mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 00:48:10 +01:00
feat(abs): unify app launcher abstraction.
This commit is contained in:
Alexandre Pujol
parent
9e402987c6
commit
52e52f06db
4 changed files with 98 additions and 114 deletions
|
|
@ -1,16 +1,16 @@
|
||||||
# apparmor.d - Full set of apparmor profiles
|
# apparmor.d - Full set of apparmor profiles
|
||||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
# Copyright (C) 2022-2023 Alexandre Pujol <alexandre@pujol.io>
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
abi <abi/3.0>,
|
abi <abi/3.0>,
|
||||||
|
|
||||||
# Root app location
|
@{bin}/* rPUx,
|
||||||
|
/usr/local/{s,}bin/* rPUx,
|
||||||
|
|
||||||
@{bin}/ r,
|
@{bin}/ r,
|
||||||
@{bin}/[a-z0-9]* rPUx,
|
|
||||||
/ r,
|
/ r,
|
||||||
/usr/ r,
|
/usr/ r,
|
||||||
/usr/local/{s,}bin/ r,
|
/usr/local/{s,}bin/ r,
|
||||||
/usr/local/{s,}bin/[a-z0-9]* rPUx,
|
|
||||||
|
|
||||||
include if exists <abstractions/app-launcher-root.d>
|
include if exists <abstractions/app-launcher-root.d>
|
||||||
|
|
@ -1,50 +1,25 @@
|
||||||
# apparmor.d - Full set of apparmor profiles
|
# apparmor.d - Full set of apparmor profiles
|
||||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
# Copyright (C) 2022-2023 Alexandre Pujol <alexandre@pujol.io>
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
abi <abi/3.0>,
|
abi <abi/3.0>,
|
||||||
|
|
||||||
# User app location
|
@{bin}/* rPUx,
|
||||||
/ r,
|
/opt/*/** rPUx,
|
||||||
/{usr/,}bin/ r,
|
/usr/share/*/* rPUx,
|
||||||
/{usr/,}bin/[a-zA-Z0-9]* rPUx,
|
/usr/local/bin/* rPUx,
|
||||||
/usr/ r,
|
|
||||||
/usr/local/bin/ r,
|
|
||||||
/usr/local/bin/[a-zA-Z0-9]* rPUx,
|
|
||||||
|
|
||||||
# All apps in opt
|
# Browsers
|
||||||
/opt/*/ r,
|
@{brave_path} rPx,
|
||||||
/opt/*/[a-zA-Z0-9]* rPUx,
|
@{chrome_path} rPx,
|
||||||
|
@{chromium_path} rPx,
|
||||||
|
@{firefox_path} rPx,
|
||||||
|
@{opera_path} rPx,
|
||||||
|
|
||||||
# Codium
|
@{bin}/ r,
|
||||||
/usr/share/codium/codium rPUx,
|
/ r,
|
||||||
|
/usr/ r,
|
||||||
# Firefox
|
/usr/local/bin/ r,
|
||||||
@{bin}/firefox{,.sh,-esr,-bin} rPx,
|
|
||||||
@{lib}/firefox{,.sh,-esr,-bin}/firefox{,.sh,-esr,-bin} rPx,
|
|
||||||
/opt/firefox{,.sh,-esr,-bin}/firefox{,.sh,-esr,-bin} rPx,
|
|
||||||
|
|
||||||
# Thunderbird
|
|
||||||
@{bin}/thunderbird{,.sh,-esr,-bin} rPx,
|
|
||||||
@{lib}/thunderbird{,.sh,-esr,-bin}/thunderbird{,.sh,-esr,-bin} rPx,
|
|
||||||
/opt/thunderbird{,.sh,-esr,-bin}/thunderbird{,.sh,-esr,-bin} rPx,
|
|
||||||
|
|
||||||
# Brave
|
|
||||||
/opt/brave{-bin,.com}/brave{,-beta,-dev,-bin}/brave{,-beta,-dev,-bin,-browser} rPx,
|
|
||||||
|
|
||||||
# Chromium
|
|
||||||
@{lib}/chromium/chromium rPx,
|
|
||||||
|
|
||||||
# Chrome
|
|
||||||
/opt/google/chrome{,-beta,-stable,-unstable}/chrome{,-beta,-stable,-unstable} rPx,
|
|
||||||
|
|
||||||
# Opera
|
|
||||||
@{lib}/@{multiarch}/opera{,-beta,-developer}/opera{,-beta,-developer} rPx,
|
|
||||||
|
|
||||||
# Discord
|
|
||||||
/usr/share/ r,
|
|
||||||
/usr/share/discord/ r,
|
|
||||||
/usr/share/discord/Discord rPx,
|
|
||||||
|
|
||||||
include if exists <abstractions/app-launcher-user.d>
|
include if exists <abstractions/app-launcher-user.d>
|
||||||
72
apparmor.d/abstractions/app-open
Normal file
72
apparmor.d/abstractions/app-open
Normal file
|
|
@ -0,0 +1,72 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
# Instead of allowing the run of all software in @{bin}/, @{lib} the purpose of
|
||||||
|
# this abstraction is to list all GUI program that can open resources.
|
||||||
|
|
||||||
|
# Ultimatelly, only sandbox manager program like bwrap, snap, flatpak, firejail
|
||||||
|
# should be present here. Until this day, this profile will be a controlled mess.
|
||||||
|
|
||||||
|
# Sandbox managers
|
||||||
|
@{bin}/bwrap rPUx,
|
||||||
|
@{bin}/firejail rPUx,
|
||||||
|
@{bin}/flatpak rPUx,
|
||||||
|
@{bin}/snap rPUx,
|
||||||
|
|
||||||
|
# Files explorer
|
||||||
|
@{bin}/nautilus rPx,
|
||||||
|
|
||||||
|
# Browsers
|
||||||
|
@{brave_path} rPx,
|
||||||
|
@{chrome_path} rPx,
|
||||||
|
@{chromium_path} rPx,
|
||||||
|
@{firefox_path} rPx,
|
||||||
|
@{opera_path} rPx,
|
||||||
|
|
||||||
|
# Text editors
|
||||||
|
@{bin}/code rPUx,
|
||||||
|
@{bin}/gedit rPUx,
|
||||||
|
@{bin}/gnome-text-editor rPUx,
|
||||||
|
/usr/share/code/{bin/,}code rPUx,
|
||||||
|
|
||||||
|
# Others
|
||||||
|
@{bin}/*{F,f}oliate rPUx,
|
||||||
|
@{bin}/blueman-tray rPx,
|
||||||
|
@{bin}/discord{,-ptb} rPx,
|
||||||
|
@{bin}/draw.io rPUx,
|
||||||
|
@{bin}/dropbox rPx,
|
||||||
|
@{bin}/element-desktop rPx,
|
||||||
|
@{bin}/engrampa rPx,
|
||||||
|
@{bin}/eog rPUx,
|
||||||
|
@{bin}/evince rPx,
|
||||||
|
@{bin}/extension-manager rPx,
|
||||||
|
@{bin}/file-roller rPUx,
|
||||||
|
@{bin}/filezilla rPx,
|
||||||
|
@{bin}/flameshot rPx,
|
||||||
|
@{bin}/flatpak rPUx,
|
||||||
|
@{bin}/geany rPx,
|
||||||
|
@{bin}/gimp* rPUx,
|
||||||
|
@{bin}/gnome-calculator rPUx,
|
||||||
|
@{bin}/gnome-disk-image-mounter rPx,
|
||||||
|
@{bin}/gnome-disks rPx,
|
||||||
|
@{bin}/gwenview rPUx,
|
||||||
|
@{bin}/kgx rPx,
|
||||||
|
@{bin}/okular rPx,
|
||||||
|
@{bin}/qbittorrent rPx,
|
||||||
|
@{bin}/qpdfview rPx,
|
||||||
|
@{bin}/smplayer rPx,
|
||||||
|
@{bin}/spacefm rPx,
|
||||||
|
@{bin}/steam-runtime rPUx,
|
||||||
|
@{bin}/teams rPUx,
|
||||||
|
@{bin}/telegram-desktop rPx,
|
||||||
|
@{bin}/thunderbird rPx,
|
||||||
|
@{bin}/transmission-gtk rPx,
|
||||||
|
@{bin}/viewnior rPUx,
|
||||||
|
@{bin}/vlc rPUx,
|
||||||
|
@{bin}/xarchiver rPx,
|
||||||
|
@{bin}/xbrlapi rPx,
|
||||||
|
@{bin}/yelp rPUx,
|
||||||
|
@{lib}/libreoffice/program/{soffice{,.bin},oosplash} rPUx,
|
||||||
|
|
||||||
|
include if exists <abstractions/app-open.d>
|
||||||
|
|
@ -2,9 +2,8 @@
|
||||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
# Note: This profile does not specify an attachment path because it is
|
# This profile is designed to be used in a child profile to limit what
|
||||||
# intended to be used only via "Px -> child-open" exec transitions
|
# confined application can invoke via xdg-open helper.
|
||||||
# from other profiles.
|
|
||||||
|
|
||||||
# Instead of allowing the run of all software in @{bin}/, the purpose of
|
# Instead of allowing the run of all software in @{bin}/, the purpose of
|
||||||
# this profile is to list all GUI program that can open resources.
|
# this profile is to list all GUI program that can open resources.
|
||||||
|
|
@ -12,6 +11,10 @@
|
||||||
# Ultimatelly, only sandbox manager program like bwrap, snap, flatpak, firejail
|
# Ultimatelly, only sandbox manager program like bwrap, snap, flatpak, firejail
|
||||||
# should be present here. Until this day, this profile will be a controlled mess.
|
# should be present here. Until this day, this profile will be a controlled mess.
|
||||||
|
|
||||||
|
# Note: This profile does not specify an attachment path because it is
|
||||||
|
# intended to be used only via "Px -> child-open" exec transitions
|
||||||
|
# from other profiles.
|
||||||
|
|
||||||
abi <abi/3.0>,
|
abi <abi/3.0>,
|
||||||
|
|
||||||
include <tunables/global>
|
include <tunables/global>
|
||||||
|
|
@ -20,6 +23,7 @@ include <tunables/global>
|
||||||
@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop
|
@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop
|
||||||
profile child-open {
|
profile child-open {
|
||||||
include <abstractions/base>
|
include <abstractions/base>
|
||||||
|
include <abstractions/app-open>
|
||||||
include <abstractions/dri-enumerate>
|
include <abstractions/dri-enumerate>
|
||||||
include <abstractions/mesa>
|
include <abstractions/mesa>
|
||||||
include <abstractions/vulkan>
|
include <abstractions/vulkan>
|
||||||
|
|
@ -32,73 +36,6 @@ profile child-open {
|
||||||
@{bin}/basename rix,
|
@{bin}/basename rix,
|
||||||
@{bin}/readlink rix,
|
@{bin}/readlink rix,
|
||||||
|
|
||||||
# Sandbox managers
|
|
||||||
@{bin}/bwrap rPUx,
|
|
||||||
@{bin}/firejail rPUx,
|
|
||||||
@{bin}/flatpak rPUx,
|
|
||||||
@{bin}/snap rPUx,
|
|
||||||
|
|
||||||
# Files explorer
|
|
||||||
@{bin}/nautilus rPx,
|
|
||||||
|
|
||||||
# Firefox
|
|
||||||
@{bin}/firefox{,.sh,-esr,-bin} rPx,
|
|
||||||
@{lib}/firefox{,.sh,-esr,-bin}/firefox{,.sh,-esr,-bin} rPx,
|
|
||||||
/opt/firefox{,.sh,-esr,-bin}/firefox{,.sh,-esr,-bin} rPx,
|
|
||||||
# Brave
|
|
||||||
/opt/brave{-bin,.com}/brave{,-beta,-dev,-bin}/brave{,-beta,-dev,-bin} rPx,
|
|
||||||
# Chromium
|
|
||||||
@{bin}/chromium rPx,
|
|
||||||
@{lib}/chromium/chromium rPx,
|
|
||||||
# Chrome
|
|
||||||
/opt/google/chrome{,-beta,-stable,-unstable}/chrome{,-beta,-stable,-unstable} rPx,
|
|
||||||
# Opera
|
|
||||||
@{lib}/@{multiarch}/opera{,-beta,-developer}/opera{,-beta,-developer} rPx,
|
|
||||||
|
|
||||||
# Text editors
|
|
||||||
@{bin}/code rPUx,
|
|
||||||
@{bin}/gedit rPUx,
|
|
||||||
@{bin}/gnome-text-editor rPUx,
|
|
||||||
/usr/share/code/{bin/,}code rPUx,
|
|
||||||
|
|
||||||
# Others
|
|
||||||
@{bin}/*{F,f}oliate rPUx,
|
|
||||||
@{bin}/blueman-tray rPx,
|
|
||||||
@{bin}/discord{,-ptb} rPx,
|
|
||||||
@{bin}/draw.io rPUx,
|
|
||||||
@{bin}/dropbox rPx,
|
|
||||||
@{bin}/element-desktop rPx,
|
|
||||||
@{bin}/engrampa rPx,
|
|
||||||
@{bin}/eog rPUx,
|
|
||||||
@{bin}/evince rPx,
|
|
||||||
@{bin}/extension-manager rPx,
|
|
||||||
@{bin}/file-roller rPUx,
|
|
||||||
@{bin}/filezilla rPx,
|
|
||||||
@{bin}/flameshot rPx,
|
|
||||||
@{bin}/geany rPx,
|
|
||||||
@{bin}/gimp* rPUx,
|
|
||||||
@{bin}/gnome-calculator rPUx,
|
|
||||||
@{bin}/gnome-disk-image-mounter rPx,
|
|
||||||
@{bin}/gnome-disks rPx,
|
|
||||||
@{bin}/gwenview rPUx,
|
|
||||||
@{bin}/kgx rPx,
|
|
||||||
@{bin}/okular rPx,
|
|
||||||
@{bin}/qbittorrent rPx,
|
|
||||||
@{bin}/qpdfview rPx,
|
|
||||||
@{bin}/smplayer rPx,
|
|
||||||
@{bin}/spacefm rPx,
|
|
||||||
@{bin}/steam-runtime rPUx,
|
|
||||||
@{bin}/teams rPUx,
|
|
||||||
@{bin}/telegram-desktop rPx,
|
|
||||||
@{bin}/thunderbird rPx,
|
|
||||||
@{bin}/transmission-gtk rPx,
|
|
||||||
@{bin}/viewnior rPUx,
|
|
||||||
@{bin}/vlc rPUx,
|
|
||||||
@{bin}/xarchiver rPx,
|
|
||||||
@{bin}/xbrlapi rPx,
|
|
||||||
@{bin}/yelp rPUx,
|
|
||||||
@{lib}/libreoffice/program/{soffice,soffice.bin,oosplash} rPUx,
|
|
||||||
|
|
||||||
include if exists <usr/child-open.d>
|
include if exists <usr/child-open.d>
|
||||||
include if exists <local/child-open>
|
include if exists <local/child-open>
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue