diff --git a/apparmor.d/groups/apps/atom b/apparmor.d/groups/apps/atom deleted file mode 100644 index 52929603..00000000 --- a/apparmor.d/groups/apps/atom +++ /dev/null @@ -1,186 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /usr/share/atom{,-beta,-nightly,-dev}/atom @{bin}/atom -profile atom @{exec_path} { - include - include - include - include - include - include - include - include - include - include - # The following doesn't seem to be needed - ##include - ##include - ##include - ##include - include - ##include - ##include - - ptrace (read) peer=lsb_release, - ptrace (read) peer=xdg-settings, - - @{exec_path} mrix, - - /usr/share/atom/** r, - /usr/share/atom/libffmpeg.so mr, - /usr/share/atom/libnode.so mr, - /usr/share/atom/resources/**/bin/* rix, - /usr/share/atom/resources/**.node mr, - /usr/share/atom/resources/**/libexec/** rix, - - deny /{usr/,}local/bin/ r, - deny @{bin}/ r, - #@{bin}/{,ba,da}sh rix, - #@{bin}/zsh rix, - #@{bin}/env rix, - #@{bin}/rmdir rix, - #@{bin}/{,e}grep rix, - #@{bin}/ls rix, - #@{bin}/{m,g,}awk rix, - #@{bin}/tty rix, - #@{bin}/dircolors rix, - #@{bin}/cut rix, - #@{bin}/xwininfo rix, - #@{bin}/date rix, - # The expr and uname tools are needed or Atom won't start with the following error: - # Your platform () is not supported. - @{bin}/expr rix, - @{bin}/uname rix, - # The following also are needed to start Atom - @{bin}/basename rix, - @{bin}/readlink rix, - @{bin}/dirname rix, - @{bin}/mkdir rix, - @{bin}/nohup rix, - @{bin}/cat rix, - - @{bin}/lsb_release rPx -> lsb_release, - @{bin}/xdg-open rCx -> open, - - @{bin}/xdg-settings rPx, - - @{bin}/git rPx, - - # Needed to sign commits - @{bin}/gpg{,2} rCx -> gpg, - - # /home/ r, - # Reading of the user home dir is required or the following error will be printed: - # Unexpected end of JSON input: - #owner @{HOME}/ r, - owner @{HOME}/.atom/ rw, - owner @{HOME}/.atom/** rwkl -> @{HOME}/.atom/**, - owner @{user_config_dirs}/Atom/ rw, - owner @{user_config_dirs}/Atom/** rwkl -> @{user_config_dirs}/Atom/**, - - # Git dirs - / r, - @{MOUNTS}/ r, - owner @{MOUNTS}/ r, - owner @{user_projects_dirs}/ r, - owner @{user_projects_dirs}/** rwkl -> @{user_projects_dirs}/**, - - owner @{user_config_dirs}/git/config r, - - /etc/fstab r, - - # Needed or atom gets crash with the following error: - # FATAL:proc_util.cc(36)] : Permission denied (13) - @{PROC}/ r, - # - deny @{PROC}/vmstat r, - @{PROC}/sys/kernel/yama/ptrace_scope r, - @{PROC}/@{pid}/fd/ r, - # Needed to remove the following error: - # Failed to activate the metrics package - # EACCES: permission denied, uv_resident_set_memory - @{PROC}/@{pids}/stat r, - # To remove the following error: - # Failed to adjust OOM score of renderer with pid : Permission denied - deny owner @{PROC}/@{pid}/oom_{,score_}adj rw, - owner @{PROC}/@{pids}/task/ r, - owner @{PROC}/@{pids}/task/@{tid}/status r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - deny owner @{PROC}/@{pid}/loginuid r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - deny @{sys}/devices/virtual/tty/tty[0-9]/active r, - deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r, - @{sys}/kernel/mm/transparent_hugepage/enabled r, - - # To remove the following error: - # pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied - # The irq file is needed to render pages. - deny @{sys}/devices/pci[0-9]*/**/irq r, - - owner /tmp/atom-@{hex}.sock rw, - owner "/tmp/Atom Crashes/" rw, - owner /tmp/github-[0-9]*-[0-9]*-*.*/ rw, - owner /tmp/github-[0-9]*-[0-9]*-*.*/** rw, - owner /tmp/github-[0-9]*-[0-9]*-*.*/git-{credential,askpass}-atom.{js,sh} rwix, - owner /tmp/github-[0-9]*-[0-9]*-*.*/linux-ssh-wrapper.sh rwix, - owner /tmp/github-[0-9]*-[0-9]*-*.*/gpg-wrapper.sh rwix, - owner /tmp/apm-install-dir-[0-9]*-[0-9]*-*.*/ rw, - owner /tmp/apm-install-dir-[0-9]*-[0-9]*-*.*/** rw, - owner /tmp/net-export/ rw, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - - profile gpg { - include - include - include - include - - @{bin}/gpg{,2} mr, - - owner @{HOME}/@{XDG_GPG_DIR}/ rw, - owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, - - # file_inherit - owner @{HOME}/.xsession-errors w, - /usr/share/atom/** r, - - } - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{bin}/{,ba,da}sh rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - - include if exists -}