mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

tty and pts are part of abstractions/consoles

Browse Source
This commit is contained in:
Jeroen Rijken 2022-08-01 18:30:03 +02:00
parent ce4eaa56e8
commit 51a33f3f5e
59 changed files with 58 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
View File

@ -81,6 +81,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
#include <abstractions/audio>
#include <abstractions/bash>
#include <abstractions/consoles>
#include <abstractions/cups-client>
#include <abstractions/dbus>
#include <abstractions/dbus-session>
@ -151,8 +152,6 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
/usr/bin/kgpg rix,
/usr/bin/kleopatra rix,
/dev/tty rw,
/usr/lib{,32,64}/@{multiarch}/gstreamer???/gstreamer-???/gst-plugin-scanner rmPUx,
owner @{user_cache_dirs}/gstreamer-???/** rw,
unix peer=(addr=@/tmp/.ICE-unix/* label=unconfined), #Gstreamer doesn't work without this

3
apparmor.d/groups/apt/apt-mark
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-mark
profile apt-mark @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/apt-common>
@{exec_path} mr,
@ -25,7 +26,5 @@ profile apt-mark @{exec_path} {
/var/cache/apt/ r,
/var/cache/apt/** rwk,
/dev/pts/[0-9]* rw,
include if exists <local/apt-mark>
}

4
apparmor.d/groups/bus/dbus-run-session
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/dbus-run-session
profile dbus-run-session @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dconf-write>
signal (receive) set=(term, kill, hup) peer=gdm*,
@ -31,9 +32,6 @@ profile dbus-run-session @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
# file_inherit
/dev/tty rw,
/dev/tty[0-9]* rw,
include if exists <local/dbus-run-session>
}

1
apparmor.d/groups/freedesktop/fc-cache
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{snap/snapd/[0-9]*/,}{usr/,}bin/fc-cache{,-32,-v*}
profile fc-cache @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-write>

1
apparmor.d/groups/freedesktop/plymouth
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/plymouth
profile plymouth @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
unix (send, receive, connect) type=stream peer=(addr="@/org/freedesktop/plymouthd"),

2
apparmor.d/groups/freedesktop/xdg-mime
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/xdg-mime
profile xdg-mime @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/freedesktop.org>
@{exec_path} r,
@ -47,7 +48,6 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
/dev/dri/card[0-9]* rw,
/dev/tty rw,
# When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two
# following root processes:

2
apparmor.d/groups/freedesktop/xdg-open
View File

@ -10,6 +10,7 @@ include <tunables/global>
profile xdg-open @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/consoles>
include <abstractions/app-launcher-user>
@{exec_path} r,
@ -50,7 +51,6 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) {
# file_inherit
/dev/dri/card[0-9]* rw,
/dev/tty rw,
profile dbus {
include <abstractions/base>

2
apparmor.d/groups/freedesktop/xkbcomp
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/xkbcomp
profile xkbcomp @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
unix (send,receive) type=stream addr=none peer=(label=gnome-shell),
@ -32,7 +33,6 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
owner /tmp/server-[0-9]*.xkm rwk,
/dev/dri/card[0-9]* rw,
/dev/tty rw,
/dev/tty[0-9]* rw,
deny /dev/input/event[0-9]* rw,

2
apparmor.d/groups/freedesktop/xorg
View File

@ -13,6 +13,7 @@ include <tunables/global>
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}
profile xorg @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
@ -131,7 +132,6 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
/dev/input/event[0-9]* rw,
/dev/shm/#[0-9]*[0-9] rw,
/dev/shm/shmfd-* rw,
/dev/tty rw,
/dev/tty[0-9]* rw,
/dev/vga_arbiter rw, # Graphic card modules

2
apparmor.d/groups/freedesktop/xwayland
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/Xwayland
profile xwayland @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
@ -41,7 +42,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pids}/comm r,
/dev/tty[0-9]* rw,
/dev/tty rw,
include if exists <local/xwayland>
}

