mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-24 03:48:13 +01:00
feat(profile): initial integration with attached path.
The feature is not yet enabled. See https://apparmor.pujol.io/development/internal/#re-attached-path
This commit is contained in:
Alexandre Pujol
parent
5bf8c6ef0f
commit
61a27bc336
85 changed files with 164 additions and 139 deletions
14
apparmor.d/abstractions/attached/base
Normal file
14
apparmor.d/abstractions/attached/base
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
# LOGPROF-SUGGEST: no
|
||||
|
||||
# Do not use it manually, it is automatically included in profiles when it is required.
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
@{att}/apparmor/.null rw,
|
||||
|
||||
include if exists <abstractions/attached/base.d>
|
||||
|
||||
# vim:syntax=apparmor
|
||||
13
apparmor.d/abstractions/attached/consoles
Normal file
13
apparmor.d/abstractions/attached/consoles
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
# LOGPROF-SUGGEST: no
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
owner @{att}/dev/pts/@{int} rw,
|
||||
owner @{att}/dev/tty@{int} rw,
|
||||
|
||||
include if exists <abstractions/attached/consoles.d>
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -67,10 +67,11 @@
|
|||
owner @{tmp}/** rmwk,
|
||||
owner /dev/shm/** rwlk -> /dev/shm/**,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket.
|
||||
@{run}/host/{,**} r,
|
||||
@{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket.
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/utmp rk,
|
||||
|
||||
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
|
||||
|
|
|
|||
|
|
@ -44,15 +44,16 @@
|
|||
owner /tmp/newroot/ w,
|
||||
owner /tmp/oldroot/ w,
|
||||
|
||||
@{att}/@{PROC}/sys/user/max_user_namespaces rw,
|
||||
owner @{att}/@{PROC}/@{pid}/cgroup r,
|
||||
owner @{att}/@{PROC}/@{pid}/gid_map rw,
|
||||
owner @{att}/@{PROC}/@{pid}/mountinfo r,
|
||||
owner @{att}/@{PROC}/@{pid}/setgroups rw,
|
||||
owner @{att}/@{PROC}/@{pid}/uid_map rw,
|
||||
|
||||
@{PROC}/sys/kernel/overflowgid r,
|
||||
@{PROC}/sys/kernel/overflowuid r,
|
||||
@{PROC}/sys/user/max_user_namespaces rw,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/gid_map rw,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/setgroups rw,
|
||||
owner @{PROC}/@{pid}/uid_map rw,
|
||||
|
||||
include if exists <abstractions/common/bwrap.d>
|
||||
|
||||
|
|
|
|||
|
|
@ -141,6 +141,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{tmp}/apt.conf.* rw,
|
||||
owner @{tmp}/apt.data.* rw,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
|
@ -148,8 +150,6 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/dev/ptmx rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
profile editor flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/editor>
|
||||
|
|
|
|||
|
|
@ -100,7 +100,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
|
|||
/var/log/apt/{term,history}.log w,
|
||||
/var/log/apt/eipp.log.xz w,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
owner @{run}/unattended-upgrades.lock rwk,
|
||||
owner @{run}/unattended-upgrades.pid rw,
|
||||
owner @{run}/unattended-upgrades.progress rw,
|
||||
|
|
|
|||
|
|
@ -24,8 +24,8 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner /var/log/unattended-upgrades/*.log* rw,
|
||||
|
||||
owner @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
owner @{run}/unattended-upgrades.lock rwk,
|
||||
owner @{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ profile epiphany @{exec_path} flags=(attach_disconnected) {
|
|||
@{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix,
|
||||
|
||||
owner /bindfile@{rand6} rw,
|
||||
owner /.flatpak-info r,
|
||||
owner @{att}/.flatpak-info r,
|
||||
|
||||
owner @{user_config_dirs}/glib-2.0/ w,
|
||||
owner @{user_config_dirs}/glib-2.0/settings/ w,
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi2-registryd
|
||||
profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
|
|
@ -27,8 +28,6 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/at-spi2-registryd>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher
|
||||
profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.a11y>
|
||||
|
|
@ -72,8 +73,6 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/oom_score_adj r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/dbus-accessibility>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -49,17 +49,17 @@ profile dbus-system flags=(attach_disconnected) {
|
|||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
@{desktop_share_dirs}/icc/ r,
|
||||
@{desktop_share_dirs}/icc/edid-@{hex32}.icc r,
|
||||
@{user_share_dirs}/icc/ r,
|
||||
@{user_share_dirs}/icc/edid-@{hex32}.icc r,
|
||||
@{att}/@{desktop_share_dirs}/icc/ r,
|
||||
@{att}/@{desktop_share_dirs}/icc/edid-@{hex32}.icc r,
|
||||
@{att}/@{user_share_dirs}/icc/ r,
|
||||
@{att}/@{user_share_dirs}/icc/edid-@{hex32}.icc r,
|
||||
|
||||
# Dbus can receive any user files
|
||||
@{HOME}/** r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw,
|
||||
@{run}/systemd/notify w,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
@{run}/systemd/users/@{int} r,
|
||||
|
||||
@{sys}/kernel/security/apparmor/.access rw,
|
||||
|
|
@ -77,8 +77,8 @@ profile dbus-system flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/oom_score_adj rw,
|
||||
|
||||
/dev/dri/card@{int} rw,
|
||||
/dev/input/event@{int} rw,
|
||||
@{att}/dev/dri/card@{int} rw,
|
||||
@{att}/dev/input/event@{int} rw,
|
||||
|
||||
include if exists <local/dbus-system>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -53,8 +53,6 @@ profile child-modprobe-nvidia flags=(attach_disconnected) {
|
|||
owner /dev/nvidia-caps/ w,
|
||||
owner /dev/nvidia-caps/nvidia-cap@{int} w,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
deny @{HOME}/.steam/** r,
|
||||
|
||||
profile kmod {
|
||||
|
|
|
|||
|
|
@ -49,8 +49,8 @@ profile colord @{exec_path} flags=(attach_disconnected) {
|
|||
owner /var/lib/snmp/mibs/{iana,ietf}/ r,
|
||||
owner /var/lib/snmp/mibs/{iana,ietf}/[A-Z]* r,
|
||||
|
||||
@{desktop_share_dirs}/icc/edid-*.icc r,
|
||||
@{user_share_dirs}/icc/edid-*.icc r,
|
||||
@{att}/@{desktop_share_dirs}/icc/edid-*.icc r,
|
||||
@{att}/@{user_share_dirs}/icc/edid-*.icc r,
|
||||
|
||||
@{run}/systemd/sessions/* r,
|
||||
|
||||
|
|
|
|||
|
|
@ -44,8 +44,9 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/etc/pipewire/{,**} r,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
/ r,
|
||||
@{att}/ r,
|
||||
owner @{att}/.flatpak-info r,
|
||||
|
||||
owner @{user_config_dirs}/pipewire/{,**} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -28,8 +28,8 @@ profile pipewire-pulse @{exec_path} flags=(attach_disconnected) {
|
|||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
@{att}/ r,
|
||||
owner @{att}/.flatpak-info r,
|
||||
|
||||
owner @{run}/user/@{uid}/pulse/pid w,
|
||||
owner @{tmp}/librnnoise-@{int}.so rm,
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ profile upowerd @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
|
||||
@{run}/udev/data/c116:@{int} r, # for ALSA
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{sys}/bus/hid/devices/ r,
|
||||
@{sys}/class/input/ r,
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/xdg-dbus-proxy
|
||||
profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
|
|
@ -16,7 +17,6 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/bus/org.freedesktop.Avahi>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
include <abstractions/bus/org.freedesktop.portal.Desktop>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network unix stream,
|
||||
|
|
@ -31,7 +31,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{HOME}/.var/app/*/.local/share/*/logs/* rw,
|
||||
owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw,
|
||||
owner @{run}/flatpak/doc/** r,
|
||||
owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw,
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app-open>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
|
|
@ -61,8 +62,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
|
|||
@{lib}/xdg-desktop-portal-validate-icon rPx,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
/ r,
|
||||
@{att}/.flatpak-info r,
|
||||
|
||||
/usr/share/dconf/profile/gdm r,
|
||||
/usr/share/xdg-desktop-portal/** r,
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/xdg-desktop-portal-gnome
|
||||
profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.a11y>
|
||||
|
|
@ -65,8 +66,6 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/task/@{tid}/ r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/status r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/xdg-desktop-portal-gnome>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/xdg-document-portal
|
||||
profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore>
|
||||
include <abstractions/deny-sensitive-home>
|
||||
|
|
@ -39,8 +40,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
|
|||
@{bin}/flatpak rPUx,
|
||||
@{bin}/fusermount{,3} rCx -> fusermount,
|
||||
|
||||
/ r,
|
||||
owner /.flatpak-info r,
|
||||
owner @{att}/ r,
|
||||
owner @{att}/.flatpak-info r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/*/{,**} rw,
|
||||
|
|
@ -57,7 +58,6 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/dev/fuse rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile fusermount flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
|
@ -83,7 +83,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
|
|||
@{PROC}/@{pids}/mounts r,
|
||||
|
||||
/dev/fuse rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
@{att}/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/xdg-document-portal_fusermount>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/xdg-permission-store
|
||||
profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
|
|
@ -45,8 +46,6 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_share_dirs}/flatpak/db/documents rw,
|
||||
owner @{user_share_dirs}/flatpak/db/notifications rw,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/xdg-permission-store>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/xkbcomp
|
||||
profile xkbcomp @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
|
|
@ -37,7 +38,6 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
|
|||
/dev/dri/card@{int} rw,
|
||||
/dev/fb@{int} rw,
|
||||
/dev/tty rw,
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
deny /dev/input/event@{int} rw,
|
||||
deny /var/log/Xorg.@{int}.log w,
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
@{att}/dev/tty@{int} rw,
|
||||
/dev/tty rw,
|
||||
|
||||
include if exists <local/xwayland>
|
||||
|
|
|
|||
|
|
@ -114,13 +114,13 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{run}/gdm{3,}/dbus/ w,
|
||||
owner @{run}/gdm{3,}/dbus/dbus-@{rand8} w,
|
||||
|
||||
@{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw,
|
||||
@{run}/cockpit/active.motd r,
|
||||
@{run}/faillock/@{user} rwk,
|
||||
@{run}/fscrypt/ rw,
|
||||
@{run}/fscrypt/@{uid}.count rwk,
|
||||
@{run}/motd.d/{,*} r,
|
||||
@{run}/systemd/sessions/* r,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
@{run}/utmp rwk,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,6 +14,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/gjs-console
|
||||
profile gjs-console @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.portal.Desktop>
|
||||
|
|
@ -85,7 +86,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/dev/ r,
|
||||
/dev/tty rw,
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gjs-console>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/gnome-keyring-daemon
|
||||
profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.login1.Session>
|
||||
|
|
|
|||
|
|
@ -48,7 +48,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_share_dirs}/grilo-plugins/ rwk,
|
||||
owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw,
|
||||
owner /var/tmp/etilqs_@{hex15} rw,
|
||||
|
|
|
|||
|
|
@ -79,9 +79,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_config_dirs}/gnome-session/ rw,
|
||||
owner @{user_config_dirs}/gnome-session/saved-session/ rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw,
|
||||
|
||||
@{run}/systemd/sessions/* r,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
owner @{run}/user/@{uid}/gnome-session-leader-fifo rw,
|
||||
owner @{run}/user/@{uid}/ICEauthority rw,
|
||||
|
|
@ -104,6 +105,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile open flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/desktop>
|
||||
|
||||
@{bin}/env rix,
|
||||
|
|
@ -119,7 +121,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
|||
/usr/games/** PUx,
|
||||
|
||||
/dev/tty rw,
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <usr/gnome-session-binary_open.d>
|
||||
include if exists <local/gnome-session-binary_open>
|
||||
|
|
|
|||
|
|
@ -207,8 +207,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
/usr/share/xml/iso-codes/{,**} r,
|
||||
@{system_share_dirs}/gnome-shell/{,**} r,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
/etc/fstab r,
|
||||
/etc/timezone r,
|
||||
/etc/tpm2-tss/*.json r,
|
||||
|
|
@ -220,6 +218,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
/var/lib/flatpak/app/**/gnome-shell/{,**} r,
|
||||
/var/lib/flatpak/appstream/**/icons/** r,
|
||||
|
||||
owner @{att}/ r,
|
||||
owner @{att}/.flatpak-info r,
|
||||
|
||||
owner @{GDM_HOME}/greeter-dconf-defaults r,
|
||||
owner @{gdm_cache_dirs}/ w,
|
||||
owner @{gdm_cache_dirs}/event-sound-cache.tdb.@{hex32}.@{multiarch} rwk,
|
||||
|
|
@ -293,11 +294,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{tmp}/@{rand6}.shell-extension.zip rw,
|
||||
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
@{run}/systemd/seats/seat@{int} r,
|
||||
@{run}/systemd/sessions/ r,
|
||||
@{run}/systemd/sessions/* r,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/udev/tags/seat/ r,
|
||||
|
||||
|
|
@ -365,9 +367,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
|
||||
/dev/input/event@{int} rw,
|
||||
/dev/media@{int} rw,
|
||||
/dev/tty@{int} rw,
|
||||
/dev/media@{int} rw,
|
||||
/dev/tty@{int} rw,
|
||||
@{att}/dev/dri/card@{int} rw,
|
||||
@{att}/dev/input/event@{int} rw,
|
||||
|
||||
profile shell flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
|
|
|
|||
|
|
@ -111,7 +111,7 @@ profile gnome-software @{exec_path} {
|
|||
owner /dev/shm/flatpak-com.*/ rw,
|
||||
owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/systemd/sessions/@{int} r,
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-a11y-settings
|
||||
profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
include <abstractions/dconf-write>
|
||||
|
|
@ -31,8 +32,6 @@ profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
|
|||
@{gdm_config_dirs}/dconf/user r,
|
||||
@{GDM_HOME}/greeter-dconf-defaults r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-a11y-settings>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-color
|
||||
profile gsd-color @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
|
|
@ -49,8 +50,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_share_dirs}/icc/ rw,
|
||||
owner @{user_share_dirs}/icc/edid-*.icc rw,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-color>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-datetime
|
||||
profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
include <abstractions/dconf-write>
|
||||
|
|
@ -49,8 +50,6 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/fdinfo/@{int} r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-datetime>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app-launcher-user>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
include <abstractions/bus/org.gtk.vfs.MountTracker>
|
||||
|
|
@ -46,8 +47,6 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pids}/cgroup r,
|
||||
owner @{PROC}/@{pids}/mountinfo r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-housekeeping>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-keyboard
|
||||
profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
|
|
@ -39,8 +40,6 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_config_dirs}/.gsd-keyboard.settings-ported* rw,
|
||||
owner @{user_share_dirs}/gnome-settings-daemon/{,input-sources*} rw,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-keyboard>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-media-keys
|
||||
profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
|
|
@ -72,7 +73,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_share_dirs}/recently-used.xbel{,.*} rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/udev/data/+sound:card@{int} r, # For sound card
|
||||
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
|
||||
|
|
@ -86,8 +87,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
|
|||
@{PROC}/1/cgroup r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-media-keys>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-power
|
||||
profile gsd-power @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
|
|
@ -60,7 +61,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/udev/data/+drm:card@{int}-* r, # For screen outputs
|
||||
@{run}/udev/data/+leds:* r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
|
|
@ -83,8 +84,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
|
|||
@{PROC}/sys/kernel/osrelease r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-power>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-print-notifications
|
||||
profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.Avahi>
|
||||
|
|
@ -38,8 +39,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-print-notifications>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-printer
|
||||
profile gsd-printer @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
|
|
@ -29,8 +30,6 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-printer>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-rfkill
|
||||
profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.hostname1>
|
||||
|
|
@ -33,8 +34,6 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
/dev/rfkill rw,
|
||||
|
||||
include if exists <local/gsd-rfkill>
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-screensaver-proxy
|
||||
profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
|
||||
|
|
@ -24,8 +25,6 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-screensaver-proxy>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-sharing
|
||||
profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
|
|
@ -44,8 +45,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
|
|||
@{PROC}/1/cgroup r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-sharing>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-smartcard
|
||||
profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
include <abstractions/dconf-write>
|
||||
|
|
@ -42,8 +43,6 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3{,.lock} rwk,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-smartcard>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-sound
|
||||
profile gsd-sound @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.gnome.SessionManager>
|
||||
|
|
@ -36,8 +37,6 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_share_dirs}/sounds/ rw,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-sound>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/gsd-wacom
|
||||
profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.a11y>
|
||||
|
|
@ -32,8 +33,6 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{gdm_config_dirs}/dconf/user r,
|
||||
owner @{GDM_HOME}/greeter-dconf-defaults r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gsd-wacom>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/mutter-x11-frames
|
||||
profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.a11y>
|
||||
|
|
@ -33,8 +34,6 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/mutter-x11-frames>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -45,7 +45,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted)
|
|||
owner @{user_config_dirs}/powermanagementprofilesrc.lock rwk,
|
||||
owner @{user_config_dirs}/powermanagementprofilesrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/**
|
||||
owner @{run}/user/@{uid}kcrash_@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -66,7 +66,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
|
||||
owner @{tmp}/@{rand6} rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
owner @{run}/user/@{uid}/KSMserver__[0-9] rw,
|
||||
|
||||
/dev/tty r,
|
||||
|
|
|
|||
|
|
@ -99,7 +99,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
|
|||
|
||||
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx
|
||||
@{run}/udev/data/n@{int} r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/usb/devices/ r,
|
||||
|
|
|
|||
|
|
@ -95,7 +95,8 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
|
|||
/usr/share/gvfs/remote-volume-monitors/{,*.monitor} r,
|
||||
/usr/share/iproute2/{,**} r,
|
||||
|
||||
/ r,
|
||||
@{att}/ r,
|
||||
|
||||
/etc/ r,
|
||||
/etc/iproute2/* r,
|
||||
/etc/machine-id r,
|
||||
|
|
@ -115,11 +116,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
|
|||
@{sys}/class/net/rfkill/ r,
|
||||
@{sys}/class/rfkill/ r,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/network/ifstate r,
|
||||
@{run}/NetworkManager/{,**} rw,
|
||||
@{run}/nm-*.pid rw,
|
||||
@{run}/nscd/db* rwl,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
@{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.)
|
||||
@{run}/udev/data/+platform:* r,
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
/dev/tty rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -97,12 +97,13 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r,
|
||||
owner @{user_cache_dirs}/{,motd*} rw,
|
||||
|
||||
@{att}/@{run}/systemd/sessions/@{int}.ref rw,
|
||||
|
||||
@{run}/faillock/@{user} rwk,
|
||||
@{run}/motd.d/{,*} r,
|
||||
@{run}/motd.dynamic rw,
|
||||
@{run}/motd.dynamic.new rw,
|
||||
@{run}/systemd/notify w,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
owner @{run}/sshd{,.init}.pid wl,
|
||||
|
||||
@{sys}/fs/cgroup/*/user/*/@{int}/ rw,
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ profile systemd-inhibit @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{bin}/cat rix,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
include if exists <local/systemd-inhibit>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -50,9 +50,9 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/etc/networkd-dispatcher/carrier.d/{,*} r,
|
||||
|
||||
/ r,
|
||||
@{att}/ r,
|
||||
|
||||
owner /var/lib/systemd/network/ r,
|
||||
owner @{att}/var/lib/systemd/network/ r,
|
||||
|
||||
@{run}/systemd/network/ r,
|
||||
@{run}/systemd/network/*.network r,
|
||||
|
|
|
|||
|
|
@ -71,7 +71,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_cache_dirs}/update-manager-core/{,**} rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
|
|
|||
|
|
@ -85,9 +85,9 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/etc/docker/{,**} r,
|
||||
|
||||
/ r,
|
||||
@{att}/ r,
|
||||
|
||||
owner @{lib}/containerd/** w,
|
||||
owner @{att}/@{lib}/containerd/** rw,
|
||||
owner @{lib}/docker/overlay2/*/work/{,**} rw,
|
||||
owner /var/lib/containerd/** rw,
|
||||
owner /var/lib/docker/{,**} rwk,
|
||||
|
|
|
|||
|
|
@ -153,11 +153,12 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
|
|||
@{user_vm_dirs}/{,**} rwk,
|
||||
@{user_publicshare_dirs}/{,**} rwk,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/libvirt/ rw,
|
||||
@{run}/libvirt/** rwk,
|
||||
@{run}/libvirtd.pid wk,
|
||||
@{run}/lock/LCK.._pts_@{int} rw,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/systemd/notify w,
|
||||
@{run}/utmp rk,
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ profile virtinterfaced @{exec_path} flags=(attach_disconnected) {
|
|||
@{lib}/gconv/gconv-modules rm,
|
||||
@{lib}/gconv/gconv-modules.d/{,*} r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
owner @{run}/user/@{uid}/libvirt/common/system.token rwk,
|
||||
owner @{run}/user/@{uid}/libvirt/interface/ rw,
|
||||
owner @{run}/user/@{uid}/libvirt/interface/run/{,*} rwk,
|
||||
|
|
|
|||
|
|
@ -28,9 +28,10 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{run}/user/@{uid}/libvirt/virtlogd.pid rwk,
|
||||
owner @{run}/user/@{uid}/libvirt/virtlogd* w,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/libvirt/common/system.token rwk,
|
||||
@{run}/libvirt/virtlogd-sock rw,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/virtlogd.pid rwk,
|
||||
|
||||
@{sys}/devices/system/node/ r,
|
||||
|
|
|
|||
|
|
@ -24,8 +24,9 @@ profile virtnetworkd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner /var/lib/libvirt/dnsmasq/*.macs* rw,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/libvirt/network/default.pid r,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/utmp rk,
|
||||
owner @{run}/libvirt/common/system.token rwk,
|
||||
owner @{run}/libvirt/network/{,**} rwk,
|
||||
|
|
|
|||
|
|
@ -32,7 +32,8 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
|
|||
/etc/libvirt/*.conf r,
|
||||
/etc/mdevctl.d/{,**} r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
owner @{run}/libvirt/common/system.token rwk,
|
||||
owner @{run}/libvirt/nodedev/ rw,
|
||||
owner @{run}/libvirt/nodedev/driver.pid wk,
|
||||
|
|
|
|||
|
|
@ -20,7 +20,8 @@ profile virtsecretd @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_config_dirs}/libvirt/secrets/ rw,
|
||||
owner @{user_config_dirs}/libvirt/secrets/run/{,*} rwk,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
owner @{run}/user/@{uid}/libvirt/common/system.token rwk,
|
||||
owner @{run}/user/@{uid}/libvirt/secrets/ rw,
|
||||
owner @{run}/user/@{uid}/libvirt/secrets/run/{,*} rwk,
|
||||
|
|
|
|||
|
|
@ -54,7 +54,8 @@ profile virtstoraged @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{run}/libvirt/storage/{,**} rwk,
|
||||
owner @{run}/virtstoraged.pid rwk,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/utmp rwk,
|
||||
|
||||
@{sys}/devices/system/node/ r,
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ profile xfce-power-manager @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
include if exists <local/xfce-power-manager>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ profile xfce-screensaver @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/etc/xdg/menus/xfce4-screensavers.menu r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
include if exists <local/xfce-screensaver>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -31,8 +31,8 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/var/lib/flatpak/exports/share/mime/mime.cache r,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
owner @{att}/ r,
|
||||
owner @{att}/.flatpak-info r,
|
||||
|
||||
owner @{HOME}/.var/app/*/**/.ref rw,
|
||||
owner @{HOME}/.var/app/*/**/logs/* rw,
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ profile foliate @{exec_path} flags=(attach_disconnected) {
|
|||
/usr/share/com.github.johnfactotum.Foliate/{,**} r,
|
||||
|
||||
owner /bindfile@{rand6} rw,
|
||||
owner /.flatpak-info r,
|
||||
owner @{att}/.flatpak-info r,
|
||||
|
||||
owner @{user_books_dirs}/{,**} r,
|
||||
owner @{user_torrents_dirs}/{,**} r,
|
||||
|
|
|
|||
|
|
@ -27,8 +27,9 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/var/lib/fprint/{,**} rw,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/systemd/journal/socket rw,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
|
||||
|
||||
@{sys}/class/hidraw/ r,
|
||||
|
|
|
|||
|
|
@ -94,11 +94,12 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) {
|
|||
@{sys}/kernel/security/tpm[0-9]/binary_bios_measurements r,
|
||||
@{sys}/power/mem_sleep r,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/motd.d/ r,
|
||||
@{run}/motd.d/@{int}-fwupd* rw,
|
||||
@{run}/motd.d/fwupd/{,**} rw,
|
||||
@{run}/mount/utab r,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/udev/data/* r,
|
||||
|
||||
@{PROC}/@{pids}/fd/ r,
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/etc/machine-id r,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/utmp r,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ profile mission-control @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk,
|
||||
owner @{user_cache_dirs}/.mc_connections rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
include if exists <local/mission-control>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -23,7 +23,8 @@ profile nvtop @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_config_dirs}/nvtop/{,**} rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/udev/data/+drm:card@{int}-* r, # for screen outputs
|
||||
@{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.)
|
||||
@{run}/udev/data/c226:@{int} r, # For /dev/dri/card*
|
||||
|
|
|
|||
|
|
@ -94,7 +94,8 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{tmp}/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw,
|
||||
owner @{tmp}/packagekit* rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
owner @{run}/systemd/users/@{uid} r,
|
||||
|
||||
#aa:only opensuse
|
||||
|
|
|
|||
|
|
@ -57,7 +57,7 @@ profile psi @{exec_path} {
|
|||
owner @{tmp}/etilqs_@{hex16} rw,
|
||||
owner @{tmp}/Psi.* rwl -> /tmp/#@{int},
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
|
|
|||
|
|
@ -57,7 +57,7 @@ profile psi-plus @{exec_path} {
|
|||
owner @{tmp}/etilqs_@{hex16} rw,
|
||||
owner @{tmp}/Psi+.* rwl -> /tmp/#@{int},
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ profile signal-desktop @{exec_path} {
|
|||
audit @{lib_dirs}/chrome-sandbox rPx,
|
||||
@{lib_dirs}/chrome_crashpad_handler rix,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{sys}/fs/cgroup/user.slice/cpu.max r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/spice-vdagent
|
||||
profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/audio-server>
|
||||
include <abstractions/bus-accessibility>
|
||||
|
|
@ -46,8 +47,6 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{PROC}/@{pids}/task/@{tid}/comm rw,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/spice-vdagent>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -174,12 +174,12 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{tmp}/steam@{rand6}/{,**} rw,
|
||||
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,
|
||||
|
||||
owner @{att}/dev/shm/ValveIPCSHM_@{uid} rw,
|
||||
owner /dev/shm/fossilize-*-@{int}-@{int} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex8} rw,
|
||||
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
|
||||
owner /dev/shm/ValveIPCSHM_@{uid} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) {
|
|||
@{bin}/speech-dispatcher rPx,
|
||||
@{open_path} rPx -> child-open-strict,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
include if exists <local/superproductivity>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -104,11 +104,12 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
|
|||
@{MOUNTS}/ rw,
|
||||
@{MOUNTS}/*/ rw,
|
||||
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
|
||||
@{run}/ r,
|
||||
@{run}/mount/utab{,.*} rwk,
|
||||
@{run}/udisks2/{,**} rw,
|
||||
@{run}/systemd/seats/seat@{int} r,
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/cryptsetup/ r,
|
||||
@{run}/cryptsetup/L* rwk,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ profile uname @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
@{att}/dev/tty@{int} rw,
|
||||
|
||||
deny network,
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
|
|
|||
|
|
@ -46,7 +46,7 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{HOME}/.xwechat/{,**} rwk,
|
||||
owner @{HOME}/.sys1og.conf rw,
|
||||
|
||||
@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||
@{run}/utmp r,
|
||||
|
||||
@{PROC}/@{pid}/net/route r,
|
||||
|
|
|
|||
|
|
@ -9,14 +9,13 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/xbrlapi
|
||||
profile xbrlapi @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/xbrlapi>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -151,7 +151,6 @@
|
|||
@{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254
|
||||
@{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511
|
||||
|
||||
#aa:only abi3
|
||||
# Attachment path for attach_disconnected.path flag.
|
||||
# Automatically generated and set in profile preamble on ABI4. Disabled on ABI3.
|
||||
@{att}=/
|
||||
|
|
|
|||
Loading…
Reference in a new issue