mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-12-27 07:27:24 +01:00
Add lxqt-session, enable start in sddm (#580)
This commit is contained in:
Besanon
GitHub
parent
be759e7c7c
commit
6f586f1f46
3 changed files with 101 additions and 0 deletions
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
||||||
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kscreen_backend_launcher
|
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kscreen_backend_launcher
|
||||||
profile kscreen_backend_launcher @{exec_path} {
|
profile kscreen_backend_launcher @{exec_path} {
|
||||||
include <abstractions/base>
|
include <abstractions/base>
|
||||||
|
include <abstractions/lxqt>
|
||||||
include <abstractions/kde-strict>
|
include <abstractions/kde-strict>
|
||||||
|
|
||||||
@{exec_path} mr,
|
@{exec_path} mr,
|
||||||
|
|
|
||||||
|
|
@ -40,6 +40,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||||
ptrace (trace) peer=@{profile_name},
|
ptrace (trace) peer=@{profile_name},
|
||||||
|
|
||||||
signal (receive) set=(hup) peer=@{p_systemd},
|
signal (receive) set=(hup) peer=@{p_systemd},
|
||||||
|
signal (send) set=(kill, term) peer=lxqt-session,
|
||||||
signal (send) set=(kill, term) peer=startplasma,
|
signal (send) set=(kill, term) peer=startplasma,
|
||||||
signal (send) set=(kill, term) peer=xorg,
|
signal (send) set=(kill, term) peer=xorg,
|
||||||
signal (send) set=(kill, term) peer=xsetroot,
|
signal (send) set=(kill, term) peer=xsetroot,
|
||||||
|
|
@ -94,6 +95,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||||
@{bin}/kwalletd{5,6} rPx,
|
@{bin}/kwalletd{5,6} rPx,
|
||||||
@{bin}/kwin_wayland rPx,
|
@{bin}/kwin_wayland rPx,
|
||||||
@{bin}/sddm-greeter{,-qt6} rPx,
|
@{bin}/sddm-greeter{,-qt6} rPx,
|
||||||
|
@{bin}/startlxqt rPx,
|
||||||
@{bin}/startplasma-wayland rPx,
|
@{bin}/startplasma-wayland rPx,
|
||||||
@{bin}/startplasma-x11 rPx,
|
@{bin}/startplasma-x11 rPx,
|
||||||
@{bin}/sway rPUx,
|
@{bin}/sway rPUx,
|
||||||
|
|
|
||||||
98
apparmor.d/groups/lxqt/lxqt-session
Normal file
98
apparmor.d/groups/lxqt/lxqt-session
Normal file
|
|
@ -0,0 +1,98 @@
|
||||||
|
# apparmor.d - Full set of apparmor profiles
|
||||||
|
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||||
|
# Copyright (C) 2024 Besanon <m231009ts@mailfence.com>
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
|
abi <abi/4.0>,
|
||||||
|
|
||||||
|
include <tunables/global>
|
||||||
|
|
||||||
|
@{exec_path} = @{bin}/lxqt-session
|
||||||
|
profile lxqt-session @{exec_path} flags=(attach_disconnected) {
|
||||||
|
include <abstractions/base>
|
||||||
|
include <abstractions/app-launcher-user>
|
||||||
|
include <abstractions/bus-accessibility>
|
||||||
|
include <abstractions/dconf>
|
||||||
|
include <abstractions/lxqt>
|
||||||
|
include <abstractions/qt5-shader-cache>
|
||||||
|
include <abstractions/nameservice-strict>
|
||||||
|
|
||||||
|
network netlink raw,
|
||||||
|
|
||||||
|
signal (send),
|
||||||
|
signal (receive) set=(kill, term) peer=startlxqt,
|
||||||
|
signal (receive) set=(kill, term) peer=sddm,
|
||||||
|
|
||||||
|
ptrace (read),
|
||||||
|
|
||||||
|
@{exec_path} mr,
|
||||||
|
|
||||||
|
@{sh_path} rix,
|
||||||
|
@{bin}/sed rix,
|
||||||
|
@{bin}/readlink rix,
|
||||||
|
@{bin}/dirname rix,
|
||||||
|
@{bin}/system-config-printer-applet rPx,
|
||||||
|
@{bin}/dbus-update-activation-environment rCx -> dbus,
|
||||||
|
@{bin}/systemctl rCx -> systemctl,
|
||||||
|
|
||||||
|
@{bin}/pavucontrol rPx,
|
||||||
|
@{lib}/geoclue-2.0/demos/agent rPx,
|
||||||
|
@{bin}/nm-connection-editor rPx,
|
||||||
|
@{bin}/nm-applet rPx,
|
||||||
|
@{bin}/openbox rix,
|
||||||
|
@{bin}/dconf-editor rPx,
|
||||||
|
@{bin}/setxkbmap rix,
|
||||||
|
@{bin}/start-pulseaudio-x11 rPx,
|
||||||
|
@{bin}/xrdb rPx,
|
||||||
|
@{bin}/xdg-user-dirs-update rPx,
|
||||||
|
|
||||||
|
/usr/share/ r,
|
||||||
|
/usr/share/mime/ r,
|
||||||
|
/usr/share/cursors/ r,
|
||||||
|
/usr/share/backintime/common/* r,
|
||||||
|
/usr/share/desktop-directories/* r,
|
||||||
|
/usr/share/system-config-printer/* r,
|
||||||
|
|
||||||
|
/etc/xdg/ r,
|
||||||
|
/etc/xdg/autostart/ r,
|
||||||
|
/etc/xdg/autostart/*.desktop r,
|
||||||
|
/etc/xdg/menus/lxqt-* r,
|
||||||
|
/etc/xdg/openbox/* r,
|
||||||
|
/etc/udev/udev.conf r,
|
||||||
|
|
||||||
|
owner @{user_config_dirs}/autostart/ r,
|
||||||
|
owner @{user_config_dirs}/autostart/*.desktop r,
|
||||||
|
owner @{user_cache_dirs}/openbox/ rw,
|
||||||
|
owner @{user_cache_dirs}/openbox/sessions/ rw,
|
||||||
|
owner @{user_cache_dirs}/openbox/openbox.log rwk,
|
||||||
|
owner @{user_config_dirs}/mimeapps.list{,.@{rand6}} rw,
|
||||||
|
owner @{user_config_dirs}/openbox/rc.xml r,
|
||||||
|
|
||||||
|
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
||||||
|
|
||||||
|
@{PROC}/ r,
|
||||||
|
@{PROC}/uptime r,
|
||||||
|
@{PROC}/@{pid}/stat r,
|
||||||
|
owner @{PROC}/@{pid}/stat r,
|
||||||
|
|
||||||
|
/dev/tty rw,
|
||||||
|
|
||||||
|
profile systemctl {
|
||||||
|
include <abstractions/base>
|
||||||
|
include <abstractions/app/systemctl>
|
||||||
|
|
||||||
|
include if exists <local/lxqt-session_systemctl>
|
||||||
|
}
|
||||||
|
profile dbus {
|
||||||
|
include <abstractions/base>
|
||||||
|
include <abstractions/bus-session>
|
||||||
|
|
||||||
|
@{bin}/dbus-update-activation-environment mr,
|
||||||
|
|
||||||
|
include if exists <local/lxqt-session_dbus>
|
||||||
|
}
|
||||||
|
|
||||||
|
include if exists <local/lxqt-session>
|
||||||
|
}
|
||||||
|
|
||||||
|
# vim:syntax=apparmor
|
||||||
Loading…
Reference in a new issue