2
apparmor.d/groups/gnome/gdm-session-worker
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{libexec}/gdm-session-worker
profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/authentication>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -87,7 +88,6 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
@{PROC}/1/limits r,
@{PROC}/keys r,
/dev/tty rw,
/dev/tty[0-9]* rw,
include if exists <local/gdm-session-worker>

1
apparmor.d/groups/gnome/gdm-xsession
View File

@ -43,7 +43,6 @@ profile gdm-xsession @{exec_path} {
/{usr/,}bin/dbus-update-activation-environment mr,
# file_inherit
/dev/tty rw,
/dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
}

2
apparmor.d/groups/gnome/gjs-console
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/gjs-console
profile gjs-console @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/dri-common>
@ -58,7 +59,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/stat r,
/dev/ r,
/dev/tty rw,
/dev/tty[0-9]* rw,
include if exists <local/gjs-console>

2
apparmor.d/groups/gnome/gnome-extensions-app
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/gnome-extensions-app
profile gnome-extensions-app @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
@ -17,7 +18,6 @@ profile gnome-extensions-app @{exec_path} {
/usr/share/terminfo/x/xterm-256color r,
/dev/tty rw,
include if exists <local/gnome-extensions-app>
}

2
apparmor.d/groups/gnome/gnome-session-binary
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{libexec}/gnome-session-binary
profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -141,7 +142,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pid}/cgroup r,
@{PROC}/cmdline r,
/dev/tty rw,
/dev/tty[0-9]* rw,
include if exists <usr/gnome-session-binary.d>

2
apparmor.d/groups/gnome/gsd-xsettings
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{libexec}/gsd-xsettings
profile gsd-xsettings @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -70,7 +71,6 @@ profile gsd-xsettings @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
/dev/tty rw,
/dev/tty[0-9]* rw,
profile run-parts {

2
apparmor.d/groups/gnome/nautilus
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/nautilus
profile nautilus @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/app-launcher-user>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -61,7 +62,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/mountinfo r,
@{PROC}/@{pids}/net/wireless r,
/dev/tty rw,
/dev/dri/card[0-9]* rw,
include if exists <local/nautilus>

2
apparmor.d/groups/network/mullvad-gui
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = "/opt/Mullvad VPN/mullvad-gui"
profile mullvad-gui @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/chromium-common>
include <abstractions/dconf-write>
include <abstractions/dri-common>
@ -69,7 +70,6 @@ profile mullvad-gui @{exec_path} {
owner @{PROC}/@{pid}/task/@{tid}/status r,
owner @{PROC}/@{pid}/uid_map w,
/dev/tty rw,
include if exists <local/mullvad-gui>
}

2
apparmor.d/groups/network/nm-openvpn-service
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-openvpn-service
profile nm-openvpn-service @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability kill,
@ -27,7 +28,6 @@ profile nm-openvpn-service @{exec_path} {
@{run}/NetworkManager/nm-openvpn-@{uuid} rw,
/dev/net/tun rw,
/dev/tty rw,
owner @{PROC}/@{pid}/fd/ r,

2
apparmor.d/groups/network/wg-quick
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/wg-quick
profile wg-quick @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability net_admin,
@ -39,7 +40,6 @@ profile wg-quick @{exec_path} {
@{PROC}/sys/net/ipv4/conf/all/src_valid_mark w,
/dev/tty rw,
# Force the use as root
deny /{usr/,}bin/sudo x,

2
apparmor.d/groups/pacman/archlinux-java
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/archlinux-java
profile archlinux-java @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -25,7 +26,6 @@ profile archlinux-java @{exec_path} {
/{usr/,}lib/jvm/default w,
/{usr/,}lib/jvm/default-runtime w,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/paccache
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/paccache
profile paccache @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability dac_read_search,
@ -35,7 +36,6 @@ profile paccache @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
/dev/tty rw,
include if exists <local/paccache>
}

