mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): general update.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-08-20 20:56:58 +01:00
parent f14ed2f024
commit 788d865939
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
34 changed files with 57 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apparmor.d/abstractions/app/firefox
View File

@ -69,11 +69,12 @@
/usr/share/webext/{,**} r,
/usr/share/xul-ext/kwallet5/* r,
/etc/{,opensc/}opensc.conf r,
/etc/@{name}/{,**} r,
/etc/fstab r,
/etc/lsb-release r,
/etc/mailcap r,
/etc/mime.types r,
/etc/{,opensc/}opensc.conf r,
/etc/sysconfig/proxy r,
/etc/xdg/* r,
/etc/xul-ext/kwallet5.js r,
@ -96,7 +97,7 @@
owner @{tmp}/firefox/* rwk,
owner @{tmp}/Temp-@{uuid}/ rw,
owner @{tmp}/Temp-@{uuid}/* rwk,
owner @{tmp}/tmp-???.xpi rw,
owner @{tmp}/tmp-*.xpi rw,
owner @{tmp}/tmpaddon r,
owner @{tmp}/tmpaddon-@{int} r,

2
apparmor.d/abstractions/audio-client
View File

@ -5,7 +5,7 @@
# Most programs do not need access to audio devices, audio-client only includes
# configuration files to be used by client applications.
/usr/share/alsa/** r,
/usr/share/alsa/{,**} r,
/usr/share/openal/hrtf/{,**} r,
/usr/share/pipewire/client-rt.conf r,
/usr/share/pipewire/client.conf r,

4
apparmor.d/abstractions/audio-server
View File

@ -7,10 +7,6 @@
include <abstractions/audio-client>
/usr/share/alsa/{,**} r,
/etc/alsa/conf.d/{,**} r,
@{run}/udev/data/+sound:card@{int} r, # for sound card
@{sys}/class/ r,

4
apparmor.d/groups/browsers/firefox-glxtest
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{name} = firefox{,.sh,-esr,-bin}
@{lib_dirs} = @{lib}/@{name} /opt/@{name}
@{config_dirs} = @{HOME}/.mozilla/
@{cache_dirs} = @{user_cache_dirs}/mozilla/
@{exec_path} = @{lib_dirs}/glxtest
profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
@ -19,6 +20,9 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
owner @{cache_dirs}/firefox/*/startupCache/scriptCache-* r,
owner @{cache_dirs}/firefox/*/startupCache/startupCache* r,
owner @{config_dirs}/firefox/*/.parentlock rw,
owner @{tmp}/@{name}/.parentlock rw,

1
apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
View File

@ -71,6 +71,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
owner @{desktop_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rw,
owner @{HOME}/ r,
owner @{HOME}/* r,
owner @{HOME}/*/{,**} rw,
owner @{MOUNTS}/ r,

3
apparmor.d/groups/gnome/gnome-clocks
View File

@ -14,8 +14,11 @@ profile gnome-clocks @{exec_path} {
include <abstractions/bus-session>
include <abstractions/bus/org.a11y>
include <abstractions/common/gnome>
include <abstractions/gstreamer>
include <abstractions/nameservice-strict>
network netlink raw,
#aa:dbus own bus=session name=org.gnome.clocks
@{exec_path} mr,

5
apparmor.d/groups/gnome/gnome-software
View File

@ -83,6 +83,11 @@ profile gnome-software @{exec_path} {
owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/flatpak/.changed w,
owner @{user_share_dirs}/flatpak/{app,runtime}/ r,
owner @{user_share_dirs}/flatpak/{app,runtime}/*/ r,
owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/deploy r,
owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/metadata r,
owner @{user_share_dirs}/flatpak/{app,runtime}/*/*/ r,
owner @{user_share_dirs}/flatpak/repo/ rw,
owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**,
owner @{user_share_dirs}/gnome-software/{,**} rw,

2
apparmor.d/groups/gnome/gnome-system-monitor
View File

@ -38,6 +38,8 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
/usr/share/gnome-system-monitor/{,**} r,
/usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
owner @{run}/user/@{uid}/doc/ rw,
owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,

2
apparmor.d/groups/gnome/gnome-tweaks
View File

@ -16,6 +16,8 @@ profile gnome-tweaks @{exec_path} {
include <abstractions/python>
include <abstractions/thumbnails-cache-read>
network netlink raw,
@{exec_path} mr,
@{bin}/ r,

1
apparmor.d/groups/gnome/gsd-datetime
View File

@ -34,6 +34,7 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/geocode-glib/* r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/stat r,
owner /dev/tty@{int} rw,

1
apparmor.d/groups/gnome/org.gnome.NautilusPreviewer
View File

@ -47,6 +47,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/@{tid}/comm w,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
/dev/media@{int} r,

2
apparmor.d/groups/gnome/tracker-miner
View File

@ -65,7 +65,9 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
owner @{gdm_config_dirs}/dconf/user r,
owner @{gdm_share_dirs}/applications/ r,
owner /var/tmp/etilqs_@{hex15} rw,
owner /var/tmp/etilqs_@{hex16} rw,
owner @{tmp}/etilqs_@{hex15} rw,
owner @{tmp}/etilqs_@{hex16} rw,
# Allow to search user files

2
apparmor.d/groups/gvfs/gvfsd-mtp
View File

@ -21,7 +21,7 @@ profile gvfsd-mtp @{exec_path} {
@{exec_path} mr,
owner @{HOME}/{,**} rw,
owner @{HOME}/{,**} rw, # FIXME: ?
owner @{MOUNTS}/{,**} rw,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,

2
apparmor.d/groups/gvfs/gvfsd-recent
View File

@ -36,7 +36,7 @@ profile gvfsd-recent @{exec_path} {
@{exec_path} mr,
# Full access to user's data
owner @{HOME}/{,**} rw,
owner @{HOME}/{,**} rw, # FIXME: ?
owner @{MOUNTS}/{,**} rw,
owner @{HOME}/.zshenv r,

3
apparmor.d/groups/pacman/pacman
View File

@ -118,6 +118,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
/var/** rwlk -> /var/**,
# Read packages files
@{user_pkg_dirs}/ r,
@{user_pkg_dirs}/**/ r,
@{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r,
@ -193,6 +194,8 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
capability dac_read_search,
capability sys_resource,
signal send set=cont peer=child-pager,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,

1
apparmor.d/groups/virt/libvirtd
View File

@ -131,6 +131,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
/usr/share/edk2*/{,**} rk,
/usr/share/hwdata/* r,
/usr/share/iproute2/{,**} r,
/usr/share/libvirt/{,**} r,
/usr/share/mime/mime.cache r,
/usr/share/misc/pci.ids r,

1
apparmor.d/groups/virt/virtnodedevd
View File

@ -62,6 +62,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/c21:@{int} r, # Generic SCSI access
@{run}/udev/data/c29:@{int} r, # For /dev/fb[0-9]*
@{run}/udev/data/c81:@{int} r, # For video4linux
@{run}/udev/data/c89:@{int} r, # For I2C bus interface
@{run}/udev/data/c90:@{int} r, # For RAM, ROM, Flash
@{run}/udev/data/c116:@{int} r, # For ALSA
@{run}/udev/data/c202:@{int} r, # CPU model-specific registers

2
apparmor.d/groups/xfce/xfce-sensors
View File

@ -16,7 +16,7 @@ profile xfce-sensors @{exec_path} {
@{sys}/class/hwmon/ r,
@{sys}/class/power_supply/ r,
@{sys}/class/thermal/ r,
@{sys}/devices/@{pci}/i2c-@{int}/name r,
@{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r,
@{sys}/devices/**/hwmon@{int}/ r,
@{sys}/devices/**/hwmon@{int}/{name,temp*} r,
@{sys}/devices/**/hwmon@{int}/**/ r,

3
apparmor.d/profiles-a-f/engrampa
View File

@ -75,8 +75,7 @@ profile engrampa @{exec_path} {
owner @{user_share_dirs}/ r,
/tmp/ r,
owner @{tmp}/** rw,
/tmp/ r,
@{run}/mount/utab r,

5
apparmor.d/profiles-a-f/firewalld
View File

@ -44,9 +44,8 @@ profile firewalld @{exec_path} flags=(attach_disconnected) {
/usr/local/lib/python3.@{int}/dist-packages/ r,
/usr/share/libalternatives/ r,
/usr/share/libalternatives/ebtables*/{,*} r,
/usr/share/libalternatives/ip{,4,6}tables*/{,*} r,
/usr/share/iproute2/{,**} r,
/usr/share/libalternatives/{,**} r,
/etc/firewalld/{,**} rw,
/etc/iproute2/group r,

1
apparmor.d/profiles-a-f/flatpak-app
View File

@ -89,6 +89,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
owner @{run}/flatpak/app/** rw,
owner @{run}/flatpak/doc/** rw,
owner @{run}/ld-so-cache-dir/* rw,
owner @{run}/user/ r,
owner @{run}/user/@{uid}/*.kioworker.socket r,
owner @{run}/user/@{uid}/#@{int} rwl,

2
apparmor.d/profiles-g-l/htop
View File

@ -89,7 +89,7 @@ profile htop @{exec_path} {
@{sys}/class/hwmon/ r,
@{sys}/class/i2c-adapter/ r,
@{sys}/class/power_supply/ r,
@{sys}/devices/@{pci}/i2c-@{int}/name r,
@{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r,
@{sys}/devices/**/hwmon@{int}/ r,
@{sys}/devices/**/hwmon@{int}/{name,temp*} r,
@{sys}/devices/**/hwmon@{int}/**/ r,

2
apparmor.d/profiles-m-r/monitorix
View File

@ -95,7 +95,7 @@ profile monitorix @{exec_path} {
@{PROC}/@{pids}/io r,
@{sys}/class/i2c-adapter/ r,
@{sys}/devices/@{pci}/i2c-@{int}/name r,
@{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r,
@{sys}/class/hwmon/ r,
@{sys}/devices/**/thermal*/{,**} r,
@{sys}/devices/**/hwmon*/{,**} r,

2
apparmor.d/profiles-m-r/mullvad-setup
View File

@ -9,9 +9,11 @@ include <tunables/global>
@{exec_path} = /opt/Mullvad*/resources/mullvad-setup
profile mullvad-setup @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
@{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/cgroup r,
# File Inherit

1
apparmor.d/profiles-m-r/qnapi
View File

@ -55,7 +55,6 @@ profile qnapi @{exec_path} {
/tmp/ r,
owner @{tmp}/@{hex}.* rw,
owner @{tmp}/** rw,
owner @{tmp}/#@{int} rw,
owner @{tmp}/QNapi-*-rc wl -> /tmp/#@{int},
owner @{tmp}/QNapi-*-rc.lock rwk,

9
apparmor.d/profiles-s-z/YACReaderLibrary
View File

@ -14,11 +14,16 @@ profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted
include <abstractions/desktop>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5-settings-write>
include <abstractions/qt5-shader-cache>
include <abstractions/ssl_certs>
network inet dgram,
network inet stream,
network inet6 dgram,
network inet6 stream,
network netlink dgram,
network netlink raw,
@{exec_path} mr,
@ -31,6 +36,7 @@ profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted
owner @{user_books_dirs}/{,**} r,
owner @{user_books_dirs}/**/.yacreaderlibrary/{,**} rwk,
owner @{user_books_dirs}/**/None rw,
owner @{user_cache_dirs}/YACReader/ rw,
owner @{user_cache_dirs}/YACReader/YACReaderLibrary/ rw,
@ -43,7 +49,10 @@ profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted
owner @{tmp}/@{uuid} w,
@{run}/mount/utab r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mountinfo r,
include if exists <local/YACReaderLibrary>
}

2
apparmor.d/profiles-s-z/sanoid
View File

@ -27,8 +27,6 @@ profile sanoid @{exec_path} flags=(complain) {
@{run}/sanoid/sanoid_cacheupdate.lock rwk,
@{run}/sanoid/sanoid_pruning.lock rwk,
owner @{tmp}/** rw,
include if exists <local/sanoid>
}

2
apparmor.d/profiles-s-z/sensors-detect
View File

@ -27,7 +27,7 @@ profile sensors-detect @{exec_path} {
@{sys}/bus/pci/devices/ r,
@{sys}/class/i2c-adapter/ r,
@{sys}/devices/@{pci}/{class,vendor,device} r,
@{sys}/devices/@{pci}/i2c-@{int}/name r,
@{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r,
@{sys}/devices/@{pci}/modalias r,
@{sys}/devices/virtual/dmi/id/board_{version,vendor,name} r,
@{sys}/devices/virtual/dmi/id/chassis_type r,

1
apparmor.d/profiles-s-z/steam-game-proton
View File

@ -29,6 +29,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected) {
network unix stream,
signal receive peer=steam,
unix,
@{exec_path} mr,
@{bin}/bwrap mrix,

3
apparmor.d/profiles-s-z/steam-gameoverlayui
View File

@ -23,7 +23,8 @@ profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) {
network inet stream,
network inet6 stream,
network unix stream,
unix,
@{exec_path} mr,

2
apparmor.d/profiles-s-z/syncoid
View File

@ -25,8 +25,6 @@ profile syncoid @{exec_path} flags=(complain) {
/etc/mbuffer.rc r,
owner @{tmp}/** rw,
@{PROC}/@{pids}/maps r,
include if exists <local/syncoid>

2
apparmor.d/profiles-s-z/system-config-printer
View File

@ -46,8 +46,6 @@ profile system-config-printer @{exec_path} flags=(complain) {
@{run}/cups/cups.sock rw,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
owner @{tmp}/* rw,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/mountinfo r,

3
apparmor.d/profiles-s-z/waybar
View File

@ -9,7 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/waybar
profile waybar @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/app-launcher-user>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/nameservice-strict>

1
apparmor.d/tunables/multiarch.d/system
View File

@ -48,6 +48,7 @@
@{rand8}=@{rand4}@{rand4}
@{rand9}=@{rand8}@{c}
@{rand10}=@{rand8}@{rand2}
@{rand15}=@{rand8}@{rand4}@{rand2}@{c}
@{rand16}=@{rand8}@{rand8}
@{rand32}=@{rand16}@{rand16}
@{rand64}=@{rand64}@{rand64}