mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): improve kde support on debian.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-20 16:13:20 +00:00
parent 74b10ec4d3
commit 5039dae148
Failed to generate hash of commit
30 changed files with 111 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/abstractions/kde-strict
View file

@ -14,6 +14,7 @@
/usr/share/hwdata/pnp.ids r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/desktop-base/kf{5,6}-settings/kdeglobals r,
/etc/xdg/kcminputrc r,
/etc/xdg/kdeglobals r,

2
apparmor.d/groups/freedesktop/polkit-kde-authentication-agent
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/@{multiarch}/polkit-kde-authentication-agent-[0-9]
@{exec_path} = @{lib}/@{multiarch}/{,libexec/}polkit-kde-authentication-agent-[0-9]
@{exec_path} += @{lib}/polkit-kde-authentication-agent-[0-9]
profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>

3
apparmor.d/groups/freedesktop/xdg-desktop-portal-kde
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/xdg-desktop-portal-kde
@{exec_path} = @{lib}/xdg-desktop-portal-kde
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}xdg-desktop-portal-kde
profile xdg-desktop-portal-kde @{exec_path} {
include <abstractions/base>
include <abstractions/kde-strict>

5
apparmor.d/groups/kde/DiscoverNotifier
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/DiscoverNotifier
@{exec_path} = @{lib}/DiscoverNotifier
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}DiscoverNotifier
profile DiscoverNotifier @{exec_path} {
include <abstractions/base>
include <abstractions/graphics>
@ -19,6 +20,8 @@ profile DiscoverNotifier @{exec_path} {
@{exec_path} mr,
@{bin}/apt-config rPx,
/usr/share/metainfo/{,**} r,
/etc/flatpak/remotes.d/ r,

3
apparmor.d/groups/kde/baloo
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/baloo_file @{lib}/{,kf6/}baloo_file
@{exec_path} = @{bin}/baloo_file @{lib}/{,kf6/}baloo_file
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}baloo_file
profile baloo @{exec_path} {
include <abstractions/base>
include <abstractions/deny-sensitive-home>

3
apparmor.d/groups/kde/baloorunner
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/baloorunner
@{exec_path} = @{lib}/baloorunner
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}baloorunner
profile baloorunner @{exec_path} {
include <abstractions/base>
include <abstractions/graphics>

3
apparmor.d/groups/kde/drkonqi
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/drkonqi
@{exec_path} = @{lib}/drkonqi
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}drkonqi
profile drkonqi @{exec_path} {
include <abstractions/base>
include <abstractions/kde-strict>

3
apparmor.d/groups/kde/drkonqi-coredump-cleanup
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/drkonqi-coredump-cleanup
@{exec_path} = @{lib}/drkonqi-coredump-cleanup
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}drkonqi-coredump-cleanup
profile drkonqi-coredump-cleanup @{exec_path} {
include <abstractions/base>

3
apparmor.d/groups/kde/drkonqi-coredump-processor
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/drkonqi-coredump-processor
@{exec_path} = @{lib}/drkonqi-coredump-processor
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}drkonqi-coredump-processor
profile drkonqi-coredump-processor @{exec_path} {
include <abstractions/base>
include <abstractions/qt5>

3
apparmor.d/groups/kde/kactivitymanagerd
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/kactivitymanagerd
@{exec_path} = @{lib}/kactivitymanagerd
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kactivitymanagerd
profile kactivitymanagerd @{exec_path} {
include <abstractions/base>
include <abstractions/graphics>

9
apparmor.d/groups/kde/kconf_update
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/kf{5,6}/kconf_update @{lib}/{,@{multiarch}/}libexec/kf{5,6}/kconf_update
@{exec_path} = @{lib}/kf{5,6}/kconf_update
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kconf_update
profile kconf_update @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
@ -27,17 +28,21 @@ profile kconf_update @{exec_path} {
@{bin}/qtpaths rix,
@{bin}/sed rix,
@{bin}/qtchooser rPx,
@{lib}/kconf_update_bin/* rix,
@{lib}/@{multiarch}/kconf_update_bin/* rix,
/usr/share/kconf_update/*.py rix,
/usr/share/kconf_update/*.sh rix,
/usr/share/kconf_update/{,**} r,
/usr/share/kglobalaccel/org.kde.krunner.desktop r,
/etc/machine-id r,
/etc/xdg/konsolerc r,
/etc/xdg/ui/ui_standards.rc r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/#@{int} rw,

3
apparmor.d/groups/kde/kde-powerdevil
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/org_kde_powerdevil
@{exec_path} = @{lib}/org_kde_powerdevil
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}org_kde_powerdevil
profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>

1
apparmor.d/groups/kde/kde-systemd-start-condition
View file

@ -13,6 +13,7 @@ profile kde-systemd-start-condition @{exec_path} {
@{exec_path} mr,
/etc/xdg/baloofilerc r,
/usr/share/desktop-base/kf{5,6}-settings/baloofilerc r,
owner @{user_config_dirs}/baloofilerc r,
owner @{user_config_dirs}/plasma-welcomerc r,

4
apparmor.d/groups/kde/kded
View file

@ -81,13 +81,15 @@ profile kded @{exec_path} {
/usr/share/kservicetypes5/{,**} r,
/etc/fstab r,
/etc/machine-id r,
/etc/xdg/accept-languages.codes r,
/etc/xdg/kcminputrc r,
/etc/xdg/kde* r,
/etc/xdg/kioslaverc r,
/etc/xdg/menus/{,**} r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{HOME}/.gtkrc-2.0 rw,
@{user_cache_dirs}/ksycoca{5,6}_* rwlk -> @{user_cache_dirs}/#@{int},

3
apparmor.d/groups/kde/kio_http_cache_cleaner
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/kf{5,6}/kio_http_cache_cleaner
@{exec_path} = @{lib}/kf{5,6}/kio_http_cache_cleaner
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kio_http_cache_cleaner
profile kio_http_cache_cleaner @{exec_path} {
include <abstractions/base>

3
apparmor.d/groups/kde/kiod
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/kf{5,6}/kiod{5,6}
@{exec_path} = @{lib}/kf{5,6}/kiod{5,6}
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kiod{5,6}
profile kiod @{exec_path} {
include <abstractions/base>
include <abstractions/graphics>

3
apparmor.d/groups/kde/kscreen_backend_launcher
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/kf{5,6}/kscreen_backend_launcher
@{exec_path} = @{lib}/kf{5,6}/kscreen_backend_launcher
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kscreen_backend_launcher
profile kscreen_backend_launcher @{exec_path} {
include <abstractions/base>
include <abstractions/kde-strict>

3
apparmor.d/groups/kde/kscreen_osd_service
View file

@ -6,7 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/kscreen_osd_service
@{exec_path} = @{lib}/kscreen_osd_service
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kscreen_osd_service
profile kscreen_osd_service @{exec_path} {
include <abstractions/base>
include <abstractions/graphics>

4
apparmor.d/groups/kde/kscreenlocker-greet
View file

@ -7,8 +7,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/kscreenlocker_greet
@{exec_path} += @{lib}/@{multiarch}/libexec/kscreenlocker_greet
@{exec_path} = @{lib}/kscreenlocker_greet
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kscreenlocker_greet
profile kscreenlocker-greet @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>

13
apparmor.d/groups/kde/ksmserver
View file

@ -23,12 +23,13 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/rm rix,
@{lib}/@{multiarch}/libexec/DiscoverNotifier rPx,
@{lib}/@{multiarch}/libexec/kscreenlocker_greet rPx,
@{lib}/DiscoverNotifier rPUx, # TODO: rPx,
@{lib}/drkonqi rPx,
@{lib}/kscreenlocker_greet rPx,
@{lib}/thunderbird/thunderbird.sh rPx,
@{lib}/@{multiarch}/{,libexec/}DiscoverNotifier rPx,
@{lib}/@{multiarch}/libexec/DiscoverNotifier rPx,
@{lib}/@{multiarch}/libexec/kscreenlocker_greet rPx,
@{lib}/DiscoverNotifier rPx,
@{lib}/drkonqi rPx,
@{lib}/kscreenlocker_greet rPx,
@{thunderbird_path} rPx,
@{user_bin_dirs}/** rPUx,