2
apparmor.d/groups/pacman/pacdiff
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pacdiff
profile pacdiff @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability mknod,
@ -36,7 +37,6 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) {
/usr/{,**} r,
/var/{,**} r,
/dev/tty rw,
# Inherit Silencer
deny /apparmor/.null rw,

2
apparmor.d/groups/pacman/pacman-hook-dconf
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dconf-update
profile pacman-hook-dconf @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -20,7 +21,6 @@ profile pacman-hook-dconf @{exec_path} {
/etc/dconf/db/{,**} rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-depmod
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/depmod
profile pacman-hook-depmod @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -23,7 +24,6 @@ profile pacman-hook-depmod @{exec_path} {
/usr/lib/modules/*/{,**} rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-dkms
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dkms
profile pacman-hook-dkms @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability mknod,
@ -27,7 +28,6 @@ profile pacman-hook-dkms @{exec_path} {
/etc/dkms/{,*} r,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-fontconfig
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/40-fontconfig-config
profile pacman-hook-fontconfig @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -21,7 +22,6 @@ profile pacman-hook-fontconfig @{exec_path} {
/etc/fonts/conf.d/* rwl,
/usr/share/fontconfig/conf.default/* r,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-gio
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gio-querymodules
profile pacman-hook-gio @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -23,7 +24,6 @@ profile pacman-hook-gio @{exec_path} {
/usr/lib/gio/modules/ rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-gtk
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gtk-update-icon-cache
profile pacman-hook-gtk @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -23,7 +24,6 @@ profile pacman-hook-gtk @{exec_path} {
/usr/share/icons/{,**} rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-install
profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability mknod,
@ -32,7 +33,6 @@ profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected)
/ r,
owner /boot/vmlinuz-* rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-remove
profile pacman-hook-mkinitcpio-remove @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability mknod,
@ -28,7 +29,6 @@ profile pacman-hook-mkinitcpio-remove @{exec_path} {
/boot/initramfs-*.img rw,
/boot/initramfs-*-fallback.img rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-perl
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/detect-old-perl-modules.sh
profile pacman-hook-perl @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability mknod,
@ -23,7 +24,6 @@ profile pacman-hook-perl @{exec_path} {
/{usr/,}lib/perl[0-9]*/{,**} r,
/dev/tty rw,
# Inherit silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-hook-systemd
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/systemd-hook
profile pacman-hook-systemd @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -29,7 +30,6 @@ profile pacman-hook-systemd @{exec_path} {
/usr/ rw,
/dev/tty rw,
# Inherit silencer
deny network inet6 stream,

2
apparmor.d/groups/pacman/pacman-key
View File

@ -10,6 +10,7 @@ include <tunables/global>
profile pacman-key @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/consoles>
capability dac_read_search,
capability mknod,
@ -35,7 +36,6 @@ profile pacman-key @{exec_path} {
/etc/pacman.d/gnupg/gpg.conf r,
/dev/tty rw,
profile gpg {
include <abstractions/base>

4
apparmor.d/groups/systemd/systemd-analyze
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/systemd-analyze
profile systemd-analyze @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/systemd-common>
capability sys_resource,
@ -57,8 +58,5 @@ profile systemd-analyze @{exec_path} {
owner @{PROC}/@{pid}/comm r,
@{PROC}/swaps r,
/dev/tty rw,
/dev/pts/1 rw,
include if exists <local/systemd-analyze>
}

2
apparmor.d/groups/systemd/systemd-environment-d-generator
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/user-environment-generators/*
profile systemd-environment-d-generator @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
@ -24,7 +25,6 @@ profile systemd-environment-d-generator @{exec_path} {
owner @{user_config_dirs}/environment.d/{,*.conf} r,
/dev/tty rw,
include if exists <local/systemd-environment-d-generator>
}

2
apparmor.d/groups/systemd/systemd-sleep
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-sleep
profile systemd-sleep @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/systemd-common>
@ -29,7 +30,6 @@ profile systemd-sleep @{exec_path} {
@{PROC}/driver/nvidia/suspend w,
/dev/tty rw,
include if exists <local/systemd-sleep>
}

2
apparmor.d/groups/virt/k3s
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}{local/,}bin/k3s
profile k3s @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/disks-read>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
@ -166,7 +167,6 @@ profile k3s @{exec_path} {
@{sys}/module/apparmor/parameters/enabled r,
/dev/kmsg r,
/dev/pts/[0-9]* rw,
include if exists <local/k3s>
}

2
apparmor.d/profiles-a-f/acpid
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/acpid
profile acpid @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability dac_read_search,
@ -33,7 +34,6 @@ profile acpid @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pids}/loginuid r,
/dev/input/{,**} r,
/dev/tty rw,
include if exists <local/acpid>
}

2
apparmor.d/profiles-a-f/apparmor.systemd
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/apparmor/apparmor.systemd
profile apparmor.systemd @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability mac_admin,
@ -41,7 +42,6 @@ profile apparmor.systemd @{exec_path} flags=(complain) {
@{PROC}/filesystems r,
@{PROC}/mounts r,
/dev/tty rw,
include if exists <local/apparmor.systemd>
}

2
apparmor.d/profiles-a-f/askpass
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/code/extensions/git/dist/askpass.sh
profile askpass @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
network inet dgram,
network inet6 dgram,
@ -25,7 +26,6 @@ profile askpass @{exec_path} {
owner /tmp/tmp.* rw,
/dev/tty rw,
include if exists <local/askpass>
}

2
apparmor.d/profiles-a-f/augenrules
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/augenrules
profile augenrules @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@ -19,7 +20,6 @@ profile augenrules @{exec_path} {
owner /tmp/aurules.* rw,
/dev/tty rw,
include if exists <local/augenrules>
}

2
apparmor.d/profiles-a-f/aurpublish
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/aurpublish/*.hook
profile aurpublish @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
signal (receive) peer=git,
@ -25,7 +26,6 @@ profile aurpublish @{exec_path} {
owner @{user_projects_dirs}/**/.SRCINFO rw,
owner @{user_projects_dirs}/**/PKGBUILD r,
/dev/tty rw,
include if exists <local/aurpublish>
}

2
apparmor.d/profiles-a-f/blueman
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/blueman-*
profile blueman @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/audio>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read>
@ -67,7 +68,6 @@ profile blueman @{exec_path} flags=(attach_disconnected) {
/dev/dri/card[0-9]* rw,
/dev/rfkill r,
/dev/shm/ r,
/dev/tty rw,
profile open {
include <abstractions/base>

2
apparmor.d/profiles-a-f/evince
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/evince /{usr/,}lib/evinced
profile evince @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dconf-write>
include <abstractions/gnome>
include <abstractions/openssl>
@ -40,7 +41,6 @@ profile evince @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
/dev/tty rw,
include if exists <local/evince>
}

2
apparmor.d/profiles-a-f/firecfg
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/firecfg
profile firecfg @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability dac_read_search,
@ -34,7 +35,6 @@ profile firecfg @{exec_path} flags=(attach_disconnected) {
@{user_share_dirs}/applications/ r,
@{user_share_dirs}/applications/*.desktop rw,
/dev/tty rw,
deny /apparmor/.null rw,

2
apparmor.d/profiles-a-f/fwupdmgr
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/fwupdmgr
profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>
@ -42,7 +43,6 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) {
owner @{PROC}/@{pid}/fd/ r,
/dev/tty rw,
profile dbus {
include <abstractions/base>

3
apparmor.d/profiles-g-l/install-info
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/install-info
profile install-info @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -20,8 +21,6 @@ profile install-info @{exec_path} {
/usr/share/info/{,**} r,
/usr/share/info/dir rw,
/dev/tty rw,
# Inherit silencer
deny network inet6 stream,
deny network inet stream,

