mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): make profile entrypoint more universal.

Browse source
This commit is contained in:
Alexandre Pujol 2023-02-04 23:28:17 +00:00
parent e031c129ed
commit 6e56cfccc9
Failed to generate hash of commit
70 changed files with 122 additions and 147 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/browsers/firefox
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{firefox_name} = firefox{,-esr} @{firefox_name} = firefox{,-esr}
@{firefox_lib_dirs} = /{usr/,}lib{,32,64}/@{firefox_name}/ /opt/@{firefox_name}/ @{firefox_lib_dirs} = /{usr/,}lib{,32,64}/@{firefox_name} /opt/@{firefox_name}
@{firefox_config_dirs} = @{HOME}/.mozilla/ @{firefox_config_dirs} = @{HOME}/.mozilla/
@{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/ @{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/

24
apparmor.d/groups/bus/dbus-daemon
View file

@ -38,17 +38,19 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/ r, @{libexec}/{,at-spi2{,-core}/}at-spi2-registryd rPx,
@{libexec}/* rPUx, @{libexec}/* rPUx,
/{usr/,}bin/[a-z0-9]* rPUx, @{libexec}/gnome-shell/gnome-shell-calendar-server rPx,
/{usr/,}lib/@{multiarch}/tumbler-1/tumblerd rPUx, /{usr/,}bin/ r,
/{usr/,}lib/@{multiarch}/xfce4/xfconf/xfconfd rPUx, /{usr/,}bin/[a-z0-9]* rPUx,
/{usr/,}lib/dbus-1.0/dbus-daemon-launch-helper rPx, /{usr/,}lib/@{multiarch}/tumbler-1/tumblerd rPUx,
/{usr/,}lib/ibus/ibus-* rPx, /{usr/,}lib/@{multiarch}/xfce4/xfconf/xfconfd rPUx,
/{usr/,}lib/telepathy/mission-control-5 rPx, /{usr/,}lib/dbus-1.0/dbus-daemon-launch-helper rPx,
/usr/share/gnome-documents/org.gnome.Documents rPx, /{usr/,}lib/ibus/ibus-* rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters rPx, /{usr/,}lib/telepathy/mission-control-5 rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx, /usr/share/gnome-documents/org.gnome.Documents rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx,
/etc/dbus-1/{,**} r, /etc/dbus-1/{,**} r,

7
apparmor.d/groups/bus/dbus-daemon-launch-helper
View file

@ -18,11 +18,10 @@ profile dbus-daemon-launch-helper @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/{usr/,}lib/@{multiarch}/cups-pk-helper-mechanism rPx, @{libexec}/{,cups-pk-helper/}cups-pk-helper-mechanism rPx,
/{usr/,}lib/cups-pk-helper-mechanism rPx,
/{usr/,}lib/cups-pk-helper/cups-pk-helper-mechanism rPx,
/{usr/,}lib/software-properties/software-properties-dbus rPx,
@{libexec}/language-selector/ls-dbus-backend rPx, @{libexec}/language-selector/ls-dbus-backend rPx,
/{usr/,}lib/@{multiarch}/cups-pk-helper-mechanism rPx,
/{usr/,}lib/software-properties/software-properties-dbus rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx, /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx,
/usr/share/usb-creator/usb-creator-helper rPx, /usr/share/usb-creator/usb-creator-helper rPx,

5
apparmor.d/groups/children/child-open
View file

@ -42,11 +42,12 @@ profile child-open {
# Browsers # Browsers
/{usr/,}bin/chromium rPx, /{usr/,}bin/chromium rPx,
/{usr/,}bin/firefox rPx, /{usr/,}bin/firefox{,-esr} rPx,
/{usr/,}lib{,32,64}/firefox{,-esr}/firefox{,-esr} rPx,
/{usr/,}lib/@{multiarch}/opera{,-beta,-developer}/opera{,-beta,-developer} rPx, /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}/opera{,-beta,-developer} rPx,
/{usr/,}lib/chromium/chromium rPx, /{usr/,}lib/chromium/chromium rPx,
/{usr/,}lib/firefox/firefox rPx,
/opt/brave.com/brave{,-beta,-dev}/brave{,-beta,-dev} rPx, /opt/brave.com/brave{,-beta,-dev}/brave{,-beta,-dev} rPx,
/opt/firefox{,-esr}/firefox{,-esr} rPx,
/opt/google/chrome{,-beta,-unstable}/chrome{,-beta,-unstable} rPx, /opt/google/chrome{,-beta,-unstable}/chrome{,-beta,-unstable} rPx,
# Text editors # Text editors

3
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/accountsservice/accounts-daemon @{exec_path} = @{libexec}/{,accountsservice/}accounts-daemon
@{exec_path} += @{libexec}/accounts-daemon
profile accounts-daemon @{exec_path} flags=(attach_disconnected) { profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>

3
apparmor.d/groups/freedesktop/at-spi-bus-launcher
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/at-spi2-core/at-spi-bus-launcher @{exec_path} = @{libexec}/{,at-spi2{,-core}/}at-spi-bus-launcher
@{exec_path} += @{libexec}/at-spi-bus-launcher
profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) { profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session> include <abstractions/dbus-session>

3
apparmor.d/groups/freedesktop/at-spi2-registryd
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/at-spi2-core/at-spi2-registryd @{exec_path} = @{libexec}/{,at-spi2{,-core}/}at-spi2-registryd
@{exec_path} += @{libexec}/at-spi2-registryd
profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

3
apparmor.d/groups/freedesktop/colord-sane
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/colord/colord-sane @{exec_path} = @{libexec}/{,colord/}colord-sane
@{exec_path} += @{libexec}/colord-sane
profile colord-sane @{exec_path} flags=(attach_disconnected,complain) { profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>

2
apparmor.d/groups/freedesktop/dconf-service
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/dconf/dconf-service @{libexec}/dconf-service @{exec_path} = @{libexec}/{,dconf/}dconf-service
profile dconf-service @{exec_path} flags=(attach_disconnected) { profile dconf-service @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

3
apparmor.d/groups/freedesktop/polkitd
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/polkit-1/polkitd @{exec_path} = @{libexec}/{,polkit-1/}polkitd
@{exec_path} += @{libexec}/polkitd
profile polkitd @{exec_path} { profile polkitd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>

3
apparmor.d/groups/freedesktop/upowerd
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/upower/upowerd @{exec_path} = @{libexec}/{,upower/}upowerd
@{exec_path} += @{libexec}/upowerd
profile upowerd @{exec_path} flags=(attach_disconnected) { profile upowerd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>

2
apparmor.d/groups/freedesktop/xorg
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/X @{exec_path} = /{usr/,}bin/X
@{exec_path} += /{usr/,}bin/Xorg @{exec_path} += /{usr/,}bin/Xorg{,.bin}
@{exec_path} += /{usr/,}lib/Xorg{,.wrap} @{exec_path} += /{usr/,}lib/Xorg{,.wrap}
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap} @{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}
profile xorg @{exec_path} flags=(attach_disconnected) { profile xorg @{exec_path} flags=(attach_disconnected) {

2
apparmor.d/groups/gnome/evolution-addressbook-factory
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/evolution-addressbook-factory @{exec_path} = @{libexec}/{,evolution-data-server/}evolution-addressbook-factory
profile evolution-addressbook-factory @{exec_path} { profile evolution-addressbook-factory @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-network-manager-strict> include <abstractions/dbus-network-manager-strict>

2
apparmor.d/groups/gnome/evolution-alarm-notify
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/evolution-data-server/evolution-alarm-notify @{exec_path} = @{libexec}/evolution-data-server/{,evolution-data-server/}evolution-alarm-notify
profile evolution-alarm-notify @{exec_path} { profile evolution-alarm-notify @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session> include <abstractions/dbus-session>

