diff --git a/apparmor.d/abstractions/chromium b/apparmor.d/abstractions/chromium index cbae4033..43fcd882 100644 --- a/apparmor.d/abstractions/chromium +++ b/apparmor.d/abstractions/chromium @@ -8,7 +8,7 @@ # This abstraction requires the following variables definied in the profile header: # @{chromium_name} = chromium # @{chromium_domain} = org.chromium.Chromium -# @{chromium_install_dirs} = /{usr/,}lib/chromium +# @{chromium_lib_dirs} = /{usr/,}lib/chromium # @{chromium_config_dirs} = @{user_config_dirs}/chromium # @{chromium_cache_dirs} = @{user_cache_dirs}/chromium @@ -54,9 +54,9 @@ network inet6 stream, network netlink raw, - @{chromium_install_dirs}/{,**} r, - @{chromium_install_dirs}/chrome_crashpad_handler rPx, - @{chromium_install_dirs}/chrome-sandbox rPx, + @{chromium_lib_dirs}/{,**} r, + @{chromium_lib_dirs}/chrome_crashpad_handler rPx, + @{chromium_lib_dirs}/chrome-sandbox rPx, # Desktop integration /{usr/,}bin/lsb_release rPx -> lsb_release, @@ -204,7 +204,7 @@ owner /dev/tty[0-9]* rw, # Silencer - deny @{chromium_install_dirs}/** w, + deny @{chromium_lib_dirs}/** w, deny @{user_share_dirs}/gvfs-metadata/* r, include if exists diff --git a/apparmor.d/groups/browsers/brave b/apparmor.d/groups/browsers/brave index 5bd500b5..8fdc257f 100644 --- a/apparmor.d/groups/browsers/brave +++ b/apparmor.d/groups/browsers/brave @@ -9,11 +9,11 @@ include @{chromium_name} = brave{,-beta,-dev} @{chromium_domain} = com.brave.Brave -@{chromium_install_dirs} = /opt/brave.com/@{chromium_name} +@{chromium_lib_dirs} = /opt/brave.com/@{chromium_name} @{chromium_config_dirs} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev} @{chromium_cache_dirs} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev} -@{exec_path} = @{chromium_install_dirs}/@{chromium_name} +@{exec_path} = @{chromium_lib_dirs}/@{chromium_name} profile brave @{exec_path} { include include @@ -22,8 +22,8 @@ profile brave @{exec_path} { /{usr/,}bin/man rPUx, # For "brave --help" - @{chromium_install_dirs}/swiftshader/libGLESv2.so mr, - @{chromium_install_dirs}/swiftshader/libEGL.so mr, + @{chromium_lib_dirs}/swiftshader/libGLESv2.so mr, + @{chromium_lib_dirs}/swiftshader/libEGL.so mr, /usr/share/chromium/extensions/ r, diff --git a/apparmor.d/groups/browsers/brave-sandbox b/apparmor.d/groups/browsers/brave-sandbox index d32b52cb..87481d25 100644 --- a/apparmor.d/groups/browsers/brave-sandbox +++ b/apparmor.d/groups/browsers/brave-sandbox @@ -7,9 +7,9 @@ abi , include -@{chromium_install_dirs} = /opt/brave.com/brave{,-beta,-dev} +@{chromium_lib_dirs} = /opt/brave.com/brave{,-beta,-dev} -@{exec_path} = @{chromium_install_dirs}/{brave,chrome}-sandbox +@{exec_path} = @{chromium_lib_dirs}/{brave,chrome}-sandbox profile brave-sandbox @{exec_path} { include @@ -21,7 +21,7 @@ profile brave-sandbox @{exec_path} { @{exec_path} mr, - @{chromium_install_dirs}/brave rPx, + @{chromium_lib_dirs}/brave rPx, @{PROC} r, @{PROC}/@{pids}/ r, diff --git a/apparmor.d/groups/browsers/brave-wrapper b/apparmor.d/groups/browsers/brave-wrapper index 05025858..40870df7 100644 --- a/apparmor.d/groups/browsers/brave-wrapper +++ b/apparmor.d/groups/browsers/brave-wrapper @@ -7,9 +7,9 @@ abi , include -@{chromium_install_dirs} = /opt/brave.com/brave{,-beta,-dev} +@{chromium_lib_dirs} = /opt/brave.com/brave{,-beta,-dev} -@{exec_path} = @{chromium_install_dirs}/brave-browser{,-beta,-dev} +@{exec_path} = @{chromium_lib_dirs}/brave-browser{,-beta,-dev} profile brave-wrapper @{exec_path} { include include @@ -24,7 +24,7 @@ profile brave-wrapper @{exec_path} { /{usr/,}bin/touch rix, /{usr/,}bin/which{,.debianutils} rix, - @{chromium_install_dirs}/brave rPx, + @{chromium_lib_dirs}/brave rPx, owner @{PROC}/@{pid}/fd/ w, diff --git a/apparmor.d/groups/browsers/chrome b/apparmor.d/groups/browsers/chrome index 633daf8f..75ec1816 100644 --- a/apparmor.d/groups/browsers/chrome +++ b/apparmor.d/groups/browsers/chrome @@ -9,11 +9,11 @@ include @{chromium_name} = chrome{,-beta,-unstable} @{chromium_domain} = com.google.Chrome -@{chromium_install_dirs} = /opt/google/@{chromium_name} +@{chromium_lib_dirs} = /opt/google/@{chromium_name} @{chromium_config_dirs} = @{user_config_dirs}/google-@{chromium_name} @{chromium_cache_dirs} = @{user_cache_dirs}/google-@{chromium_name} -@{exec_path} = @{chromium_install_dirs}/@{chromium_name} +@{exec_path} = @{chromium_lib_dirs}/@{chromium_name} profile chrome @{exec_path} { include include @@ -22,16 +22,16 @@ profile chrome @{exec_path} { /{usr/,}bin/man rPUx, # For "chrome --help" - @{chromium_install_dirs}/google-chrome{,-beta,-unstable} rPx, + @{chromium_lib_dirs}/google-chrome{,-beta,-unstable} rPx, - @{chromium_install_dirs}/nacl_helper rix, - @{chromium_install_dirs}/xdg-mime rix, #-> xdg-mime, - @{chromium_install_dirs}/xdg-settings rix, #-> xdg-settings, + @{chromium_lib_dirs}/nacl_helper rix, + @{chromium_lib_dirs}/xdg-mime rix, #-> xdg-mime, + @{chromium_lib_dirs}/xdg-settings rix, #-> xdg-settings, - @{chromium_install_dirs}/*.so* mr, - @{chromium_install_dirs}/libwidevinecdm.so mr, - @{chromium_install_dirs}/libwidevinecdmadapter.so mr, - @{chromium_install_dirs}/WidevineCdm/_platform_specific/linux_*/libwidevinecdm.so mr, + @{chromium_lib_dirs}/*.so* mr, + @{chromium_lib_dirs}/libwidevinecdm.so mr, + @{chromium_lib_dirs}/libwidevinecdmadapter.so mr, + @{chromium_lib_dirs}/WidevineCdm/_platform_specific/linux_*/libwidevinecdm.so mr, include if exists } diff --git a/apparmor.d/groups/browsers/chrome-crashpad-handler b/apparmor.d/groups/browsers/chrome-crashpad-handler index 1e43dfea..865c3c5c 100644 --- a/apparmor.d/groups/browsers/chrome-crashpad-handler +++ b/apparmor.d/groups/browsers/chrome-crashpad-handler @@ -7,10 +7,10 @@ abi , include -@{chromium_install_dirs} = /opt/google/chrome{,-beta,-unstable} +@{chromium_lib_dirs} = /opt/google/chrome{,-beta,-unstable} @{chromium_config_dirs} = @{user_config_dirs}/google-chrome{,-beta,-unstable} -@{exec_path} = @{chromium_install_dirs}/chrome_crashpad_handler +@{exec_path} = @{chromium_lib_dirs}/chrome_crashpad_handler profile chrome-crashpad-handler @{exec_path} { include diff --git a/apparmor.d/groups/browsers/chrome-sandbox b/apparmor.d/groups/browsers/chrome-sandbox index 5fc4508d..95152871 100644 --- a/apparmor.d/groups/browsers/chrome-sandbox +++ b/apparmor.d/groups/browsers/chrome-sandbox @@ -7,9 +7,9 @@ abi , include -@{chromium_install_dirs} = /opt/google/chrome{,-stable,-beta,-unstable} +@{chromium_lib_dirs} = /opt/google/chrome{,-stable,-beta,-unstable} -@{exec_path} = @{chromium_install_dirs}/chrome-sandbox +@{exec_path} = @{chromium_lib_dirs}/chrome-sandbox profile chrome-sandbox @{exec_path} { include @@ -21,8 +21,8 @@ profile chrome-sandbox @{exec_path} { @{exec_path} mr, - @{chromium_install_dirs}/chrome rPx, - @{chromium_install_dirs}/nacl_helper rix, + @{chromium_lib_dirs}/chrome rPx, + @{chromium_lib_dirs}/nacl_helper rix, @{PROC} r, @{PROC}/@{pids}/ r, diff --git a/apparmor.d/groups/browsers/chrome-wrapper b/apparmor.d/groups/browsers/chrome-wrapper index d32c5e50..e64bdbc1 100644 --- a/apparmor.d/groups/browsers/chrome-wrapper +++ b/apparmor.d/groups/browsers/chrome-wrapper @@ -7,9 +7,9 @@ abi , include -@{chromium_install_dirs} = /opt/google/chrome{,-beta,-unstable} +@{chromium_lib_dirs} = /opt/google/chrome{,-beta,-unstable} -@{exec_path} = @{chromium_install_dirs}/google-chrome{,-beta,-unstable} +@{exec_path} = @{chromium_lib_dirs}/google-chrome{,-beta,-unstable} profile chrome-wrapper @{exec_path} { include include @@ -24,7 +24,7 @@ profile chrome-wrapper @{exec_path} { /{usr/,}bin/touch rix, /{usr/,}bin/which{,.debianutils} rix, - @{chromium_install_dirs}/chrome rPx, + @{chromium_lib_dirs}/chrome rPx, owner @{user_config_dirs}/chrome-flags.conf r, diff --git a/apparmor.d/groups/browsers/chromium b/apparmor.d/groups/browsers/chromium index e3a93810..dd62e861 100644 --- a/apparmor.d/groups/browsers/chromium +++ b/apparmor.d/groups/browsers/chromium @@ -9,11 +9,11 @@ include @{chromium_name} = chromium @{chromium_domain} = org.chromium.Chromium -@{chromium_install_dirs} = /{usr/,}lib/@{chromium_name} +@{chromium_lib_dirs} = /{usr/,}lib/@{chromium_name} @{chromium_config_dirs} = @{user_config_dirs}/@{chromium_name} @{chromium_cache_dirs} = @{user_cache_dirs}/@{chromium_name} -@{exec_path} = @{chromium_install_dirs}/@{chromium_name} +@{exec_path} = @{chromium_lib_dirs}/@{chromium_name} profile chromium @{exec_path} { include include diff --git a/apparmor.d/groups/browsers/opera b/apparmor.d/groups/browsers/opera index ab3b7409..29da08d9 100644 --- a/apparmor.d/groups/browsers/opera +++ b/apparmor.d/groups/browsers/opera @@ -9,20 +9,20 @@ include @{chromium_name} = opera{,-beta,-developer} @{chromium_domain} = com.opera.Opera -@{chromium_install_dirs} = /{usr/,}lib/@{multiarch}/@{chromium_name} +@{chromium_lib_dirs} = /{usr/,}lib/@{multiarch}/@{chromium_name} @{chromium_config_dirs} = @{user_config_dirs}/@{chromium_name} @{chromium_cache_dirs} = @{user_cache_dirs}/@{chromium_name} -@{exec_path} = @{chromium_install_dirs}/@{chromium_name} +@{exec_path} = @{chromium_lib_dirs}/@{chromium_name} profile opera @{exec_path} { include include @{exec_path} mrix, - @{chromium_install_dirs}/opera_autoupdate krix, - @{chromium_install_dirs}/opera_crashreporter rPx, - @{chromium_install_dirs}/opera-sandbox rPx, + @{chromium_lib_dirs}/opera_autoupdate krix, + @{chromium_lib_dirs}/opera_crashreporter rPx, + @{chromium_lib_dirs}/opera-sandbox rPx, /opt/google/chrome{,-beta,-unstable}/libwidevinecdm.so mr, /opt/google/chrome{,-beta,-unstable}/libwidevinecdmadapter.so mr, diff --git a/apparmor.d/groups/browsers/opera-crashreporter b/apparmor.d/groups/browsers/opera-crashreporter index 03aa613f..adfee634 100644 --- a/apparmor.d/groups/browsers/opera-crashreporter +++ b/apparmor.d/groups/browsers/opera-crashreporter @@ -8,10 +8,10 @@ abi , include @{chromium_name} = opera{,-beta,-developer} -@{chromium_install_dirs} = /{usr/,}lib/@{multiarch}/@{chromium_name} +@{chromium_lib_dirs} = /{usr/,}lib/@{multiarch}/@{chromium_name} @{chromium_config_dirs} = @{user_config_dirs}/@{chromium_name} -@{exec_path} = @{chromium_install_dirs}/opera_crashreporter +@{exec_path} = @{chromium_lib_dirs}/opera_crashreporter profile opera-crashreporter @{exec_path} { include include diff --git a/apparmor.d/groups/browsers/opera-sandbox b/apparmor.d/groups/browsers/opera-sandbox index 3d1bccb8..02ab6e01 100644 --- a/apparmor.d/groups/browsers/opera-sandbox +++ b/apparmor.d/groups/browsers/opera-sandbox @@ -7,9 +7,9 @@ abi , include @{chromium_name} = opera{,-beta,-developer} -@{chromium_install_dirs} = /{usr/,}lib/@{multiarch}/@{chromium_name} +@{chromium_lib_dirs} = /{usr/,}lib/@{multiarch}/@{chromium_name} -@{exec_path} = @{chromium_install_dirs}/opera_sandbox +@{exec_path} = @{chromium_lib_dirs}/opera_sandbox profile opera-sandbox @{exec_path} { include include @@ -25,7 +25,7 @@ profile opera-sandbox @{exec_path} { @{exec_path} mr, - @{chromium_install_dirs}/opera{,-beta,-developer} rPx, + @{chromium_lib_dirs}/opera{,-beta,-developer} rPx, @{PROC} r, @{PROC}/@{pids}/ r,