mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 08:58:15 +01:00
Profiles update.
This commit is contained in:
Alexandre Pujol
parent
bb0847f5df
commit
4ff371e739
22 changed files with 67 additions and 33 deletions
|
|
@ -21,7 +21,7 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}lib/ibus/ibus-extension-gtk3
|
||||
profile ibus-extension-gtk3 @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/gtk>
|
||||
|
|
@ -24,6 +25,7 @@ profile ibus-extension-gtk3 @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/dconf/profile/gdm r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/ibus/{,**} r,
|
||||
/usr/share/icons/{,**} r,
|
||||
|
|
@ -34,13 +36,12 @@ profile ibus-extension-gtk3 @{exec_path} {
|
|||
owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
|
||||
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-[0-9] r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
/usr/share/dconf/profile/gdm r,
|
||||
/var/lib/gdm/.config/dconf/user r,
|
||||
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
||||
|
||||
include if exists <local/ibus-extension-gtk3>
|
||||
}
|
||||
|
|
@ -15,6 +15,7 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,6 +12,7 @@ profile evolution-alarm-notify @{exec_path} {
|
|||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/openssl>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -57,6 +57,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/user/@{uid}/wayland-cursor-shared-* rw,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/drm/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
|
||||
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/tty rw,
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ profile gnome-calendar @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}lib/gnome-contacts-search-provider
|
||||
profile gnome-contacts-search-provider @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/openssl>
|
||||
|
||||
signal (send) set=(term) peer=unconfined,
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
profile goa-daemon @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
|
|
|
|||
|
|
@ -15,6 +15,7 @@ profile gsd-xsettings @{exec_path} {
|
|||
include <abstractions/fonts>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
|
|
|||
|
|
@ -28,6 +28,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
# Full access to user's data
|
||||
/ r,
|
||||
/home/ r,
|
||||
owner @{HOME}/{,**} rw,
|
||||
owner @{MOUNTS}/{,**} rw,
|
||||
owner @{run}/user/@{uid}/{,**} rw,
|
||||
|
|
@ -46,7 +47,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/net/wireless r,
|
||||
@{PROC}/@{pids}/net/wireless r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
@{run}/systemd/userdb/ r,
|
||||
|
|
|
|||
|
|
@ -23,6 +23,8 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
|
|||
|
||||
signal (send) set=(term, kill) peer=mount,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/lsof rix,
|
||||
|
|
@ -51,10 +53,12 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
|
|||
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/fdinfo/[0-9]* r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/net/* r,
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pid}/stat r,
|
||||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/locks r,
|
||||
|
||||
|
|
|
|||
|
|
@ -13,15 +13,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet raw,
|
||||
network inet6 raw,
|
||||
network netlink raw,
|
||||
network packet dgram,
|
||||
|
||||
capability audit_write,
|
||||
capability dac_override,
|
||||
capability kill,
|
||||
|
|
@ -33,6 +24,15 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
|
|||
capability sys_chroot,
|
||||
capability sys_module,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet raw,
|
||||
network inet6 raw,
|
||||
network netlink raw,
|
||||
network packet dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,19 @@ include <tunables/global>
|
|||
profile nm-dhcp-helper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
||||
ptrace (readby) peer=NetworkManager,
|
||||
|
||||
signal (receive) peer=NetworkManager,
|
||||
signal (send) peer=dhclient,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/var/lib/NetworkManager/*lease r,
|
||||
|
||||
@{run}/NetworkManager/private-dhcp rw,
|
||||
|
||||
include if exists <local/nm-dhcp-helper>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -42,14 +42,14 @@ profile tailscaled @{exec_path} {
|
|||
@{PROC}/ r,
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/@{pid}/net/{,**} r,
|
||||
@{PROC}/sys/net/{,**} r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/fd/ r,
|
||||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/1/stat r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/stat r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/net/{,**} r,
|
||||
|
||||
/dev/net/tun rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -57,6 +57,7 @@ profile pacman @{exec_path} {
|
|||
/{usr/,}bin/gettext rix,
|
||||
/{usr/,}bin/ghc-pkg-* rix,
|
||||
/{usr/,}bin/grep rix,
|
||||
/{usr/,}bin/iscsi-iname rix,
|
||||
/{usr/,}bin/killall rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/setcap rix,
|
||||
|
|
|
|||
|
|
@ -17,14 +17,15 @@ profile systemd-binfmt @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
# Config file locations
|
||||
/etc/binfmt.d/*.conf r,
|
||||
@{run}/binfmt.d/*.conf r,
|
||||
/usr/lib/binfmt.d/*.conf r,
|
||||
/etc/binfmt.d/{,*.conf} r,
|
||||
@{run}/binfmt.d/{,*.conf} r,
|
||||
/usr/lib/binfmt.d/{,*.conf} r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/fs/binfmt_misc/status w,
|
||||
@{PROC}/sys/fs/binfmt_misc/register w,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
include if exists <local/systemd-binfmt>
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/aa-log
|
||||
profile aa-log @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -31,20 +31,22 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
|
|||
/{usr/,}bin/gpgconf rCx -> gpg,
|
||||
/{usr/,}bin/gpgsm rCx -> gpg,
|
||||
|
||||
/usr/share/fwupd/{,**} r,
|
||||
/usr/share/mime/mime.cache r,
|
||||
|
||||
/etc/pki/fwupd/{,**} r,
|
||||
/etc/pki/fwupd-metadata/{,**} r,
|
||||
/etc/fwupd/{,**} r,
|
||||
/usr/share/fwupd/{,**} r,
|
||||
/etc/fwupd/remotes.d/* rw,
|
||||
|
||||
/var/cache/fwupd/{,**} rw,
|
||||
/var/lib/fwupd/{,**} rw,
|
||||
/var/lib/fwupd/pending.db rwk,
|
||||
|
||||
/boot/{,**} r,
|
||||
/boot/EFI/arch/fwupdx[0-9]*.efi rw,
|
||||
/boot/EFI/arch/fw/fwupd-*.cap{,.*} rw,
|
||||
|
||||
/usr/share/mime/mime.cache r,
|
||||
/boot/EFI/*/.goutputstream-* rw,
|
||||
/boot/EFI/*/fw/fwupd-*.cap{,.*} rw,
|
||||
/boot/EFI/*/fwupdx[0-9]*.efi rw,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
|
|
|||
|
|
@ -13,6 +13,7 @@ profile glxinfo @{exec_path} {
|
|||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
|
||||
capability sys_admin,
|
||||
# Needed?
|
||||
|
|
|
|||
|
|
@ -90,6 +90,7 @@ profile htop @{exec_path} {
|
|||
@{sys}/devices/**/hwmon/**/{name,temp*} r,
|
||||
@{sys}/devices/**/power_supply/**/{uevent,type,online} r,
|
||||
@{sys}/devices/*/name r,
|
||||
@{sys}/devices/i2c-[0-9]*/name r,
|
||||
@{sys}/devices/pci[0-9]*/**/i2c-[0-9]*/name r,
|
||||
@{sys}/devices/system/cpu/cpu[0-9]*/online r,
|
||||
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/xdg-dbus-proxy
|
||||
profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected, complain) {
|
||||
profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
@ -15,8 +15,10 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected, complain) {
|
|||
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
|
||||
owner @{run}/firejail/dbus/[0-9]*/[0-9]*-user rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw,
|
||||
owner @{run}/user/@{uid}/.dbus-proxy/{session,a11y}-bus-proxy-[0-9A-Z]* rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-[0-9A-Z]* rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/bus-proxy-[0-9A-Z]* rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw,
|
||||
|
||||
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
|
||||
|
||||
|
|
|
|||
|
|
@ -13,14 +13,13 @@ include <tunables/global>
|
|||
@{exec_path} += /{usr/,}lib/xorg/Xorg
|
||||
profile xorg @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/opencl-nvidia>
|
||||
include <abstractions/vulkan>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/vulkan>
|
||||
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
|
@ -66,7 +65,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_share_dirs}/xorg/Xorg.[0-9].log{,.old} rw,
|
||||
owner @{user_share_dirs}/xorg/Xorg.pid-@{pid}.log{,.old} rw,
|
||||
|
||||
owner /var/lib/gdm/.local/share/xorg/Xorg.pid-@{pid}.log{,.old} rw,
|
||||
/var/lib/gdm/.local/share/xorg/Xorg.pid-@{pid}.log{,.old} rw,
|
||||
owner /var/log/lightdm/x-*.log* rw,
|
||||
owner /var/log/Xorg.[0-9].log{,.old} rw,
|
||||
owner /var/log/Xorg.pid-@{pid}.log{,.old} rw,
|
||||
|
|
|
|||
Loading…
Reference in a new issue