2
apparmor.d/groups/gnome/evolution-calendar-factory
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/evolution-calendar-factory @{exec_path} = @{libexec}/{,evolution-data-server/}evolution-calendar-factory
profile evolution-calendar-factory @{exec_path} { profile evolution-calendar-factory @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-network-manager-strict> include <abstractions/dbus-network-manager-strict>

2
apparmor.d/groups/gnome/evolution-source-registry
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/evolution-source-registry @{exec_path} = @{libexec}/{,evolution-data-server/}evolution-source-registry
profile evolution-source-registry @{exec_path} { profile evolution-source-registry @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

6
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/gdm-session-worker @{exec_path} = @{libexec}/{,gdm/}gdm-session-worker
profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/authentication> include <abstractions/authentication>
@ -58,9 +58,9 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
@{exec_path} mrix, @{exec_path} mrix,
@{libexec}/{,gdm/}gdm-wayland-session rPx,
@{libexec}/{,gdm/}gdm-x-session rPx,
/{usr/,}bin/gnome-keyring-daemon rPx, /{usr/,}bin/gnome-keyring-daemon rPx,
@{libexec}/gdm-wayland-session rPx,
@{libexec}/gdm-x-session rPx,
/etc/gdm{3,}/{Pre,Post}Session/Default rix, /etc/gdm{3,}/{Pre,Post}Session/Default rix,
/etc/gdm{3,}/PrimeOff/Default rix, /etc/gdm{3,}/PrimeOff/Default rix,

2
apparmor.d/groups/gnome/gdm-wayland-session
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/gdm-wayland-session @{exec_path} = @{libexec}/{,gdm/}gdm-wayland-session
profile gdm-wayland-session @{exec_path} { profile gdm-wayland-session @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bash> include <abstractions/bash>

2
apparmor.d/groups/gnome/gnome-contacts-search-provider
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gnome-contacts-search-provider @{exec_path} = @{libexec}/gnome-contacts-search-provider
profile gnome-contacts-search-provider @{exec_path} { profile gnome-contacts-search-provider @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

6
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -147,12 +147,12 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{libexec}/gnome-session-check-accelerated-gl-helper rix, @{libexec}/gnome-session-check-accelerated-gl-helper rix,
@{libexec}/gnome-session-check-accelerated-gles-helper rix, @{libexec}/gnome-session-check-accelerated-gles-helper rix,
@{libexec}/gnome-session-failed rix, @{libexec}/gnome-session-failed rix,
@{libexec}/gnome-shell-overrides-migration.sh rix, @{libexec}/{,gnome-shell/}gnome-shell-overrides-migration.sh rix,
@{libexec}/gsd-* rPx, @{libexec}/gsd-* rPx,
# TODO: rCx gio-launch-desktop and put all the following program in this # TODO: rCx gio-launch-desktop and put all the following program in this
# subprofile. Not done yet as it breaks compatibility with Ubuntu/Debian # subprofile. Not done yet as it breaks compatibility with Ubuntu/Debian
/{usr/,}lib/gio-launch-desktop rix, @{libexec}/gio-launch-desktop rix,
/{usr/,}bin/aa-notify rPx, /{usr/,}bin/aa-notify rPx,
/{usr/,}bin/baloo_file rPUx, /{usr/,}bin/baloo_file rPUx,
@ -180,8 +180,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/{usr/,}lib/xapps/sn-watcher/* rPUx, /{usr/,}lib/xapps/sn-watcher/* rPUx,
/{usr/,}share/libpam-kwallet-common/pam_kwallet_init rPUx, /{usr/,}share/libpam-kwallet-common/pam_kwallet_init rPUx,
@{libexec}/deja-dup/deja-dup-monitor rPUx, @{libexec}/deja-dup/deja-dup-monitor rPUx,
@{libexec}/evolution-data-server/evolution-alarm-notify rPx,
@{libexec}/gsd-disk-utility-notify rPx, @{libexec}/gsd-disk-utility-notify rPx,
@{libexec}/evolution-data-server/{,evolution-data-server/}evolution-alarm-notify rPx,
/usr/share/applications/{,**} r, /usr/share/applications/{,**} r,
/usr/share/dconf/profile/gdm r, /usr/share/dconf/profile/gdm r,

2
apparmor.d/groups/gnome/gnome-shell-calendar-server
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/gnome-shell-calendar-server @{exec_path} = @{libexec}/{,gnome-shell/}gnome-shell-calendar-server
profile gnome-shell-calendar-server @{exec_path} { profile gnome-shell-calendar-server @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

4
apparmor.d/groups/gvfs/gvfs-afc-volume-monitor
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfs-afc-volume-monitor @{exec_path} = @{libexec}/{,gvfs}/gvfs-afc-volume-monitor
@{exec_path} += @{libexec}/gvfs-afc-volume-monitor
profile gvfs-afc-volume-monitor @{exec_path} { profile gvfs-afc-volume-monitor @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

4
apparmor.d/groups/gvfs/gvfs-goa-volume-monitor
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfs-goa-volume-monitor @{exec_path} = @{libexec}/{,gvfs/}gvfs-goa-volume-monitor
@{exec_path} += @{libexec}/gvfs-goa-volume-monitor
profile gvfs-goa-volume-monitor @{exec_path} { profile gvfs-goa-volume-monitor @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

4
apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfs-gphoto2-volume-monitor @{exec_path} = @{libexec}/{,gvfs/}gvfs-gphoto2-volume-monitor
@{exec_path} += @{libexec}/gvfs-gphoto2-volume-monitor
profile gvfs-gphoto2-volume-monitor @{exec_path} { profile gvfs-gphoto2-volume-monitor @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

4
apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfs-mtp-volume-monitor @{exec_path} = @{libexec}/{,gvfs/}gvfs-mtp-volume-monitor
@{exec_path} += @{libexec}/gvfs-mtp-volume-monitor
profile gvfs-mtp-volume-monitor @{exec_path} { profile gvfs-mtp-volume-monitor @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

3
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfs-udisks2-volume-monitor @{exec_path} = @{libexec}/{,gvfs/}gvfs-udisks2-volume-monitor
@{exec_path} += @{libexec}/gvfs-udisks2-volume-monitor
profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) { profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

8
apparmor.d/groups/gvfs/gvfsd
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd @{exec_path} = @{libexec}/{,gvfs/}gvfsd
@{exec_path} += @{libexec}/gvfsd
profile gvfsd @{exec_path} { profile gvfsd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-gtk> include <abstractions/dbus-gtk>
@ -53,9 +52,8 @@ profile gvfsd @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/{,ba,da}sh rix,
/{usr/,}lib/gvfs/gvfsd-* rpx, @{libexec}/{,gvfs/}gvfsd-* rpx,
@{libexec}/gvfsd-* rpx,
/usr/share/gvfs/{,**} r, /usr/share/gvfs/{,**} r,

4
apparmor.d/groups/gvfs/gvfsd-admin
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-admin @{exec_path} = @{libexec}/{,gvfs/}gvfsd-admin
@{exec_path} += @{libexec}/gvfsd-admin
profile gvfsd-admin @{exec_path} { profile gvfsd-admin @{exec_path} {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/groups/gvfs/gvfsd-afc
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-afc @{exec_path} = @{libexec}/{,gvfs/}gvfsd-afc
@{exec_path} += @{libexec}/gvfsd-afc
profile gvfsd-afc @{exec_path} { profile gvfsd-afc @{exec_path} {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/groups/gvfs/gvfsd-afp
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-afp @{exec_path} = @{libexec}/{,gvfs/}gvfsd-afp
@{exec_path} += @{libexec}/gvfsd-afp
profile gvfsd-afp @{exec_path} { profile gvfsd-afp @{exec_path} {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/groups/gvfs/gvfsd-afp-browse
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-afp-browse @{exec_path} = @{libexec}/{,gvfs/}gvfsd-afp-browse
@{exec_path} += @{libexec}/gvfsd-afp-browse
profile gvfsd-afp-browse @{exec_path} { profile gvfsd-afp-browse @{exec_path} {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/groups/gvfs/gvfsd-archive
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-archive @{exec_path} = @{libexec}/{,gvfs/}gvfsd-archive
@{exec_path} += @{libexec}/gvfsd-archive
profile gvfsd-archive @{exec_path} { profile gvfsd-archive @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>

