mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-20 08:55:34 +01:00
feat(profile): remove the atom profile.
This commit is contained in:
Alexandre Pujol
parent
2aace6bccb
commit
70dc9b7844
1 changed files with 0 additions and 186 deletions
|
|
@ -1,186 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /usr/share/atom{,-beta,-nightly,-dev}/atom @{bin}/atom
|
||||
profile atom @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/chromium-common>
|
||||
# The following doesn't seem to be needed
|
||||
##include <abstractions/mesa>
|
||||
##include <abstractions/consoles>
|
||||
##include <abstractions/audio>
|
||||
##include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
##include <abstractions/zsh>
|
||||
##include <abstractions/fzf>
|
||||
|
||||
ptrace (read) peer=lsb_release,
|
||||
ptrace (read) peer=xdg-settings,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/usr/share/atom/** r,
|
||||
/usr/share/atom/libffmpeg.so mr,
|
||||
/usr/share/atom/libnode.so mr,
|
||||
/usr/share/atom/resources/**/bin/* rix,
|
||||
/usr/share/atom/resources/**.node mr,
|
||||
/usr/share/atom/resources/**/libexec/** rix,
|
||||
|
||||
deny /{usr/,}local/bin/ r,
|
||||
deny @{bin}/ r,
|
||||
#@{bin}/{,ba,da}sh rix,
|
||||
#@{bin}/zsh rix,
|
||||
#@{bin}/env rix,
|
||||
#@{bin}/rmdir rix,
|
||||
#@{bin}/{,e}grep rix,
|
||||
#@{bin}/ls rix,
|
||||
#@{bin}/{m,g,}awk rix,
|
||||
#@{bin}/tty rix,
|
||||
#@{bin}/dircolors rix,
|
||||
#@{bin}/cut rix,
|
||||
#@{bin}/xwininfo rix,
|
||||
#@{bin}/date rix,
|
||||
# The expr and uname tools are needed or Atom won't start with the following error:
|
||||
# Your platform () is not supported.
|
||||
@{bin}/expr rix,
|
||||
@{bin}/uname rix,
|
||||
# The following also are needed to start Atom
|
||||
@{bin}/basename rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/dirname rix,
|
||||
@{bin}/mkdir rix,
|
||||
@{bin}/nohup rix,
|
||||
@{bin}/cat rix,
|
||||
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
|
||||
@{bin}/xdg-settings rPx,
|
||||
|
||||
@{bin}/git rPx,
|
||||
|
||||
# Needed to sign commits
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
|
||||
# /home/ r,
|
||||
# Reading of the user home dir is required or the following error will be printed:
|
||||
# Unexpected end of JSON input:
|
||||
#owner @{HOME}/ r,
|
||||
owner @{HOME}/.atom/ rw,
|
||||
owner @{HOME}/.atom/** rwkl -> @{HOME}/.atom/**,
|
||||
owner @{user_config_dirs}/Atom/ rw,
|
||||
owner @{user_config_dirs}/Atom/** rwkl -> @{user_config_dirs}/Atom/**,
|
||||
|
||||
# Git dirs
|
||||
/ r,
|
||||
@{MOUNTS}/ r,
|
||||
owner @{MOUNTS}/ r,
|
||||
owner @{user_projects_dirs}/ r,
|
||||
owner @{user_projects_dirs}/** rwkl -> @{user_projects_dirs}/**,
|
||||
|
||||
owner @{user_config_dirs}/git/config r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# Needed or atom gets crash with the following error:
|
||||
# FATAL:proc_util.cc(36)] : Permission denied (13)
|
||||
@{PROC}/ r,
|
||||
#
|
||||
deny @{PROC}/vmstat r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
# Needed to remove the following error:
|
||||
# Failed to activate the metrics package
|
||||
# EACCES: permission denied, uv_resident_set_memory
|
||||
@{PROC}/@{pids}/stat r,
|
||||
# To remove the following error:
|
||||
# Failed to adjust OOM score of renderer with pid : Permission denied
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
owner @{PROC}/@{pids}/task/ r,
|
||||
owner @{PROC}/@{pids}/task/@{tid}/status r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
deny @{sys}/devices/virtual/tty/tty[0-9]/active r,
|
||||
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
@{sys}/kernel/mm/transparent_hugepage/enabled r,
|
||||
|
||||
# To remove the following error:
|
||||
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
|
||||
# The irq file is needed to render pages.
|
||||
deny @{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
owner /tmp/atom-@{hex}.sock rw,
|
||||
owner "/tmp/Atom Crashes/" rw,
|
||||
owner /tmp/github-[0-9]*-[0-9]*-*.*/ rw,
|
||||
owner /tmp/github-[0-9]*-[0-9]*-*.*/** rw,
|
||||
owner /tmp/github-[0-9]*-[0-9]*-*.*/git-{credential,askpass}-atom.{js,sh} rwix,
|
||||
owner /tmp/github-[0-9]*-[0-9]*-*.*/linux-ssh-wrapper.sh rwix,
|
||||
owner /tmp/github-[0-9]*-[0-9]*-*.*/gpg-wrapper.sh rwix,
|
||||
owner /tmp/apm-install-dir-[0-9]*-[0-9]*-*.*/ rw,
|
||||
owner /tmp/apm-install-dir-[0-9]*-[0-9]*-*.*/** rw,
|
||||
owner /tmp/net-export/ rw,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
|
||||
@{bin}/gpg{,2} mr,
|
||||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
/usr/share/atom/** r,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{bin}/{,ba,da}sh rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/atom>
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue