diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index fe69ad91..040af8fa 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -16,6 +16,8 @@ profile gimp @{exec_path} { include include + signal (send) set=(term, kill) peer=xsane-gimp, + #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @@ -23,7 +25,8 @@ profile gimp @{exec_path} { @{lib}/gimp/*/plug-ins/** rix, - @{open_path} rPx -> child-open-help, + @{bin}/xsane-gimp rPx, + @{open_path} rPx -> child-open-help, /usr/share/gimp/{,**} r, /usr/share/mypaint-data/{,**} r, diff --git a/apparmor.d/profiles-s-z/xsane-gimp b/apparmor.d/profiles-s-z/xsane-gimp new file mode 100644 index 00000000..94312bff --- /dev/null +++ b/apparmor.d/profiles-s-z/xsane-gimp @@ -0,0 +1,38 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/xsane-gimp +profile xsane-gimp /{,usr/}{,s}bin/xsane-gimp { + include + include + include + + signal (receive) set=(term, kill) peer=gimp, + + network inet dgram, + network inet6 dgram, + network netlink raw, + + @{exec_path} mr, + @{system_share_dirs}/gimp/{,**} r, + @{system_share_dirs}/sane/xsane/{,**} r, + @{system_share_dirs}/snmp/mibs/{,**} r, # network + /etc/sane.d/{,**} r, + owner @{HOME}/.sane/{,**} rw, + owner @{tmp}/xsane-* rw, + @{sys}/devices/@{pci}/{model,type,vendor} r, + @{PROC}/sys/dev/parport/{,parport@{int}/{base-addr,irq}} r, + + # SCSI + @{sys}/bus/scsi/devices/ r, + @{PROC}/scsi/scsi r, + + include if exists +} + +# vim:syntax=apparmor