4
apparmor.d/groups/gvfs/gvfsd-burn
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-burn @{exec_path} = @{libexec}/{,gvfs/}gvfsd-burn
@{exec_path} += @{libexec}/gvfsd-burn
profile gvfsd-burn @{exec_path} { profile gvfsd-burn @{exec_path} {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/groups/gvfs/gvfsd-cdda
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-cdda @{exec_path} = @{libexec}/{,gvfs/}gvfsd-cdda
@{exec_path} += @{libexec}/gvfsd-cdda
profile gvfsd-cdda @{exec_path} { profile gvfsd-cdda @{exec_path} {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/groups/gvfs/gvfsd-computer
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-computer @{exec_path} = @{libexec}/{,gvfs/}gvfsd-computer
@{exec_path} += @{libexec}/gvfsd-computer
profile gvfsd-computer @{exec_path} { profile gvfsd-computer @{exec_path} {
include <abstractions/base> include <abstractions/base>

3
apparmor.d/groups/gvfs/gvfsd-dav
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-dav @{exec_path} = @{libexec}/{,gvfs/}gvfsd-dav
@{exec_path} += @{libexec}/gvfsd-dav
profile gvfsd-dav @{exec_path} { profile gvfsd-dav @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

3
apparmor.d/groups/gvfs/gvfsd-dnssd
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-dnssd @{exec_path} = @{libexec}/{,gvfs/}gvfsd-dnssd
@{exec_path} += @{libexec}/gvfsd-dnssd
profile gvfsd-dnssd @{exec_path} { profile gvfsd-dnssd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

3
apparmor.d/groups/gvfs/gvfsd-ftp
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-ftp @{exec_path} = @{libexec}/{,gvfs/}gvfsd-ftp
@{exec_path} += @{libexec}/gvfsd-ftp
profile gvfsd-ftp @{exec_path} { profile gvfsd-ftp @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

3
apparmor.d/groups/gvfs/gvfsd-fuse
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-fuse @{exec_path} = @{libexec}/{,gvfs/}gvfsd-fuse
@{exec_path} += @{libexec}/gvfsd-fuse
profile gvfsd-fuse @{exec_path} { profile gvfsd-fuse @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-gtk> include <abstractions/dbus-gtk>

4
apparmor.d/groups/gvfs/gvfsd-google
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-google @{exec_path} = @{libexec}/{,gvfs/}gvfsd-google
@{exec_path} += @{libexec}/gvfsd-google
profile gvfsd-google @{exec_path} { profile gvfsd-google @{exec_path} {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/groups/gvfs/gvfsd-gphoto2
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-gphoto2 @{exec_path} = @{libexec}/{,gvfs/}gvfsd-gphoto2
@{exec_path} += @{libexec}/gvfsd-gphoto2
profile gvfsd-gphoto2 @{exec_path} { profile gvfsd-gphoto2 @{exec_path} {
include <abstractions/base> include <abstractions/base>

3
apparmor.d/groups/gvfs/gvfsd-http
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-http @{exec_path} = @{libexec}/{,gvfs/}gvfsd-http
@{exec_path} += @{libexec}/gvfsd-http
profile gvfsd-http @{exec_path} { profile gvfsd-http @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

4
apparmor.d/groups/gvfs/gvfsd-localtest
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-localtest @{exec_path} = @{libexec}/{,gvfs/}gvfsd-localtest
@{exec_path} += @{libexec}/gvfsd-localtest
profile gvfsd-localtest @{exec_path} { profile gvfsd-localtest @{exec_path} {
include <abstractions/base> include <abstractions/base>

3
apparmor.d/groups/gvfs/gvfsd-metadata
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-metadata @{exec_path} = @{libexec}/{,gvfs/}gvfsd-metadata
@{exec_path} += @{libexec}/gvfsd-metadata
profile gvfsd-metadata @{exec_path} { profile gvfsd-metadata @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-gtk> include <abstractions/dbus-gtk>

3
apparmor.d/groups/gvfs/gvfsd-mtp
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-mtp @{exec_path} = @{libexec}/{,gvfs/}gvfsd-mtp
@{exec_path} += @{libexec}/gvfsd-mtp
profile gvfsd-mtp @{exec_path} { profile gvfsd-mtp @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

3
apparmor.d/groups/gvfs/gvfsd-network
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-network @{exec_path} = @{libexec}/{,gvfs/}gvfsd-network
@{exec_path} += @{libexec}/gvfsd-network
profile gvfsd-network @{exec_path} { profile gvfsd-network @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

4
apparmor.d/groups/gvfs/gvfsd-nfs
View file

@ -1,13 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-nfs @{exec_path} = @{libexec}/{,gvfs/}gvfsd-nfs
@{exec_path} += @{libexec}/gvfsd-nfs
profile gvfsd-nfs @{exec_path} { profile gvfsd-nfs @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

5
apparmor.d/groups/gvfs/gvfsd-recent
View file

@ -1,14 +1,13 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-recent @{exec_path} = @{libexec}/{,gvfs/}gvfsd-recent
@{exec_path} += @{libexec}/gvfsd-recent
profile gvfsd-recent @{exec_path} { profile gvfsd-recent @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

3
apparmor.d/groups/gvfs/gvfsd-sftp
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-sftp @{exec_path} = @{libexec}/{,gvfs/}gvfsd-sftp
@{exec_path} += @{libexec}/gvfsd-sftp
profile gvfsd-sftp @{exec_path} { profile gvfsd-sftp @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

3
apparmor.d/groups/gvfs/gvfsd-smb
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-smb @{exec_path} = @{libexec}/{,gvfs/}gvfsd-smb
@{exec_path} += @{libexec}/gvfsd-smb
profile gvfsd-smb @{exec_path} { profile gvfsd-smb @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

3
apparmor.d/groups/gvfs/gvfsd-smb-browse
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-smb-browse @{exec_path} = @{libexec}/{,gvfs/}gvfsd-smb-browse
@{exec_path} += @{libexec}/gvfsd-smb-browse
profile gvfsd-smb-browse @{exec_path} { profile gvfsd-smb-browse @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>

3
apparmor.d/groups/gvfs/gvfsd-trash
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/gvfs/gvfsd-trash @{exec_path} = @{libexec}/{,gvfs/}gvfsd-trash
@{exec_path} += @{libexec}/gvfsd-trash
profile gvfsd-trash @{exec_path} { profile gvfsd-trash @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-gtk> include <abstractions/dbus-gtk>

15
apparmor.d/groups/network/NetworkManager
View file

@ -92,13 +92,14 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/dnsmasq rPx, /{usr/,}bin/dnsmasq rPx,
/{usr/,}bin/resolvconf rPx, /{usr/,}bin/resolvconf rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl, /{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}lib/nm-dhcp-helper rPx, @{libexec}/nm-dhcp-helper rPx,
/{usr/,}lib/nm-dispatcher rPx, @{libexec}/nm-dispatcher rPx,
/{usr/,}lib/nm-iface-helper rPx, @{libexec}/nm-iface-helper rPx,
/{usr/,}lib/nm-initrd-generator rPx, @{libexec}/nm-initrd-generator rPx,
/{usr/,}lib/nm-openvpn-auth-dialog rPx, @{libexec}/nm-openvpn-auth-dialog rPx,
/{usr/,}lib/nm-openvpn-service rPx, @{libexec}/nm-openvpn-service rPx,
/{usr/,}lib/nm-openvpn-service-openvpn-helper rPx, @{libexec}/nm-openvpn-service-openvpn-helper rPx,
@{libexec}/nm-daemon-helper rPx,
/usr/share/gvfs/remote-volume-monitors/{,*.monitor} r, /usr/share/gvfs/remote-volume-monitors/{,*.monitor} r,

2
apparmor.d/groups/network/nm-dhcp-helper
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-dhcp-helper @{exec_path} = @{libexec}/nm-dhcp-helper
profile nm-dhcp-helper @{exec_path} { profile nm-dhcp-helper @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus> include <abstractions/dbus>

3
apparmor.d/groups/network/nm-dispatcher
View file

@ -6,8 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-dispatcher @{exec_path} = @{libexec}/{,NetworkManager/}nm-dispatcher
@{exec_path} += /{usr/,}lib/NetworkManager/nm-dispatcher
profile nm-dispatcher @{exec_path} flags=(attach_disconnected) { profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>

2
apparmor.d/groups/network/nm-iface-helper
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-iface-helper @{exec_path} = @{libexec}/nm-iface-helper
profile nm-iface-helper @{exec_path} { profile nm-iface-helper @{exec_path} {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/groups/network/nm-initrd-generator
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-initrd-generator @{exec_path} = @{libexec}/nm-initrd-generator
profile nm-initrd-generator @{exec_path} { profile nm-initrd-generator @{exec_path} {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/groups/network/nm-openvpn-auth-dialog
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-openvpn-auth-dialog @{exec_path} = @{libexec}/nm-openvpn-auth-dialog
profile nm-openvpn-auth-dialog @{exec_path} { profile nm-openvpn-auth-dialog @{exec_path} {
include <abstractions/base> include <abstractions/base>

8
apparmor.d/groups/network/nm-openvpn-service
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-openvpn-service @{exec_path} = @{libexec}/nm-openvpn-service
profile nm-openvpn-service @{exec_path} { profile nm-openvpn-service @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -18,10 +18,10 @@ profile nm-openvpn-service @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix, @{libexec}/nm-openvpn-auth-dialog rPx,
@{libexec}/nm-openvpn-service-openvpn-helper rPx,
/{usr/,}{s,}bin/openvpn rPx, /{usr/,}{s,}bin/openvpn rPx,
/{usr/,}lib/nm-openvpn-auth-dialog rPx, /{usr/,}bin/{,ba,da}sh rix,
/{usr/,}lib/nm-openvpn-service-openvpn-helper rPx,
/{usr/,}bin/kmod rPx, /{usr/,}bin/kmod rPx,
@{run}/NetworkManager/nm-openvpn-@{uuid} rw, @{run}/NetworkManager/nm-openvpn-@{uuid} rw,

2
apparmor.d/groups/network/nm-openvpn-service-openvpn-helper
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-openvpn-service-openvpn-helper @{exec_path} = @{libexec}/nm-openvpn-service-openvpn-helper
profile nm-openvpn-service-openvpn-helper @{exec_path} { profile nm-openvpn-service-openvpn-helper @{exec_path} {
include <abstractions/base> include <abstractions/base>

3
apparmor.d/profiles-a-f/bluetoothd
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/bluetooth/bluetoothd @{exec_path} = @{libexec}/bluetooth/bluetoothd
@{exec_path} += @{libexec}/bluetooth/bluetoothd
profile bluetoothd @{exec_path} { profile bluetoothd @{exec_path} {
include <abstractions/base> include <abstractions/base>

3
apparmor.d/profiles-a-f/cups-pk-helper-mechanism
View file

@ -6,8 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/cups-pk-helper-mechanism @{exec_path} = @{libexec}/{,cups-pk-helper/}cups-pk-helper-mechanism
@{exec_path} += /{usr/,}lib/cups-pk-helper/cups-pk-helper-mechanism
@{exec_path} += /{usr/,}lib/@{multiarch}/cups-pk-helper-mechanism @{exec_path} += /{usr/,}lib/@{multiarch}/cups-pk-helper-mechanism
profile cups-pk-helper-mechanism @{exec_path} { profile cups-pk-helper-mechanism @{exec_path} {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/profiles-a-f/evince
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/evince /{usr/,}lib/evinced @{exec_path} = /{usr/,}bin/evince @{libexec}/evinced
profile evince @{exec_path} { profile evince @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

2
apparmor.d/profiles-a-f/fwupd
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/fwupd @{libexec}/fwupd/fwupd @{exec_path} = @{libexec}/{,fwupd/}fwupd
profile fwupd @{exec_path} flags=(complain,attach_disconnected) { profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

3
apparmor.d/profiles-g-l/gparted
View file

@ -30,8 +30,7 @@ profile gparted @{exec_path} {
@{libexec}/gparted/gpartedbin rPx, @{libexec}/gparted/gpartedbin rPx,
@{libexec}/gpartedbin rPx, @{libexec}/gpartedbin rPx,
/{usr/,}lib/udisks2/udisks2-inhibit rix, @{libexec}/{,udisks2/}udisks2-inhibit rix,
@{libexec}/udisks2/udisks2-inhibit rix,
@{run}/udev/rules.d/ rw, @{run}/udev/rules.d/ rw,
@{run}/udev/rules.d/90-udisks-inhibit.rules rw, @{run}/udev/rules.d/90-udisks-inhibit.rules rw,

4
apparmor.d/profiles-g-l/lightdm
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov # Copyright (C) 2017-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -115,8 +116,7 @@ profile lightdm @{exec_path} {
owner @{HOME}/.dmrc* rw, owner @{HOME}/.dmrc* rw,
/var/cache/lightdm/dmrc/*.dmrc* rw, /var/cache/lightdm/dmrc/*.dmrc* rw,
/{usr/,}lib/at-spi2-core/at-spi-bus-launcher rPUx, @{libexec}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
@{libexec}/at-spi-bus-launcher rPUx,
include if exists <local/lightdm> include if exists <local/lightdm>
} }

5
apparmor.d/profiles-g-l/lightdm-gtk-greeter
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov # Copyright (C) 2017-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -50,9 +51,7 @@ profile lightdm-gtk-greeter @{exec_path} {
@{HOME}/.dmrc r, @{HOME}/.dmrc r,
@{HOME}/.face r, @{HOME}/.face r,
/{usr/,}lib/at-spi2-core/at-spi-bus-launcher rPUx, @{libexec}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
@{libexec}/at-spi-bus-launcher rPUx,
profile systemd { profile systemd {
include <abstractions/base> include <abstractions/base>

4
apparmor.d/profiles-m-r/mission-control
View file

@ -6,8 +6,8 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/telepathy/mission-control-5 @{exec_path} = @{libexec}/{,telepathy/}mission-control-5
profile mission-control @{exec_path} { profile mission-control @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>

2
apparmor.d/profiles-m-r/rtkit-daemon
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/rtkit-daemon @{exec_path} = @{libexec}/{,rtkit/}rtkit-daemon
profile rtkit-daemon @{exec_path} flags=(attach_disconnected) { profile rtkit-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>

3
apparmor.d/profiles-s-z/udisksd
View file

@ -7,8 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/udisks2/udisksd @{exec_path} = @{libexec}/{,udisks2/}udisksd
@{exec_path} += @{libexec}/udisks2/udisksd
profile udisksd @{exec_path} flags=(attach_disconnected) { profile udisksd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>