3
apparmor.d/profiles-m-r/mount-zfs
View File

@ -9,14 +9,13 @@ include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/mount.zfs
profile mount-zfs @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_admin, # To mount anything.
@{exec_path} mr,
/dev/pts/[0-9]* rw,
@{MOUNTDIRS}/ r,
@{MOUNTS}/ r,
@{MOUNTS}/*/ r,

2
apparmor.d/profiles-m-r/needrestart-iucode-scan-versions
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/needrestart/iucode-scan-versions
profile needrestart-iucode-scan-versions @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
@ -29,7 +30,6 @@ profile needrestart-iucode-scan-versions @{exec_path} {
@{sys}/devices/system/cpu/cpu[0-9]*/microcode/processor_flags r,
/dev/tty rw,
include if exists <local/needrestart-iucode-scan-versions>
}

2
apparmor.d/profiles-m-r/pass
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pass
profile pass @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@ -65,7 +66,6 @@ profile pass @{exec_path} {
@{PROC}/sys/kernel/osrelease r,
@{PROC}/uptime r,
/dev/tty rw,
profile editor {
include <abstractions/base>

2
apparmor.d/profiles-m-r/pkttyagent
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pkttyagent
profile pkttyagent @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
@ -39,7 +40,6 @@ profile pkttyagent @{exec_path} {
owner @{PROC}/@{pids}/stat r,
/dev/tty rw,
include if exists <local/pkttyagent>
}

2
apparmor.d/profiles-m-r/resolvconf
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}sbin/resolvconf
profile resolvconf @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@ -33,7 +34,6 @@ profile resolvconf @{exec_path} {
owner @{run}/resolvconf/{,**} rw,
owner @{run}/resolvconf/run-lock wk,
/dev/tty rw,
include if exists <local/resolvconf>
}

2
apparmor.d/profiles-s-z/start-pulseaudio-x11
View File

@ -9,13 +9,13 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/start-pulseaudio-x11
profile start-pulseaudio-x11 @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/pactl rPx,
/dev/tty rw,
include if exists <local/start-pulseaudio-x11>
}

2
apparmor.d/profiles-s-z/udisksctl
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/udisksctl
profile udisksctl @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
@ -19,7 +20,6 @@ profile udisksctl @{exec_path} {
/{usr/,}bin/less rPx -> child-pager,
/{usr/,}bin/more rPx -> child-pager,
/dev/tty rw,
include if exists <local/udisksctl>
}

2
apparmor.d/profiles-s-z/update-ca-trust
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/update-ca-trust
profile update-ca-trust @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/ssl_certs>
capability dac_read_search,
@ -30,7 +31,6 @@ profile update-ca-trust @{exec_path} {
/etc/ssl/certs/{,*} rw,
/etc/ssl/certs/java/cacerts{,.*} w,
/dev/tty rw,
# Inherit silencer
deny network inet6 stream,

2
apparmor.d/profiles-s-z/wl-copy
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/wl-{copy,paste}
profile wl-copy @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
@ -19,7 +20,6 @@ profile wl-copy @{exec_path} {
owner /tmp/wl-copy-buffer-*/{,**} rw,
/dev/tty rw,
include if exists <local/wl-copy>
}

2
apparmor.d/profiles-s-z/zpool
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}{local/,}{s,}bin/zpool
profile zpool @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/disks-read>
capability sys_admin,
@ -31,7 +32,6 @@ profile zpool @{exec_path} {
@{PROC}/@{pids}/mounts r,
@{PROC}/sys/kernel/spl/hostid r,
/dev/pts/[0-9]* rw,
/dev/zfs rw,
include if exists <local/zpool>

2
apparmor.d/profiles-s-z/zsysd
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/zsysd /{usr/,}{s,}bin/zsysctl
profile zsysd @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
@ -41,7 +42,6 @@ profile zsysd @{exec_path} flags=(complain) {
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/dev/pts/[0-9]* rw,
/dev/zfs rw,
include if exists <local/zsysd>