m-r/rustdesk-utils
Normal file
20
apparmor.d/profiles-m-r/rustdesk-utils
Normal file
@ -0,0 +1,20 @@
|
||||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}{,local/}bin/rustdesk-utils
|
||||
profile rustdesk-utils @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/consoles>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/rustdesk-utils>
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user