mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): Cleanup udev rules.

Browse source
This commit is contained in:
Alexandre Pujol 2023-01-19 18:51:16 +00:00
parent 43606814cc
commit 64ad329dd9
Failed to generate hash of commit
21 changed files with 84 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/abstractions/devices-usb
View file

@ -20,8 +20,8 @@
# Udev data about usb devices (~equal to content of lsusb -v)
@{run}/udev/data/+usb:* r,
@{run}/udev/data/c16[6,7]* r,
@{run}/udev/data/c18[0,8,9]* r,
@{run}/udev/data/c16[6,7]:[0-9]* r, # USB modems
@{run}/udev/data/c18[0,8,9]:[0-9]* r, # USB devices & USB serial converters
@{run}/udev/data/c8[0-9]:[0-9]* r,
include if exists <abstractions/devices-usb.d>

2
apparmor.d/abstractions/gstreamer
View file

@ -18,7 +18,7 @@
#
@{run}/udev/data/c81:[0-9]* r, # For video4linux
@{run}/udev/data/c189:[0-9]* r, # For /dev/bus/usb/**
@{run}/udev/data/c189:[0-9]* r, # For USB serial converters
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card[0-9]*
@{run}/udev/data/+drm:* r, # For screen outputs
#@{run}/udev/data/+pci:* r,

5
apparmor.d/groups/freedesktop/pipewire
View file

@ -61,8 +61,9 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/pipewire-[0-9]*.lock rwk,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{run}/udev/data/c81:[0-9]* r, # For video4linux
@{sys}/bus/ r,

4
apparmor.d/groups/freedesktop/plymouthd
View file

@ -36,8 +36,8 @@ profile plymouthd @{exec_path} {
@{run}/plymouth/{,**} rw,
@{run}/udev/data/+drm:* r,
@{run}/udev/data/c226:* r,
@{run}/udev/data/c29:* r,
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card[0-9]*
@{run}/udev/data/c29:* r, # For /dev/fb[0-9]*
@{sys}/bus/ r,
@{sys}/class/ r,

4
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -151,8 +151,8 @@ profile pulseaudio @{exec_path} {
@{run}/systemd/users/@{uid} r,
@{run}/udev/data/+sound* r,
@{run}/udev/data/c116:[0-9]* r, # For ALSA
@{run}/udev/data/+sound:card[0-9]* r, # For sound
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{sys}/class/sound/ r,
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,

2
apparmor.d/groups/freedesktop/xorg
View file

@ -124,7 +124,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/+serio* r, # for touchpad?
@{run}/udev/data/c4:[0-9]* r, # for /dev/tty[0-9]*
@{run}/udev/data/c5:[0-9]* r, # for /dev/tty, /dev/console, /dev/ptmx
@{run}/udev/data/c10:[0-9]* r,
@{run}/udev/data/c10:[0-9]* r, # for non-serial mice, misc features
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
@{run}/udev/data/c226:[0-9]* r, # for /dev/dri/card*

13
apparmor.d/groups/gnome/gnome-control-center
View file

@ -151,12 +151,15 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/users/@{uid} r,
@{run}/udev/data/+dmi:* r,
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+pci* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{run}/udev/data/c3[0-9]*:[0-9]* r, # For dynamic assignment range 384 to 511
@{run}/udev/data/c4[0-9]*:[0-9]* r,
@{run}/udev/data/c5[0-9]*:[0-9]* r,
@{run}/udev/data/n[0-9]* r,
@{sys}/bus/ r,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -604,7 +604,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/+usb* r, # for USB mouse and keyboard
@{run}/udev/data/+i2c:* r,
@{run}/udev/data/+hid* r, # for HID-Compliant Keyboard
@{run}/udev/data/c10:[0-9]* r,
@{run}/udev/data/c10:[0-9]* r, # for non-serial mice, misc features
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
@{run}/udev/data/c226:[0-9]* r, # for /dev/dri/card*

6
apparmor.d/groups/gnome/tracker-extract
View file

@ -102,9 +102,9 @@ profile tracker-extract @{exec_path} {
@{run}/blkid/blkid.tab r,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{run}/mount/utab r,
owner @{PROC}/@{pid}/fd/ r,

7
apparmor.d/groups/network/ModemManager
View file

@ -52,9 +52,10 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/+pci:* r,
@{run}/udev/data/+platform* r,
@{run}/udev/data/+usb:* r,
@{run}/udev/data/c189:[0-9]* r,
@{run}/udev/data/c4:[0-9]* r, # for /dev/tty[0-9]*
@{run}/udev/data/c5:[0-9]* r, # for /dev/tty, /dev/console, /dev/ptmx
@{run}/udev/data/c16[6,7]:[0-9]* r, # USB modems
@{run}/udev/data/c18[0,8,9]:[0-9]* r, # USB devices & USB serial converters
@{run}/udev/data/c4:[0-9]* r, # for /dev/tty[0-9]*
@{run}/udev/data/c5:[0-9]* r, # for /dev/tty, /dev/console, /dev/ptmx
@{run}/udev/data/n[0-9]* r,
@{run}/systemd/inhibit/*.ref rw,

15
apparmor.d/groups/systemd/systemd-journald
View file

@ -47,13 +47,16 @@ profile systemd-journald @{exec_path} {
@{run}/udev/data/+usb-serial:* r,
@{run}/udev/data/+usb:* r,
@{run}/udev/data/+virtio:* r,
@{run}/udev/data/c1:[0-9]* r,
@{run}/udev/data/c10:[0-9]* r, # for /dev/tpm0
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c1:[0-9]* r, # For RAM disk
@{run}/udev/data/c4:[0-9]* r, # For TTY devices
@{run}/udev/data/c10:[0-9]* r, # For non-serial mice, misc features
@{run}/udev/data/c18[8-9]:[0-9]* r, # USB devices & USB serial converters
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c4:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{run}/udev/data/c3[0-9]*:[0-9]* r, # For dynamic assignment range 384 to 511
@{run}/udev/data/c4[0-9]*:[0-9]* r,
@{run}/udev/data/c5[0-9]*:[0-9]* r,
@{sys}/devices/**/uevent r,
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,

26
apparmor.d/groups/systemd/systemd-logind
View file

@ -82,20 +82,22 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
@{run}/udev/static_node-tags/uaccess/ r,
@{run}/udev/data/+backlight:* r,
@{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+drm:card[0-9]-* r, # For screen outputs
@{run}/udev/data/+input* r, # For mouse, keyboard, touchpad
@{run}/udev/data/+pci* r,
@{run}/udev/data/c10:[0-9]* r,
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c14:[0-9]* r,
@{run}/udev/data/c21:[0-9]* r,
@{run}/udev/data/c226:[0-9]* r, # for /dev/dri/card*
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c10:[0-9]* r, # For non-serial mice, misc features
@{run}/udev/data/c13:[0-9]* r, # For /dev/input/*
@{run}/udev/data/c14:[0-9]* r, # Open Sound System (OSS)
@{run}/udev/data/c21:[0-9]* r, # Generic SCSI access
@{run}/udev/data/c29:[0-9]* r, # For /dev/fb[0-9]*
@{run}/udev/data/c116:[0-9]* r, # For ALSA
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card*
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c29:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{run}/udev/data/c3[0-9]*:[0-9]* r, # For dynamic assignment range 384 to 511
@{run}/udev/data/c4[0-9]*:[0-9]* r,
@{run}/udev/data/c5[0-9]*:[0-9]* r,
@{run}/systemd/inhibit/ rw,
@{run}/systemd/inhibit/.#* rw,

4
apparmor.d/profiles-a-f/fprintd
View file

@ -41,7 +41,9 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/journal/socket rw,
@{run}/systemd/inhibit/*.ref w,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{sys}/class/hidraw/ r,

2
apparmor.d/profiles-a-f/fritzing
View file

@ -59,8 +59,8 @@ profile fritzing @{exec_path} {
@{sys}/devices/**/tty*/uevent r,
@{sys}/devices/**/tty/**/uevent r,
@{run}/udev/data/c5:[0-9]* r, # for /dev/tty, /dev/console, /dev/ptmx
@{run}/udev/data/c4:[0-9]* r, # for /dev/tty[0-9]*
@{run}/udev/data/c5:[0-9]* r, # for /dev/tty, /dev/console, /dev/ptmx
@{run}/udev/data/c166:[0-9]* r, # for /dev/ttyACM[0-9]*
/dev/ttyS[0-9]* rw,

8
apparmor.d/profiles-g-l/gzdoom
View file

@ -87,9 +87,11 @@ profile gzdoom @{exec_path} {
@{run}/udev/data/+sound:* r,
@{run}/udev/data/+input:* r,
@{run}/udev/data/c13:[0-9]* r, # For /dev/input/*
@{run}/udev/data/c116:[0-9]* r, # For ALSA
@{run}/udev/data/c240:[0-9]* r, # For USB HID
@{run}/udev/data/c13:[0-9]* r, # For /dev/input/*
@{run}/udev/data/c116:[0-9]* r, # For ALSA
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
include if exists <local/gzdoom>
}

6
apparmor.d/profiles-m-r/nvtop
View file

@ -28,8 +28,10 @@ profile nvtop @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/inhibit/*.ref r,
@{run}/udev/data/+drm:* r,
@{run}/udev/data/+pci* r,
@{run}/udev/data/c226:[0-9]* r,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card*
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{sys}/bus/ r,
@{sys}/class/ r,

2
apparmor.d/profiles-m-r/obexautofs
View file

@ -34,7 +34,7 @@ profile obexautofs @{exec_path} {
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{uevent,busnum,devnum,speed,descriptors} r,
@{run}/udev/data/+usb:* r,
@{run}/udev/data/c189:* r, # for /dev/bus/usb/**
@{run}/udev/data/c18[0,8,9]:[0-9]* r, # USB devices & USB serial converters
/dev/bus/usb/ r,
/dev/fuse rw,

8
apparmor.d/profiles-s-z/steam
View file

@ -152,13 +152,15 @@ profile steam @{exec_path} {
owner /tmp/sh-thd.* rw,
owner /tmp/steam_chrome_shmem_uid@{uid}_spid[0-9]* rw,
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+sound* r,
@{run}/udev/data/+pci* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{run}/udev/data/n[0-9]* r,
@{sys}/ r,

10
apparmor.d/profiles-s-z/steam-game
View file

@ -185,12 +185,14 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
owner /tmp/miles_image_* mr,
owner /tmp/pressure-vessel-*/{,**} rwl,
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+sound* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c241:[0-9]* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{sys}/ r,
@{sys}/bus/ r,

7
apparmor.d/profiles-s-z/virt-manager
View file

@ -87,8 +87,11 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/libvirt/libvirtd.lock rwk,
owner @{run}/user/@{uid}/wayland-cursor-shared-* rw,
@{run}/mount/utab r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/mount/utab r,
@{run}/udev/data/c3[0-9]*:[0-9]* r, # For dynamic assignment range 384 to 511
@{run}/udev/data/c4[0-9]*:[0-9]* r,
@{run}/udev/data/c5[0-9]*:[0-9]* r,
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/virtual/drm/ttm/uevent r,

7
apparmor.d/profiles-s-z/wireplumber
View file

@ -36,9 +36,10 @@ profile wireplumber @{exec_path} {
@{run}/udev/data/+sound:card[0-9]* r, # For sound
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c14:[0-9]* r,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c14:[0-9]* r, # Open Sound System (OSS)
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/c25[0-4]:[0-9]* r,
@{run}/udev/data/c81:[0-9]* r, # For video4linux
@{sys}/bus/ r,