diff --git a/apparmor.d/abstractions/dbus-session-strict.d/complete b/apparmor.d/abstractions/dbus-session-strict.d/complete index 8578e7d2..1dc40e4c 100644 --- a/apparmor.d/abstractions/dbus-session-strict.d/complete +++ b/apparmor.d/abstractions/dbus-session-strict.d/complete @@ -2,7 +2,9 @@ # Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - unix (bind, listen) type=stream addr="@/tmp/dbus-*", + unix (connect, send, receive, accept) + type=stream + addr="@/tmp/dbus-*", unix (connect, receive, send, accept) type=stream diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 146a45be..97bae8b7 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -86,15 +86,13 @@ # changes, it's better to allow the whole range (240-254) instead of the single major numbers # visible in the /proc/devices file. # [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt - @{run}/udev/data/b252:[0-9]* r, - @{run}/udev/data/b253:[0-9]* r, + @{run}/udev/data/b24[0-9]:[0-9]* r, + @{run}/udev/data/b25[0-4]:[0-9]* r, @{run}/udev/data/b259:[0-9]* r, - @{run}/udev/data/c24[0-9]:[0-9]* r, - @{run}/udev/data/c25[0-4]:[0-9]* r, - @{run}/udev/data/b230:[0-9]* r, # /dev/zvol* @{run}/udev/data/b11:[0-9]* r, # for /dev/sr* @{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk* + @{run}/udev/data/b230:[0-9]* r, # for /dev/zvol* @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index e72a8906..fd5c7b73 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -68,23 +68,16 @@ # changes, it's better to allow the whole range (240-254) instead of the single major numbers # visible in the /proc/devices file. # [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt - @{run}/udev/data/b252:[0-9]* r, - @{run}/udev/data/b253:[0-9]* r, + @{run}/udev/data/b24[0-9]:[0-9]* r, + @{run}/udev/data/b25[0-4]:[0-9]* r, @{run}/udev/data/b259:[0-9]* r, - @{run}/udev/data/c24[0-9]:[0-9]* r, - @{run}/udev/data/c25[0-4]:[0-9]* r, - @{run}/udev/data/b230:[0-9]* r, # /dev/zvol* @{run}/udev/data/b11:[0-9]* r, # for /dev/sr* @{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk* - @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* - @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* - - @{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk* - @{run}/udev/data/b11:[0-9]* r, # for /dev/sr* - @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* - @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* @{run}/udev/data/b2:[0-9]* r, # for /dev/fd* + @{run}/udev/data/b230:[0-9]* r, # for /dev/zvol* + @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* + @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* @{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**