mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-20 08:55:34 +01:00
feat(profile): modernise some profiles.
This commit is contained in:
Alexandre Pujol
parent
40abc98201
commit
683bfed4ad
15 changed files with 197 additions and 631 deletions
|
|
@ -20,17 +20,12 @@ profile calibre @{exec_path} {
|
|||
include <abstractions/bus/org.a11y>
|
||||
include <abstractions/bus/org.gtk.vfs.MountTracker>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/nvidia>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/python>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
|
|
@ -66,7 +61,6 @@ profile calibre @{exec_path} {
|
|||
@{bin}/xdg-mime rPx,
|
||||
|
||||
/usr/share/calibre/{,**} r,
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/inputrc r,
|
||||
|
|
|
|||
|
|
@ -10,20 +10,15 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/flameshot
|
||||
profile flameshot @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/X>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -36,58 +31,24 @@ profile flameshot @{exec_path} {
|
|||
|
||||
@{bin}/whoami rix,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
|
||||
# Flameshot home files
|
||||
owner @{user_config_dirs}/flameshot/ rw,
|
||||
owner @{user_config_dirs}/flameshot/flameshot.ini rw,
|
||||
owner @{user_config_dirs}/flameshot/#@{int} rw,
|
||||
owner @{user_config_dirs}/flameshot/flameshot.ini* rwl -> @{user_config_dirs}/flameshot/#@{int},
|
||||
owner @{user_config_dirs}/flameshot/flameshot.ini.lock rwk,
|
||||
@{open_path} rPx -> child-open-help,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner @{user_config_dirs}/flameshot/ rw,
|
||||
owner @{user_config_dirs}/flameshot/** rwlk -> @{user_config_dirs}/flameshot/**,
|
||||
|
||||
owner @{tmp}/.*/{,s} rw,
|
||||
owner @{tmp}/*= rw,
|
||||
owner @{tmp}/qipc_{systemsem,sharedmemory}_*@{hex} rw,
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/flameshot>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,28 +7,19 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{TELEGRAM_WORK_DIR} = @{MOUNTS}/Kabi/telegram
|
||||
|
||||
@{exec_path} = @{bin}/telegram-desktop
|
||||
profile telegram-desktop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/common/electron>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -41,80 +32,26 @@ profile telegram-desktop @{exec_path} {
|
|||
|
||||
@{sh_path} rix,
|
||||
|
||||
# Launch external apps
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
# What's this for?
|
||||
deny @{bin}/fc-list rx,
|
||||
|
||||
# Telegram files
|
||||
/usr/share/TelegramDesktop/{,**} r,
|
||||
|
||||
# Download dir
|
||||
owner @{TELEGRAM_WORK_DIR}/ rw,
|
||||
owner @{TELEGRAM_WORK_DIR}/** rwkl -> @{TELEGRAM_WORK_DIR}/#@{int},
|
||||
|
||||
# Telegram's profile (via telegram -many -workdir ~/some/dir/)
|
||||
#owner @{TELEGRAM_WORK_DIR}/{,**} rw,
|
||||
|
||||
# Autostart
|
||||
owner @{user_config_dirs}/autostart/telegramdesktop.desktop rw,
|
||||
|
||||
owner @{tmp}/@{hex}-* rwk,
|
||||
owner @{run}/user/@{uid}/@{hex}-* rwk,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner @{user_config_dirs}/autostart/telegramdesktop.desktop rw,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/smplayer rPx,
|
||||
@{bin}/viewnior rPUx,
|
||||
@{bin}/qpdfview rPx,
|
||||
@{bin}/geany rPx,
|
||||
owner @{tmp}/@{hex}-* rwk,
|
||||
owner @{run}/user/@{uid}/@{hex}-* rwk,
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{TELEGRAM_WORK_DIR}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/smplayer rPx,
|
||||
@{bin}/qpdfview rPx,
|
||||
@{bin}/viewnior rPUx,
|
||||
@{bin}/geany rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/telegram-desktop>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,16 +10,11 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/birdtray
|
||||
profile birdtray @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/X>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
|
|
@ -28,20 +23,13 @@ profile birdtray @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
# To be able to start Thunderbird
|
||||
@{bin}/thunderbird rPx,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{bin}/thunderbird rPx,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/usr/share/ulduzsoft/birdtray/{,**} r,
|
||||
|
||||
owner @{user_config_dirs}/ulduzsoft/ rw,
|
||||
owner @{user_config_dirs}/ulduzsoft/* rwkl -> /home/morfik/.config/ulduzsoft/*,
|
||||
|
||||
owner @{user_config_dirs}/birdtray-config.json rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/birdtray-config.json.* rwl -> @{user_config_dirs}/#@{int},
|
||||
|
||||
owner @{tmp}/birdtray.ulduzsoft.single.instance.server.socket w,
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# Thunderbird mail dirs
|
||||
owner @{HOME}/ r,
|
||||
|
|
@ -51,47 +39,22 @@ profile birdtray @{exec_path} {
|
|||
owner @{HOME}/.thunderbird/*.*/{Imap,}Mail/**/ r,
|
||||
owner @{HOME}/.thunderbird/*.*/{Imap,}Mail/**/*.msf r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner @{user_config_dirs}/ulduzsoft/ rw,
|
||||
owner @{user_config_dirs}/ulduzsoft/* rwkl -> /home/morfik/.config/ulduzsoft/*,
|
||||
|
||||
owner @{user_config_dirs}/birdtray-config.json rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/birdtray-config.json.* rwl -> @{user_config_dirs}/#@{int},
|
||||
|
||||
owner @{tmp}/birdtray.ulduzsoft.single.instance.server.socket w,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/qpdfview_open>
|
||||
}
|
||||
|
||||
include if exists <local/birdtray>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -42,8 +42,6 @@ profile keepassxc @{exec_path} {
|
|||
/usr/share/keepassxc/{,**} r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json rw,
|
||||
|
|
|
|||
|
|
@ -11,19 +11,14 @@ include <tunables/global>
|
|||
profile megasync @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/X>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -40,71 +35,29 @@ profile megasync @{exec_path} {
|
|||
@{bin}/xrdb rPx,
|
||||
@{bin}/xdg-mime rPx,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
|
||||
# Megasync home files
|
||||
owner @{HOME}/ r,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/" rw,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/**" rwkl -> "@{user_share_dirs}/data/Mega Limited/MEGAsync/#@{int}",
|
||||
|
||||
owner @{user_config_dirs}/QtProject.conf r,
|
||||
|
||||
# Sync folder
|
||||
owner @{user_sync_dirs}/ r,
|
||||
owner @{user_sync_dirs}/** rwl -> @{user_sync_dirs}/**,
|
||||
|
||||
# Proc filesystem
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# Autostart
|
||||
owner @{user_config_dirs}/autostart/#@{int} rw,
|
||||
owner @{user_config_dirs}/autostart/megasync.desktop rwl -> @{user_config_dirs}/autostart/#@{int},
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner @{HOME}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/spacefm rPx,
|
||||
owner @{user_config_dirs}/autostart/#@{int} rw,
|
||||
owner @{user_config_dirs}/autostart/megasync.desktop rwl -> @{user_config_dirs}/autostart/#@{int},
|
||||
|
||||
# file_inherit
|
||||
owner "@{user_share_dirs}/data/Mega Limited/" rw,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/**" rwkl -> "@{user_share_dirs}/data/Mega Limited/MEGAsync/#@{int}",
|
||||
|
||||
owner @{user_sync_dirs}/ r,
|
||||
owner @{user_sync_dirs}/** rwl -> @{user_sync_dirs}/**,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/MEGAsync/" r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/spacefm rPx,
|
||||
|
||||
# file_inherit
|
||||
owner "@{user_share_dirs}/data/Mega Limited/MEGAsync/logs/MEGAsync.log" rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/megasync>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,18 +10,14 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/minitube
|
||||
profile minitube @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
|
|
@ -34,18 +30,33 @@ profile minitube @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
# Minitube home files
|
||||
# Be able to turn off the screensaver while playing movies
|
||||
@{bin}/xdg-screensaver rCx -> xdg-screensaver,
|
||||
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/usr/share/minitube/{,**} r,
|
||||
|
||||
/etc/vdpau_wrapper.cfg r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner @{HOME}/vlcsnap-.png rw,
|
||||
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/**" rwl -> "@{user_cache_dirs}/Flavio Tordini/Minitube/**",
|
||||
|
||||
owner "@{user_config_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_config_dirs}/Flavio Tordini/*" rwkl -> "@{user_config_dirs}/Flavio Tordini/#@{int}",
|
||||
owner "@{user_share_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_share_dirs}/Flavio Tordini/Minitube/" rw,
|
||||
owner "@{user_share_dirs}/Flavio Tordini/Minitube/*" rwk,
|
||||
|
||||
# Snapshot
|
||||
owner @{user_pictures_dirs}/*.png rw,
|
||||
owner @{HOME}/vlcsnap-.png rw,
|
||||
|
||||
/usr/share/minitube/{,**} r,
|
||||
owner @{tmp}/qtsingleapp-minitu-* rw,
|
||||
owner @{tmp}/qtsingleapp-minitu-*-lockfile rwk,
|
||||
|
||||
# If one is blocked, the others are probed.
|
||||
deny owner @{HOME}/#@{int} mrw,
|
||||
|
|
@ -53,65 +64,13 @@ profile minitube @{exec_path} {
|
|||
# owner @{tmp}/#@{int} mrw,
|
||||
# owner @{tmp}/.glvnd* mrw,
|
||||
|
||||
# Cache
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/**" rwl -> "@{user_cache_dirs}/Flavio Tordini/Minitube/**",
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
deny /dev/ r,
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
/etc/vdpau_wrapper.cfg r,
|
||||
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
# TMP
|
||||
owner @{tmp}/qtsingleapp-minitu-* rw,
|
||||
owner @{tmp}/qtsingleapp-minitu-*-lockfile rwk,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
|
||||
# Be able to turn off the screensaver while playing movies
|
||||
@{bin}/xdg-screensaver rCx -> xdg-screensaver,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
|
||||
# file_inherit
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
profile xdg-screensaver {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
|
@ -133,6 +92,8 @@ profile minitube @{exec_path} {
|
|||
/dev/dri/card@{int} rw,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
include if exists <local/minitube_xdg-screensaver>
|
||||
}
|
||||
|
||||
include if exists <local/minitube>
|
||||
|
|
|
|||
|
|
@ -11,21 +11,16 @@ include <tunables/global>
|
|||
profile psi @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -38,12 +33,11 @@ profile psi @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
@{bin}/aplay rCx -> aplay,
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
@{bin}/gpg{,2} rPx,
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{open_path} rPx -> child-open,
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/psi/{,**} r,
|
||||
|
||||
/etc/debian_version r,
|
||||
|
|
@ -51,8 +45,6 @@ profile psi @{exec_path} {
|
|||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/#@{int} rw,
|
||||
|
|
@ -64,18 +56,17 @@ profile psi @{exec_path} {
|
|||
owner @{user_share_dirs}/psi/** rwk,
|
||||
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/etilqs_@{hex} rw,
|
||||
owner @{tmp}/Psi.* rwl -> /tmp/#@{int},
|
||||
|
||||
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
# file_inherit
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile aplay {
|
||||
|
|
@ -95,42 +86,7 @@ profile psi @{exec_path} {
|
|||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/gpg{,2} mr,
|
||||
|
||||
owner @{HOME}/.gnupg/ rw,
|
||||
owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**,
|
||||
|
||||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/psi_aplay>
|
||||
}
|
||||
|
||||
include if exists <local/psi>
|
||||
|
|
|
|||
|
|
@ -11,21 +11,16 @@ include <tunables/global>
|
|||
profile psi-plus @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -38,12 +33,11 @@ profile psi-plus @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
@{bin}/aplay rCx -> aplay,
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
@{bin}/gpg{,2} rPx,
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{open_path} rPx -> child-open,
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/psi-plus/{,**} r,
|
||||
|
||||
/etc/debian_version r,
|
||||
|
|
@ -62,19 +56,17 @@ profile psi-plus @{exec_path} {
|
|||
owner @{user_share_dirs}/psi+/** rwk,
|
||||
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/etilqs_@{hex} rw,
|
||||
owner @{tmp}/Psi+.* rwl -> /tmp/#@{int},
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
# file_inherit
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile aplay {
|
||||
|
|
@ -94,42 +86,7 @@ profile psi-plus @{exec_path} {
|
|||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/gpg{,2} mr,
|
||||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/psi-plus_aplay>
|
||||
}
|
||||
|
||||
include if exists <local/psi-plus>
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qbittorrent-nox
|
||||
profile qbittorrent-nox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freeedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
|
|
@ -22,48 +23,37 @@ profile qbittorrent-nox @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
# Qbittorrent home dirs
|
||||
owner @{user_config_dirs}/qBittorrent/ rw,
|
||||
owner @{user_config_dirs}/qBittorrent/** rwkl -> @{user_config_dirs}/qBittorrent/#@{int},
|
||||
owner @{user_share_dirs}/qBittorrent/ rw,
|
||||
owner @{user_share_dirs}/qBittorrent/** rwl -> @{user_share_dirs}/data/qBittorrent/**/#@{int},
|
||||
# Old dir, not recommended to use:
|
||||
deny owner @{user_share_dirs}/data/qBittorrent/ rw,
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{user_torrents_dirs}/ r,
|
||||
owner @{user_torrents_dirs}/** rw,
|
||||
|
||||
# Cache dir
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/#@{int} rw,
|
||||
owner @{user_cache_dirs}/qBittorrent/{,**} rw,
|
||||
|
||||
# Torrent files
|
||||
owner @{user_torrents_dirs}/ r,
|
||||
owner @{user_torrents_dirs}/** rw,
|
||||
owner @{user_config_dirs}/qBittorrent/ rw,
|
||||
owner @{user_config_dirs}/qBittorrent/** rwkl -> @{user_config_dirs}/qBittorrent/#@{int},
|
||||
owner @{user_share_dirs}/qBittorrent/ rw,
|
||||
owner @{user_share_dirs}/qBittorrent/** rwl -> @{user_share_dirs}/data/qBittorrent/**/#@{int},
|
||||
|
||||
/dev/disk/by-label/ r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/mime/mime.cache r,
|
||||
/usr/share/mime/types r,
|
||||
owner @{user_share_dirs}/mime/mime.cache r,
|
||||
owner @{user_share_dirs}/mime/types r,
|
||||
|
||||
# TMP
|
||||
owner @{tmp}/qtsingleapp-qBitto-* rw,
|
||||
owner @{tmp}/qtsingleapp-qBitto-*-lockfile rwk,
|
||||
owner @{tmp}/.*/{,s} rw,
|
||||
owner @{tmp}/.qBittorrent/ rw,
|
||||
owner @{tmp}/.qBittorrent/* rwl -> /tmp/.qBittorrent/*,
|
||||
owner @{tmp}/mozilla_*/*.torrent rw,
|
||||
owner @{tmp}/*.torrent rw,
|
||||
owner @{tmp}/.*/{,s} rw,
|
||||
owner @{tmp}/mozilla_*/*.torrent rw,
|
||||
owner @{tmp}/qtsingleapp-qBitto-* rw,
|
||||
owner @{tmp}/qtsingleapp-qBitto-*-lockfile rwk,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/disk/by-label/ r,
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
deny owner @{user_share_dirs}/data/qBittorrent/ rw, # Old dir, not recommended to use
|
||||
|
||||
include if exists <local/qbittorrent-nox>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,18 +10,13 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qnapi
|
||||
profile qnapi @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -39,12 +34,10 @@ profile qnapi @{exec_path} {
|
|||
@{bin}/7z rix,
|
||||
@{lib}/p7zip/7z rix,
|
||||
|
||||
@{bin}/ffprobe rPx,
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{bin}/ffprobe rPx,
|
||||
@{open_path} rPx -> child-open,
|
||||
@{lib}/firefox/firefox rPx,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
|
@ -60,8 +53,6 @@ profile qnapi @{exec_path} {
|
|||
owner @{user_config_dirs}/qnapi.ini.* rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/qnapi.ini.mlXXXY rwl -> @{user_config_dirs}/#@{int},
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
|
||||
/tmp/ r,
|
||||
owner @{tmp}/@{hex}.* rw,
|
||||
owner @{tmp}/** rw,
|
||||
|
|
@ -73,37 +64,13 @@ profile qnapi @{exec_path} {
|
|||
owner @{tmp}/QNapi.@{int}.tmp.* rwl -> /tmp/#@{int},
|
||||
owner @{tmp}/QNapi.@{int} rw,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/qnapi>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,19 +10,14 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qpdfview
|
||||
profile qpdfview @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
@ -34,7 +29,6 @@ profile qpdfview @{exec_path} {
|
|||
@{lib}/firefox/firefox rPUx,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/poppler/** r,
|
||||
/usr/share/djvu/** r,
|
||||
|
||||
|
|
@ -60,10 +54,10 @@ profile qpdfview @{exec_path} {
|
|||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/qpdfview.*.pdf rwl -> /tmp/#@{int},
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,19 +10,17 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qt5ct
|
||||
profile qt5ct @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner @{user_config_dirs}/qt5ct/ rw,
|
||||
owner @{user_config_dirs}/qt5ct/** rwkl -> @{user_config_dirs}/qt5ct/#@{int},
|
||||
|
||||
|
|
@ -35,19 +33,8 @@ profile qt5ct @{exec_path} {
|
|||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}//sys/kernel/random/boot_id r,
|
||||
|
||||
/etc/X11/cursors/*.theme r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/scrot
|
||||
profile scrot @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
@ -21,16 +22,10 @@ profile scrot @{exec_path} {
|
|||
# The image dir
|
||||
owner @{HOME}/*.png rw,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
owner @{HOME}/.icons/default/index.theme r,
|
||||
/usr/share/icons/*/index.theme r,
|
||||
/usr/share/icons/*/cursors/* r,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
include if exists <local/scrot>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,22 +10,18 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/strawberry
|
||||
profile strawberry @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/X>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
signal (send) set=(term, kill) peer=strawberry-tagreader,
|
||||
|
||||
|
|
@ -42,88 +38,45 @@ profile strawberry @{exec_path} {
|
|||
|
||||
@{bin}/strawberry-tagreader rPx,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{open_path} rPx -> child-open-help,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
# Media library
|
||||
owner @{user_music_dirs}/ r,
|
||||
owner @{user_music_dirs}/** rw,
|
||||
|
||||
# Playlists
|
||||
owner @{HOME}/**.{m3u,xspf,pls,asx,cue,wpl} rw,
|
||||
owner @{HOME}/**.{M3U,XSPF,PLS,ASX,CUE,WPL} rw,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{user_config_dirs}/strawberry/ rw,
|
||||
owner @{user_config_dirs}/strawberry/* rwkl -> @{user_config_dirs}/strawberry/#@{int},
|
||||
|
||||
owner @{user_share_dirs}/strawberry/ rw,
|
||||
owner @{user_share_dirs}/strawberry/** rwk,
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/strawberry/ rw,
|
||||
owner @{user_cache_dirs}/strawberry/** rwl -> @{user_cache_dirs}/strawberry/networkcache/prepared/#@{int},
|
||||
|
||||
owner @{user_cache_dirs}/xine-lib/ rw,
|
||||
owner @{user_cache_dirs}/xine-lib/plugins.cache{,.new} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{tmp}/.*/ rw,
|
||||
owner @{tmp}/.*/s rw,
|
||||
owner @{tmp}/*= w,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/etilqs_@{hex} rw,
|
||||
owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw,
|
||||
owner @{tmp}/strawberry-cover-@{rand6}.jpg rwl -> @{tmp}/#@{int},
|
||||
owner @{tmp}/strawberry*[0-9] w,
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
/dev/sr[0-9]* r,
|
||||
|
||||
owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw,
|
||||
owner @{tmp}/.*/ rw,
|
||||
owner @{tmp}/.*/s rw,
|
||||
owner @{tmp}/strawberry*[0-9] w,
|
||||
owner @{tmp}/strawberry-cover-*.jpg rwl -> /tmp/#@{int},
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/*= w,
|
||||
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
owner @{HOME}/.anyRemote/anyremote.stdout w,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/strawberry>
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue