mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): add inital version of dolphin.

Browse source
This commit is contained in:
Alexandre Pujol 2023-08-27 15:24:54 +01:00
parent ad3e5a5dcf
commit 7a5096e7d8
Failed to generate hash of commit
2 changed files with 80 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
apparmor.d/groups/kde/dolphin Normal file
View file

@ -0,0 +1,78 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/dolphin
profile dolphin @{exec_path} {
include <abstractions/base>
include <abstractions/deny-sensitive-home>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
network netlink raw,
signal (send) set=(term) peer=kioslave5,
@{exec_path} mr,
@{bin}/konsole rPUx,
@{bin}/ldd rix,
@{lib}/kf5/kioslave5 rPx,
/usr/share/kf5/kmoretools/{,**} r,
/usr/share/kio/{,**} r,
/usr/share/kservices5/{,**} r,
/usr/share/mime/ r,
/etc/fstab r,
/etc/xdg/arkrc r,
/etc/machine-id r,
# Full access to user's data
/ r,
owner @{HOME}/{,**} rw,
# Silence non user's data
deny /boot/{,**} r,
deny /opt/{,**} r,
deny /root/{,**} r,
deny /tmp/.* rw,
deny /tmp/.*/{,**} rw,
owner @{user_share_dirs}/dolphin/ rw,
owner @{user_share_dirs}/dolphin/** rwkl -> @{user_share_dirs}/dolphin/#@{int},
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/dolphinrc rw,
owner @{user_config_dirs}/dolphinrc.@{rand6} rwl -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/dolphinrc.lock rwk,
owner @{user_config_dirs}/kde.org/#@{int} rw,
owner @{user_config_dirs}/kde.org/UserFeedback.org.kde.dolphin.conf rw,
owner @{user_config_dirs}/kde.org/UserFeedback.org.kde.dolphin.conf.@{rand6} rwlk -> @{user_config_dirs}/kde.org/#@{int},
owner @{user_config_dirs}/kde.org/UserFeedback.org.kde.dolphin.conf.lock rwk,
owner @{user_config_dirs}/session/ rw,
owner @{user_config_dirs}/session/#@{int} rw,
owner @{user_config_dirs}/session/dolphin_* rwlk -> @{user_config_dirs}/session/#@{int},
@{run}/mount/utab r,
owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int},
owner @{run}/user/@{uid}/#@{int} rw,
@{PROC}/sys/kernel/core_pattern r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
/dev/tty r,
include if exists <local/dolphin>
}

6
dists/flags/main.flags
View file

@ -8,10 +8,6 @@ akonadi_agent_server complain
akonadi_akonotes_resource complain
akonadi_archivemail_agent complain
akonadi_birthdays_resource complain
akonadi_contacts_resource complain
akonadi_control complain
akonadi_davgroupware_resource complain
akonadi_etesync_resource complain
akonadi_ews_resource complain
akonadi_ewsmta_resource complain
akonadi_followupreminder_agent complain
@ -85,9 +81,11 @@ cups-backend-usb complain
cups-browsed complain
cups-pk-helper-mechanism complain
cupsd attach_disconnected,complain
DiscoverNotifier complain
dkms attach_disconnected,complain
docker-proxy complain
dockerd attach_disconnected,complain
dolphin complain
downloadhelper complain
drkonqi complain
e2fsck complain