mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 17:08:09 +01:00
Add idbus profiles.
This commit is contained in:
Alexandre Pujol
parent
001c2028f6
commit
559020861b
7 changed files with 199 additions and 0 deletions
34
apparmor.d/groups/bus/ibus-daemon
Normal file
34
apparmor.d/groups/bus/ibus-daemon
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
abi <abi/3.0>,
|
||||||
|
|
||||||
|
include <tunables/global>
|
||||||
|
|
||||||
|
@{exec_path} = /{usr/,}bin/ibus-daemon
|
||||||
|
profile ibus-daemon @{exec_path} flags=(attach_disconnected) {
|
||||||
|
include <abstractions/base>
|
||||||
|
include <abstractions/nameservice-strict>
|
||||||
|
|
||||||
|
signal (receive) set=(usr1) peer=gnome-shell,
|
||||||
|
signal (send) set=(term) peer=ibus*,
|
||||||
|
|
||||||
|
@{exec_path} mr,
|
||||||
|
|
||||||
|
/{usr/,}lib/ibus/ibus-* rPx,
|
||||||
|
|
||||||
|
/usr/share/ibus/{,**} r,
|
||||||
|
/var/lib/dbus/machine-id r,
|
||||||
|
|
||||||
|
owner @{user_config_dirs}/ibus/{,**} rw,
|
||||||
|
owner @{user_cache_dirs}/ibus/{,**} rw,
|
||||||
|
/var/lib/gdm/.config/ibus/{,**} rw,
|
||||||
|
/var/lib/gdm/.cache/ibus/{,**} rw,
|
||||||
|
|
||||||
|
owner @{PROC}/@{pids}/fd/ r,
|
||||||
|
|
||||||
|
owner /dev/tty[0-9]* rw,
|
||||||
|
|
||||||
|
include if exists <local/ibus-daemon>
|
||||||
|
}
|
||||||
35
apparmor.d/groups/bus/ibus-dconf
Normal file
35
apparmor.d/groups/bus/ibus-dconf
Normal file
|
|
@ -0,0 +1,35 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
abi <abi/3.0>,
|
||||||
|
|
||||||
|
include <tunables/global>
|
||||||
|
|
||||||
|
@{exec_path} = /{usr/,}lib/ibus/ibus-dconf
|
||||||
|
profile ibus-dconf @{exec_path} flags=(attach_disconnected) {
|
||||||
|
include <abstractions/base>
|
||||||
|
|
||||||
|
signal (receive) set=term peer=ibus-daemon,
|
||||||
|
|
||||||
|
@{exec_path} mr,
|
||||||
|
|
||||||
|
/usr/share/gdm/greeter-dconf-defaults r,
|
||||||
|
|
||||||
|
/etc/dconf/profile/ibus r,
|
||||||
|
/etc/dconf/db/ibus r,
|
||||||
|
/var/lib/dbus/machine-id r,
|
||||||
|
|
||||||
|
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
|
||||||
|
include <abstractions/dconf>
|
||||||
|
owner @{run}/user/@{uid}/dconf/ rw,
|
||||||
|
owner @{run}/user/@{uid}/dconf/user rw,
|
||||||
|
/usr/share/dconf/profile/gdm r,
|
||||||
|
/var/lib/gdm/.config/dconf/user r,
|
||||||
|
|
||||||
|
owner /dev/tty[0-9]* rw,
|
||||||
|
|
||||||
|
include if exists <local/ibus-dconf>
|
||||||
|
}
|
||||||
25
apparmor.d/groups/bus/ibus-engine-simple
Normal file
25
apparmor.d/groups/bus/ibus-engine-simple
Normal file
|
|
@ -0,0 +1,25 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
abi <abi/3.0>,
|
||||||
|
|
||||||
|
include <tunables/global>
|
||||||
|
|
||||||
|
@{exec_path} = /{usr/,}lib/ibus/ibus-engine-simple
|
||||||
|
profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) {
|
||||||
|
include <abstractions/base>
|
||||||
|
|
||||||
|
signal (receive) set=term peer=ibus-daemon,
|
||||||
|
|
||||||
|
@{exec_path} mr,
|
||||||
|
|
||||||
|
/var/lib/dbus/machine-id r,
|
||||||
|
|
||||||
|
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
|
||||||
|
owner /dev/tty[0-9]* rw,
|
||||||
|
|
||||||
|
include if exists <local/ibus-engine-simple>
|
||||||
|
}
|
||||||
42
apparmor.d/groups/bus/ibus-extension-gtk3
Normal file
42
apparmor.d/groups/bus/ibus-extension-gtk3
Normal file
|
|
@ -0,0 +1,42 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
abi <abi/3.0>,
|
||||||
|
|
||||||
|
include <tunables/global>
|
||||||
|
|
||||||
|
@{exec_path} = /{usr/,}lib/ibus/ibus-extension-gtk3
|
||||||
|
profile ibus-extension-gtk3 @{exec_path} {
|
||||||
|
include <abstractions/base>
|
||||||
|
include <abstractions/fonts>
|
||||||
|
include <abstractions/gtk>
|
||||||
|
include <abstractions/nameservice-strict>
|
||||||
|
|
||||||
|
signal (receive) set=term peer=ibus-daemon,
|
||||||
|
|
||||||
|
network inet dgram,
|
||||||
|
network inet6 dgram,
|
||||||
|
network inet stream,
|
||||||
|
network inet6 stream,
|
||||||
|
network netlink raw,
|
||||||
|
|
||||||
|
@{exec_path} mr,
|
||||||
|
|
||||||
|
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||||
|
/usr/share/ibus/{,**} r,
|
||||||
|
/usr/share/icons/{,**} r,
|
||||||
|
/usr/share/X11/xkb/** r,
|
||||||
|
|
||||||
|
/var/lib/dbus/machine-id r,
|
||||||
|
|
||||||
|
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
|
||||||
|
include <abstractions/dconf>
|
||||||
|
owner @{run}/user/@{uid}/dconf/ rw,
|
||||||
|
owner @{run}/user/@{uid}/dconf/user rw,
|
||||||
|
/usr/share/dconf/profile/gdm r,
|
||||||
|
/var/lib/gdm/.config/dconf/user r,
|
||||||
|
|
||||||
|
include if exists <local/ibus-extension-gtk3>
|
||||||
|
}
|
||||||
30
apparmor.d/groups/bus/ibus-portal
Normal file
30
apparmor.d/groups/bus/ibus-portal
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
abi <abi/3.0>,
|
||||||
|
|
||||||
|
include <tunables/global>
|
||||||
|
|
||||||
|
@{exec_path} = /{usr/,}lib/ibus/ibus-portal
|
||||||
|
profile ibus-portal @{exec_path} flags=(attach_disconnected) {
|
||||||
|
include <abstractions/base>
|
||||||
|
|
||||||
|
signal (receive) set=(term, hup) peer=gdm*,
|
||||||
|
|
||||||
|
@{exec_path} mr,
|
||||||
|
|
||||||
|
/{usr/,}lib/gio/modules/{,*} r,
|
||||||
|
/{usr/,}lib/locale/locale-archive r,
|
||||||
|
|
||||||
|
/usr/share/locale/locale.alias r,
|
||||||
|
|
||||||
|
/var/lib/dbus/machine-id r,
|
||||||
|
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
|
||||||
|
owner /dev/tty[0-9]* rw,
|
||||||
|
/dev/null rw,
|
||||||
|
|
||||||
|
include if exists <local/ibus-portal>
|
||||||
|
}
|
||||||
30
apparmor.d/groups/bus/ibus-x11
Normal file
30
apparmor.d/groups/bus/ibus-x11
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
abi <abi/3.0>,
|
||||||
|
|
||||||
|
include <tunables/global>
|
||||||
|
|
||||||
|
@{exec_path} = /{usr/,}lib/ibus/ibus-x11
|
||||||
|
profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
|
||||||
|
include <abstractions/base>
|
||||||
|
include <abstractions/dri-common>
|
||||||
|
include <abstractions/dri-enumerate>
|
||||||
|
include <abstractions/nameservice-strict>
|
||||||
|
include <abstractions/mesa>
|
||||||
|
include <abstractions/gtk>
|
||||||
|
|
||||||
|
@{exec_path} mr,
|
||||||
|
|
||||||
|
/var/lib/dbus/machine-id r,
|
||||||
|
|
||||||
|
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
|
||||||
|
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
|
||||||
|
|
||||||
|
owner /dev/tty[0-9]* rw,
|
||||||
|
|
||||||
|
include if exists <local/ibus-x11>
|
||||||
|
}
|
||||||
|
|
@ -31,6 +31,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
||||||
ptrace (read),
|
ptrace (read),
|
||||||
|
|
||||||
signal (receive) set=(term, hup) peer=gdm*,
|
signal (receive) set=(term, hup) peer=gdm*,
|
||||||
|
signal (send) set=(usr1) peer=ibus-daemon,
|
||||||
signal (send) set=(term) peer=polkit*,
|
signal (send) set=(term) peer=polkit*,
|
||||||
|
|
||||||
@{exec_path} mr,
|
@{exec_path} mr,
|
||||||
|
|
@ -66,6 +67,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
||||||
|
|
||||||
owner @{user_config_dirs}/monitors.xml r,
|
owner @{user_config_dirs}/monitors.xml r,
|
||||||
owner @{user_config_dirs}/ibus/* r,
|
owner @{user_config_dirs}/ibus/* r,
|
||||||
|
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
|
||||||
|
|
||||||
owner @{user_share_dirs}/gnome-shell/{,**} rw,
|
owner @{user_share_dirs}/gnome-shell/{,**} rw,
|
||||||
owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
|
owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue