mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(dbus): rewrite some dbus rules (8).

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-05 21:27:03 +00:00
parent c4b48b06e2
commit 6a3cc952e1
Failed to generate hash of commit
12 changed files with 32 additions and 101 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/browsers/firefox
View file

@ -56,7 +56,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
dbus bind bus=session name=org.mozilla.firefox.*,
dbus bind bus=session name=org.mpris.MediaPlayer2.firefox.*,
dbus bind bus=session name=org.mozilla.firefox_beta.*,
deny dbus send bus=system path=/org/freedesktop/hostname[0-9]*,
deny dbus send bus=system path=/org/freedesktop/hostname1,
dbus send bus=session path=/ScreenSaver
interface=org.freedesktop.ScreenSaver

1
apparmor.d/groups/freedesktop/xorg
View file

@ -13,6 +13,7 @@ include <tunables/global>
@{exec_path} += @{lib}/xorg/Xorg{,.wrap}
profile xorg @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/login-session>
include <abstractions/dbus-strict>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>

2
apparmor.d/groups/gnome/gnome-control-center
View file

@ -11,8 +11,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/atspi>
include <abstractions/dbus-session>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session>
include <abstractions/dbus>
include <abstractions/dconf-write>
include <abstractions/dri-common>

8
apparmor.d/groups/gnome/goa-daemon
View file

@ -30,14 +30,6 @@ profile goa-daemon @{exec_path} {
interface=org.freedesktop.DBus.ObjectManager
peer=(name=:*),
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member={PropertiesChanged,GetAll},
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member={CheckPermissions,StateChanged},
dbus send bus=session path=/org/gnome/Identity
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects

29
apparmor.d/groups/gnome/gsd-datetime
View file

@ -9,44 +9,19 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-datetime
profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/session-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus bind bus=session name=org.gnome.SettingsDaemon.Datetime,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.gnome.SettingsDaemon.Datetime,
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

16
apparmor.d/groups/gvfs/gvfsd-dnssd
View file

@ -10,22 +10,12 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-dnssd
profile gvfsd-dnssd @{exec_path} {
include <abstractions/base>
include <abstractions/bus/avahi>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
dbus send bus=system path=/
interface=org.freedesktop.Avahi.Server
member={Ping,GetAPIVersion,GetState,ServiceBrowserNew},
dbus send bus=system path=/
interface=org.freedesktop.DBus.Peer
member=Ping
peer=(name=org.freedesktop.Avahi),
dbus receive bus=system path=/Client[0-9]*/ServiceBrowser[0-9]
interface=org.freedesktop.Avahi.ServiceBrowser
member={CacheExhausted,AllForNow},
dbus bind bus=session name=org.gtk.vfs.mountpoint_dnssd,
dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
@ -42,8 +32,6 @@ profile gvfsd-dnssd @{exec_path} {
member=Spawned
peer=(name=:*, label=gvfsd),
dbus bind bus=session name=org.gtk.vfs.mountpoint_dnssd,
@{exec_path} mr,
owner @{run}/user/@{uid}/gvfsd/ rw,

1
apparmor.d/groups/systemd/hostnamectl
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/hostnamectl
profile hostnamectl @{exec_path} {
include <abstractions/base>
include <abstractions/bus/hostname>
include <abstractions/consoles>
include <abstractions/dbus-strict>

12
apparmor.d/groups/systemd/loginctl
View file

@ -9,22 +9,14 @@ include <tunables/global>
@{exec_path} = @{bin}/loginctl
profile loginctl @{exec_path} {
include <abstractions/base>
include <abstractions/bus/login-session>
include <abstractions/bus/login>
include <abstractions/dbus-strict>
include <abstractions/systemd-common>
capability net_admin,
capability sys_resource,
dbus (send) bus=system path=/org/freedesktop/login1*
interface=org.freedesktop.login1*.Manager
member={ListSessions,GetSession}
peer=(name=org.freedesktop.login1*, label=systemd-logind),
dbus (send) bus=system path=/org/freedesktop/login1*/session/**
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(name=org.freedesktop.login1*, label=systemd-logind),
@{exec_path} mr,
@{bin}/less rPx -> child-pager,

21
apparmor.d/groups/systemd/systemd-machined
View file

@ -24,6 +24,14 @@ profile systemd-machined @{exec_path} {
capability sys_chroot,
capability sys_ptrace,
dbus bind bus=system name=org.freedesktop.machine1,
dbus receive bus=system path=/org/freedesktop/machine1{,/**}
interface=org.freedesktop.machine1.Manager
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/machine1{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/systemd1/{,{unit,job}/*}
interface=org.freedesktop.DBus.Properties
member=Get
@ -44,19 +52,6 @@ profile systemd-machined @{exec_path} {
member={JobRemoved,UnitRemoved,Reloading}
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/machine1
interface=org.freedesktop.machine1.Manager
member={TerminateMachine,GetMachineByPID,CreateMachineWithNetwork}
peer=(name=:*, label=libvirtd),
dbus receive bus=system path=/org/freedesktop/machine1/machine/*
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=:*, label=libvirtd),
dbus bind bus=system
name=org.freedesktop.machine1,
@{exec_path} mr,
/var/lib/machines/{,**} rw,

8
apparmor.d/groups/systemd/systemd-networkd
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-networkd
profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
include <abstractions/base>
include <abstractions/bus/hostname>
include <abstractions/dbus-strict>
include <abstractions/systemd-common>
@ -28,12 +29,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
dbus bind bus=system name=org.freedesktop.network1,
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.hostname1
member=SetHostname
peer=(name=org.freedesktop.hostname1),
dbus receive bus=system path=/org/freedesktop/network[0-9]
dbus receive bus=system path=/org/freedesktop/network1
interface=org.freedesktop.DBus.Properties
member=Get,

14
apparmor.d/groups/systemd/systemd-resolved
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-resolved
profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/login>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
@ -30,19 +31,14 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus bind bus=system name=org.freedesktop.resolve1,
dbus receive bus=system path=/org/freedesktop/resolve1
interface=org.freedesktop.{resolve1.Manager,DBus.Peer,DBus.Properties},
interface=org.freedesktop.resolve1.Manager
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,GetConnectionUnixUser}
peer=(name=org.freedesktop.DBus),
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={PrepareForSleep,PrepareForShutdown}
peer=(name=:*, label=systemd-logind),
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,

19
apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon
View file

@ -14,22 +14,17 @@ profile ubuntu-advantage-desktop-daemon @{exec_path} flags=(attach_disconnected)
capability sys_nice,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=RequestName
peer=(name=org.freedesktop.DBus),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=system name=com.canonical.UbuntuAdvantage,
dbus receive bus=system path=/
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
member=GetManagedObjects
peer=(name=:*, label=software-properties-gtk),
dbus bind bus=system
name=com.canonical.UbuntuAdvantage,
dbus receive bus=system
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=software-properties-gtk),
@{exec_path} mr,