mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

up to date version

Browse source
This commit is contained in:
nobodysu 2022-05-27 02:02:28 +03:00 committed by Alex
parent e547f6c7bd
commit 6b4ae79806
1 changed files with 36 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

73
apparmor.d/groups/systemd/systemd-logind
View file

@ -44,6 +44,10 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
@{run}/udev/tags/uaccess/ r,
@{run}/udev/static_node-tags/uaccess/ r,
@{run}/udev/data/+backlight:intel_backlight r,
@{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+pci* r,
@{run}/udev/data/c10:[0-9]* r,
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@ -55,61 +59,56 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
@{run}/udev/data/+backlight:intel_backlight r,
@{run}/udev/data/+pci* r,
@{run}/systemd/inhibit/ rw,
@{run}/systemd/inhibit/.#* rw,
@{run}/systemd/inhibit/[0-9]*{,.ref} rw,
@{run}/systemd/seats/ rw,
@{run}/systemd/seats/.#seat* rw,
@{run}/systemd/seats/seat[0-9]* rw,
@{run}/systemd/inhibit/ rw,
@{run}/systemd/inhibit/[0-9]*{,.ref} rw,
@{run}/systemd/inhibit/.#* rw,
@{run}/systemd/sessions/ r,
@{run}/systemd/sessions/ rw,
@{run}/systemd/sessions/* rw,
@{run}/systemd/sessions/*.ref rw,
@{run}/systemd/users/ rw,
@{run}/systemd/users/@{uid} rw,
@{run}/systemd/users/.#* rw,
@{run}/systemd/userdb/ r,
@{run}/systemd/userdb/io.systemd.DynamicUser rw,
@{run}/systemd/notify w,
@{run}/systemd/users/ rw,
@{run}/systemd/users/.#* rw,
@{run}/systemd/users/@{uid} rw,
/dev/input/event[0-9]* rw, # Input devices (keyboard, mouse, etc)
/dev/dri/card[0-9]* rw,
/dev/tty[0-9]* rw,
/dev/nvme* r,
/dev/shm/{,**/} r,
/dev/mqueue/ r,
@{sys}/module/vt/parameters/default_utf8 r,
@{sys}/fs/cgroup/memory/memory.limit_in_bytes r,
@{sys}/fs/cgroup/memory.max r,
@{sys}/devices/virtual/tty/tty[0-9]*/active r,
@{sys}/devices/**/{uevent,enabled,status} r,
@{sys}/devices/**/brightness rw,
@{run}/systemd/journal/socket rw,
@{run}/systemd/notify rw,
@{sys}/class/drm/ r,
@{sys}/power/{state,resume_offset,resume,disk} r,
@{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndications-@{uuid} r,
@{sys}/devices/**/{uevent,enabled,status} r,
@{sys}/devices/**/brightness rw,
@{sys}/devices/virtual/tty/tty[0-9]*/active r,
@{sys}/firmware/efi/efivars/LoaderEntries-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderFeatures-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndications-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r,
@{sys}/fs/cgroup/memory.max r,
@{sys}/fs/cgroup/memory/memory.limit_in_bytes r,
@{sys}/module/vt/parameters/default_utf8 r,
@{sys}/power/{state,resume_offset,resume,disk} r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/comm r,
@{PROC}/@{pids}/fd/ r,
@{PROC}/@{pids}/mountinfo r,
@{PROC}/@{pids}/sessionid r,
@{PROC}/@{pids}/stat r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/comm r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/mountinfo r,
@{PROC}/@{pid}/sessionid r,
@{PROC}/@{pid}/stat r,
@{PROC}/1/cmdline r,
@{PROC}/swaps r,
@{PROC}/sysvipc/{shm,sem,msg} r,
/dev/dri/card[0-9]* rw,
/dev/input/event[0-9]* rw, # Input devices (keyboard, mouse, etc)
/dev/mqueue/ r,
/dev/nvme* r,
/dev/shm/{,**/} rw,
/dev/tty[0-9]* rw,
# DBus
# all members for login related, specific for others
# all members for login-related, specific for others
dbus send
bus="system" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="{GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials,RequestName}" peer=(name="org.freedesktop.DBus"),