mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): various profile fixes.

Browse source
This commit is contained in:
Alexandre Pujol 2023-08-19 14:01:50 +01:00
parent 1dbced42ed
commit 5704d1ba20
Failed to generate hash of commit
11 changed files with 38 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/bus/dbus-daemon
View file

@ -77,6 +77,8 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/dbus-1/{,**} r,
@{user_share_dirs}/icc/{,edid-*} r,
owner /tmp/dbus-@{rand10} rw,
owner @{run}/user/@{uid}/dbus-1/ rw,
owner @{run}/user/@{uid}/dbus-1/services/ rw,
@{run}/systemd/inhibit/[0-9]*.ref rw,

27
apparmor.d/groups/freedesktop/xdg-document-portal
View file

@ -13,7 +13,9 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
capability sys_nice,
capability sys_resource,
# capability sys_admin,
capability sys_admin,
mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/,
ptrace (read) peer=xdg-desktop-portal,
@ -78,12 +80,12 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
/ r,
/etc/flatpak/remotes.d/{,*} r,
/var/lib/flatpak/{,**} rw,
owner @{user_cache_dirs}/flatpak/{,**} r,
owner @{user_config_dirs}/user-dirs.dirs r,
owner @{user_share_dirs}/flatpak/{,**} r,
/var/lib/flatpak/{,**} rw,
@{PROC}/sys/kernel/random/boot_id r,
/dev/tty rw,
@ -98,25 +100,22 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
capability sys_admin,
capability dac_read_search,
unix (send receive) type=stream peer=(label=xdg-document-portal),
# network inet stream,
# network inet6 stream,
@{bin}/fusermount{,3} mr,
/etc/fuse{,3}.conf r,
mount options=(rw, rprivate) -> /,
mount options=(rw, rbind) @{run}/user/@{uid}/ -> /,
mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/,
umount @{run}/user/@{uid}/doc/,
@{PROC}/@{pids}/mounts r,
unix (send receive) type=stream peer=(label=xdg-document-portal),
@{bin}/fusermount{,3} mr,
/etc/fuse{,3}.conf r,
owner @{run}/user/@{uid}/doc/ rw,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/xdg-document-portal_fusermount>

2
apparmor.d/groups/freedesktop/xkbcomp
View file

@ -31,6 +31,8 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm{3,}/.local/share/xorg/Xorg.@{int}.log w,
owner /var/log/lightdm/x-@{int}.log w,
owner @{run}/user/@{uid}/server-@{int}.xkm rwk,
owner /tmp/server-@{int}.xkm rwk,
/dev/dri/card@{int} rw,

1
apparmor.d/groups/freedesktop/xwayland
View file

@ -38,6 +38,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
owner /tmp/server-@{int}.xkm rwk,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw,
owner @{run}/user/@{uid}/server-@{int}.xkm rw,
owner @{run}/user/@{uid}/xwayland-shared-@{rand6} rw,
@{sys}/bus/pci/devices/ r,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -581,7 +581,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw,
owner @{run}/user/@{uid}/systemd/notify rw,
owner @{run}/user/@{uid}/wayland-@{int} rwk,
owner @{run}/user/@{uid}/wayland-@{int}.lock rwk,
owner /dev/shm/.org.chromium.Chromium.* rw,
owner /dev/shm/wayland.mozilla.ipc.@{int} rw,

11
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -44,10 +44,13 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/sessions/* r,
@{run}/systemd/sessions/*.ref r,
@{sys}/devices/pci[0-9]*/**/net/*/statistics/collisions r,
@{sys}/devices/pci[0-9]*/**/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/pci[0-9]*/**/net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/pci[0-9]*/**/virtio[0-9]*/**/stat r,
@{sys}/devices/@{pci}/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/virtio[0-9]*/**/stat r,
@{sys}/devices/virtual/net/*/statistics/collisions r,
@{sys}/devices/virtual/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/virtual/net/*/statistics/tx_{bytes,errors,packets} r,

2
apparmor.d/groups/virt/virtnodedevd
View file

@ -52,7 +52,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/c29:[0-9]* r, # For /dev/fb[0-9]*
@{run}/udev/data/c90:[0-9]* r, # For RAM, ROM, Flash
@{run}/udev/data/c116:[0-9]* r, # For ALSA
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card@{int}
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card[0-9]*
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,

5
apparmor.d/profiles-m-r/multipath
View file

@ -16,8 +16,11 @@ profile multipath @{exec_path} {
@{exec_path} mr,
/etc/multipath/bindings rwk,
/etc/multipath.conf r,
/etc/multipath/bindings rwk,
/etc/systemd/system/ r,
@{run}/systemd/system/ r,
@{sys}/bus/ r,
@{sys}/class/ r,

4
apparmor.d/profiles-m-r/pidof
View file

@ -18,10 +18,14 @@ profile pidof @{exec_path} {
/app/lib/libzypak-preload-host*.so rm,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/ r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/stat r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/uptime r,
owner /dev/tty@{int} rw,

2
apparmor.d/profiles-s-z/thunderbird-vaapitest
View file

@ -30,5 +30,7 @@ profile thunderbird-vaapitest @{exec_path} {
owner /tmp/thunderbird/.parentlock rw,
@{sys}/devices/@{pci}/{irq,resource,revision} r,
include if exists <local/thunderbird-vaapitest>
}

2
dists/flags/main.flags
View file

@ -354,7 +354,7 @@ xdg-desktop-portal attach_disconnected,complain
xdg-desktop-portal-gnome complain
xdg-desktop-portal-gtk complain
xdg-desktop-portal-kde complain
xdg-document-portal complain
xdg-document-portal attach_disconnected,complain
xdg-permission-store attach_disconnected,complain
xdg-user-dirs-gtk-update complain
xdm-xsession complain