25
apparmor.d/groups/kde/ksmserver-logout-greeter
View file

@ -1,26 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Jeroen Rijken
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/@{multiarch}/libexec/ksmserver-logout-greeter
@{exec_path} = @{bin}/ksmserver-logout-greeter
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}ksmserver-logout-greeter
profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dri>
include <abstractions/fontconfig-cache-read>
include <abstractions/kde-icon-cache-write>
include <abstractions/kde-strict>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
@{exec_path} mr,
owner @{HOME}/ r,
@{lib}/os-release r,
/ r,
/etc/machine-id r,
@ -32,12 +33,13 @@ profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected) {
/var/lib/flatpak/exports/share/icons/{,**} r,
/var/lib/flatpak/exports/share/mime/generic-icons r,
@{lib}/os-release r,
owner @{HOME}/ r,
owner @{user_cache_dirs}/ r,
owner @{user_cache_dirs}/#@{int} rwlk,
owner @{user_cache_dirs}/kcrash-metadata/ r,
owner @{user_cache_dirs}/ksmserver-logout-greeter/qmlcache/{,*} r,
owner @{user_cache_dirs}/ksmserver-logout-greeter/ rw,
owner @{user_cache_dirs}/ksmserver-logout-greeter/** rwlk,
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
owner @{user_cache_dirs}/plasma-svgelements rw,
owner @{user_cache_dirs}/plasma-svgelements.@{rand6} rwl -> @{user_cache_dirs}/#@{int},
@ -50,15 +52,12 @@ profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/ksmserverrc r,
owner @{user_config_dirs}/plasmarc r,
owner @{user_share_dirs}/icons/{**,} r,
owner @{user_share_dirs}/mime/generic-icons r,
owner @{PROC}/@{pid}/exe r,
owner @{PROC}/@{pid}/status r,
owner @{run}/user/@{uid}/ r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
@{PROC}/sys/kernel/core_pattern r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
@{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/exe r,
owner @{PROC}/@{pid}/status r,
include if exists <local/ksmserver-logout-greeter>
}

5
apparmor.d/groups/kde/kwin_wayland
View file

@ -31,6 +31,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
@{bin}/plasmashell r,
@{bin}/Xwayland rPx,
@{lib}/kscreenlocker_greet rPx,
@{lib}/@{multiarch}/libexec/kscreenlocker_greet rPx,
@{lib}/kwin_killer_helper rix,
/usr/share/color-schemes/*.colors r,
@ -46,13 +47,15 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
/usr/share/plasma/desktoptheme/** r,
/usr/share/qt/translations/*.qm r,
/etc/machine-id r,
/etc/pipewire/client.conf.d/ r,
/etc/xdg/kscreenlockerrc r,
/etc/xdg/menus/{,applications.menu} r,
/etc/xdg/menus/applications-merged/ r,
/etc/xdg/plasmarc r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{sddm_cache_dirs}/#@{int} rwk,
owner @{sddm_cache_dirs}/fontconfig/* rwk,
owner @{sddm_cache_dirs}/fontconfig/*-le64.cache-@{int}.LCK l -> @{sddm_cache_dirs}/fontconfig/*-le64.cache-@{int}.TMP-@{rand6},

5
apparmor.d/groups/kde/plasma_session
View file

@ -29,7 +29,10 @@ profile plasma_session @{exec_path} {
@{lib}/geoclue-2.0/demos/agent rPx,
@{lib}/org_kde_powerdevil rPx,
@{lib}/pam_kwallet_init rPx,
@{lib}/polkit-kde-authentication-agent-@{int} rPx,
@{lib}/polkit-kde-authentication-agent-[0-9] rPx,
@{lib}/@{multiarch}/{,libexec/}org_kde_powerdevil rPx,
@{lib}/@{multiarch}/{,libexec/}polkit-kde-authentication-agent-[0-9] rPx,
/usr/share/kservices{5,6}/{,**} r,
/usr/share/knotifications{5,6}/{,**} r,

1
apparmor.d/groups/kde/plasmashell
View file

@ -68,6 +68,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
/usr/share/akonadi/firstrun/{,*} r,
/usr/share/akonadi/plugins/serializer/{,*.desktop} r,
/usr/share/desktop-base/{,**} r,
/usr/share/desktop-directories/kf5-*.directory r,
/usr/share/kf6/{,**} r,
/usr/share/kio/servicemenus/{,*.desktop} r,

2
apparmor.d/groups/kde/sddm
View file

@ -65,6 +65,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{lib}/@{multiarch}/sddm/sddm-helper rix,
@{lib}/plasma-dbus-run-session-if-needed rix,
@{lib}/@{multiarch}/libexec/plasma-dbus-run-session-if-needed rix,
@{lib}/sddm/sddm-helper rix,
@{lib}/sddm/sddm-helper-start-wayland rix,
@{lib}/sddm/sddm-helper-start-x11user rix,
@ -99,6 +100,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/xrdb rPx,
@{bin}/xset rPx,
@{bin}/xsetroot rPx,
@{etc_ro}/sddm/wayland-session rPx,
@{etc_ro}/sddm/Xsession rPx,
@{etc_ro}/X11/xdm/Xsession rPx,

2
apparmor.d/groups/kde/sddm-greeter
View file

@ -28,7 +28,7 @@ profile sddm-greeter @{exec_path} {
@{lib}/libheif/ r,
@{lib}/libheif/*.so* rm,
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
/usr/share/desktop-base/*-theme/login/*.svg r,
/usr/share/plasma/desktoptheme/** r,
/usr/share/qt5ct/** r,
/usr/share/sddm/{,**} r,

4
apparmor.d/groups/kde/startplasma
View file

@ -16,6 +16,9 @@ profile startplasma @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/env rix,
@{bin}/kapplymousetheme rPUx,
@{bin}/ksplashqml rPUx,
@{bin}/plasma_session rPx,
@ -32,6 +35,7 @@ profile startplasma @{exec_path} {
/etc/machine-id r,
/etc/xdg/kcminputrc r,
/etc/xdg/menus/{,**} r,
/etc/xdg/plasma-workspace/env/{,**} r,
@{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int},
owner @{user_cache_dirs}/#@{int} rwk,

28
apparmor.d/groups/kde/wayland-session Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{etc_ro}/sddm/wayland-session
profile wayland-session @{exec_path} {
include <abstractions/base>
include <abstractions/bash-strict>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/id rix,
@{lib}/plasma-dbus-run-session-if-needed rix,
@{lib}/@{multiarch}/libexec/plasma-dbus-run-session-if-needed rix,
@{bin}/startplasma-wayland rPx,
/etc/machine-id r,
owner @{user_share_dirs}/sddm/wayland-session.log rw,
include if exists <local/wayland-session>
}

5
apparmor.d/groups/kde/xdm-xsession
View file

@ -16,8 +16,9 @@ profile xdm-xsession @{exec_path} {
@{exec_path} mr,
@{bin}/checkproc rix,
@{sh_path} rix,
@{bin}/checkproc rix,
@{bin}/basename rix,
@{bin}/cat rix,
@{bin}/dirname rix,
@ -42,7 +43,7 @@ profile xdm-xsession @{exec_path} {
@{bin}/xdg-user-dirs-update rPx,
@{bin}/xrdb rPx,
@{lib}/gnome-session-binary rPx,
@{lib}/gnome-session-binary rPx,
@{bin}/gnome rix,
@{bin}/gnome-session rix,
@{bin}/gsettings rPx,

4
apparmor.d/profiles-m-r/qtchooser
View file

@ -13,8 +13,8 @@ profile qtchooser @{exec_path} flags=(complain) {
@{exec_path} mr,
@{lib}/qt5/bin/qdbus rPUx,
@{lib}/qt5/bin/qmake rPUx,
@{lib}/qt{5,6}/bin/qdbus rPx,
@{lib}/qt{5,6}/bin/qmake rPUx,
/usr/share/qtchooser/{,*.conf} r,