diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 542b837c..836257dd 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -16,6 +16,7 @@ @{sys}/devices/pci[0-9]*/**/{usb,ata}[0-9]/** r, # SSD Nvme devices + /dev/nvme* rk, @{sys}/devices/pci[0-9]*/**/nvme/nvme[0-9]*/{,**} r, # SD card devices diff --git a/apparmor.d/abstractions/wayland.d/complete b/apparmor.d/abstractions/wayland.d/complete index dd11fe5e..2d5c3dea 100644 --- a/apparmor.d/abstractions/wayland.d/complete +++ b/apparmor.d/abstractions/wayland.d/complete @@ -4,5 +4,5 @@ # SPDX-License-Identifier: GPL-2.0-only owner @{run}/user/@{uid}/wayland-[0-9]* rw, - owner @{run}/user/@{uid}/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw, + @{run}/user/@{uid}/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw, owner /dev/shm/wlroots-* rw, diff --git a/apparmor.d/groups/browsers/chromium-chromium b/apparmor.d/groups/browsers/chromium-chromium index 12314687..72c6e561 100644 --- a/apparmor.d/groups/browsers/chromium-chromium +++ b/apparmor.d/groups/browsers/chromium-chromium @@ -200,6 +200,7 @@ profile chromium-chromium @{exec_path} { profile open { include include + include /{usr/,}bin/xdg-open mr, diff --git a/apparmor.d/groups/desktop/dconf-service b/apparmor.d/groups/desktop/dconf-service index 21dd86a4..15a76260 100644 --- a/apparmor.d/groups/desktop/dconf-service +++ b/apparmor.d/groups/desktop/dconf-service @@ -7,12 +7,14 @@ abi , include @{exec_path} = /{usr/,}lib/dconf/dconf-service /usr/{lib,libexec}/dconf-service -profile dconf-service @{exec_path} { +profile dconf-service @{exec_path} flags=(attach_disconnected) { include # Needed? deny capability sys_nice, + signal (receive) set=term peer=gdm, + @{exec_path} mr, owner @{run}/user/@{uid}/dconf/ rw, @@ -24,8 +26,11 @@ profile dconf-service @{exec_path} { owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/dconf/ rw, owner @{user_cache_dirs}/dconf/user rw, + /var/lib/gdm/.config/dconf/user r, @{PROC}/cmdline r, + /dev/tty[0-9]* rw, + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 8f15c2f3..4cc8792a 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -16,7 +16,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { signal (send) set=(term) peer=gsd-*, signal (receive) set=(term, hup) peer=gdm*, - signal (receive) set=(term) peer=gdm-wayland-session, @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 99824d70..0b97db89 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -33,6 +33,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term, hup) peer=gdm*, signal (send) set=(usr1) peer=ibus-daemon, signal (send) set=(term) peer=polkit*, + signal (send) set=(term) peer=xwayland, @{exec_path} mr, @@ -126,7 +127,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { @{sys}/devices/pci[0-9]*/**/boot_vga r, @{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r, @{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r, - @{sys}/devices/pci[0-9]*/drm/ r, + @{sys}/devices/pci[0-9]*/**/drm/ r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer b/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer index 6aadba7b..b0cc588f 100644 --- a/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer +++ b/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer @@ -12,5 +12,7 @@ profile gnome-shell-hotplug-sniffer @{exec_path} { @{exec_path} mr, + /usr/share/mime/mime.cache r, + include if exists } diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index 6c119e60..c12b745d 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -9,6 +9,7 @@ include @{exec_path} = /{usr/,}lib/gsd-housekeeping profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { include + include include signal (receive) set=(term, hup) peer=gdm*, diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index a2aba291..2476e1f4 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -17,6 +17,7 @@ profile gpg-agent @{exec_path} { @{exec_path} mr, /{usr/,}lib/gnupg/scdaemon rPx, + /{usr/,}bin/pinentry-* rPx, /usr/share/gnupg/* r, @@ -47,9 +48,6 @@ profile gpg-agent @{exec_path} { @{PROC}/@{pid}/fd/ r, - # PIN-entry apps - /{usr/,}bin/pinentry-* rPx, - # file_inherit owner @{HOME}/.xsession-errors w, diff --git a/apparmor.d/groups/gpg/gpgconf b/apparmor.d/groups/gpg/gpgconf index fca74cea..11c5dfd4 100644 --- a/apparmor.d/groups/gpg/gpgconf +++ b/apparmor.d/groups/gpg/gpgconf @@ -24,6 +24,7 @@ profile gpgconf @{exec_path} { /{usr/,}bin/pinentry-* rPx, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/**, owner @{PROC}/@{pid}/task/@{tid}/stat rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/groups/gpg/gpgsm b/apparmor.d/groups/gpg/gpgsm index 94b8361d..78a371d4 100644 --- a/apparmor.d/groups/gpg/gpgsm +++ b/apparmor.d/groups/gpg/gpgsm @@ -16,6 +16,7 @@ profile gpgsm @{exec_path} { deny /usr/bin/.gnupg/ w, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**, owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**, diff --git a/apparmor.d/profiles-a-l/dkms b/apparmor.d/profiles-a-l/dkms index e8031ec1..129fd400 100644 --- a/apparmor.d/profiles-a-l/dkms +++ b/apparmor.d/profiles-a-l/dkms @@ -17,6 +17,8 @@ profile dkms @{exec_path} { capability setgid, capability setuid, + unix (receive) type=stream, + @{exec_path} r, /{usr/,}bin/{,ba,da}sh rix, @@ -63,7 +65,7 @@ profile dkms @{exec_path} { /{usr/,}lib/modules/*/updates/ rw, /{usr/,}lib/modules/*/updates/dkms/ rw, /{usr/,}lib/modules/*/updates/dkms/*.ko rw, - /{usr/,}lib/modules/*/kernel/drivers/{,*.**.ko.xz} rw, + /{usr/,}lib/modules/*/kernel/drivers/{,*,*/,**.ko.xz} rw, /var/lib/dkms/ r, /var/lib/dkms/** rw, diff --git a/apparmor.d/profiles-a-l/gio-querymodules b/apparmor.d/profiles-a-l/gio-querymodules index 56bba7b8..b01e0e3e 100644 --- a/apparmor.d/profiles-a-l/gio-querymodules +++ b/apparmor.d/profiles-a-l/gio-querymodules @@ -13,7 +13,7 @@ profile gio-querymodules @{exec_path} { @{exec_path} mr, - /{usr/,}/lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w, + /{usr/,}lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w, include if exists } \ No newline at end of file diff --git a/apparmor.d/profiles-a-l/groupadd b/apparmor.d/profiles-a-l/groupadd index 9561e3ad..3b254c15 100644 --- a/apparmor.d/profiles-a-l/groupadd +++ b/apparmor.d/profiles-a-l/groupadd @@ -22,6 +22,7 @@ profile groupadd @{exec_path} { network netlink raw, @{exec_path} mr, + /{usr/,}{s,}bin/nscd rix, /etc/login.defs r, diff --git a/apparmor.d/profiles-a-l/install-info b/apparmor.d/profiles-a-l/install-info index 3ee11fb2..0e45e73b 100644 --- a/apparmor.d/profiles-a-l/install-info +++ b/apparmor.d/profiles-a-l/install-info @@ -10,13 +10,17 @@ include profile install-info @{exec_path} { include + capability dac_read_search, + @{exec_path} mr, /{usr/,}bin/{,ba,da}sh rix, - /{usr/,}/bin/gzip rix, + /{usr/,}bin/gzip rix, /usr/share/info/{,**} r, /usr/share/info/dir rw, + /dev/tty rw, + include if exists } \ No newline at end of file diff --git a/apparmor.d/profiles-a-l/kmod b/apparmor.d/profiles-a-l/kmod index a0dcb19b..ff09733c 100644 --- a/apparmor.d/profiles-a-l/kmod +++ b/apparmor.d/profiles-a-l/kmod @@ -26,8 +26,7 @@ profile kmod @{exec_path} { # than to standard error. capability syslog, - unix (receive) type=stream peer=(label=depmod), - unix (receive) type=stream peer=(label=modprobe), + unix (receive) type=stream, @{exec_path} mr,