From 81b9de3aff77bb79fa72aa3a0a40b6ff71e6b738 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Mar 2024 15:44:40 +0000 Subject: [PATCH] feat(profile): use the new audio-client abs in profiles. --- .../groups/browsers/firefox-kmozillahelper | 10 +--- apparmor.d/groups/kde/kalendarac | 9 +-- apparmor.d/groups/kde/plasma-discover | 2 +- apparmor.d/groups/ubuntu/apport-gtk | 11 +--- apparmor.d/groups/ubuntu/update-manager | 9 +-- apparmor.d/profiles-a-f/cawbird | 11 ++-- apparmor.d/profiles-a-f/element-desktop | 3 +- apparmor.d/profiles-g-l/kodi | 59 ++++++------------- apparmor.d/profiles-m-r/mono-sgen | 15 +---- apparmor.d/profiles-m-r/pavucontrol | 19 +++--- apparmor.d/profiles-m-r/qtox | 59 ++++--------------- 11 files changed, 53 insertions(+), 154 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index 25c9909a..a47bef7c 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -9,12 +9,11 @@ include @{exec_path} = @{lib}/mozilla/kmozillahelper profile firefox-kmozillahelper @{exec_path} { include - include - include + include + include include include include - include include include @@ -29,10 +28,7 @@ profile firefox-kmozillahelper @{exec_path} { /usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/knotifications{5,6}/*.notifyrc r, /usr/share/kservices{5,6}/{,**} r, - /usr/share/sounds/{,**} r, - /etc/pulse/client.conf r, - /etc/pulse/client.conf.d/{,*} r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, /etc/xdg/menus/ r, @@ -51,10 +47,8 @@ profile firefox-kmozillahelper @{exec_path} { owner @{user_config_dirs}/kmozillahelperrc r, owner @{user_config_dirs}/kmozillahelperrc.@{rand6} rwl, owner @{user_config_dirs}/kwinrc r, - owner @{user_config_dirs}/pulse/cookie rk, owner @{run}/user/@{uid}/kmozillahelper@{rand6}.@{int}.kioworker.socket wl, - owner @{run}/user/@{uid}/pulse/ r, owner @{run}/user/@{uid}/xauth_@{rand6} rl, @{run}/udev/data/+usb:* r, # For /dev/bus/usb/** diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index 4771b819..fc1cb49f 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -9,9 +9,10 @@ include @{exec_path} = @{bin}/kalendarac profile kalendarac @{exec_path} { include + include include - include include + include @{exec_path} mr, @@ -20,11 +21,8 @@ profile kalendarac @{exec_path} { /usr/share/akonadi/firstrun/{,*} r, /usr/share/akonadi/plugins/serializer/{,*.desktop} r, /usr/share/knotifications{5,6}/{,**} r, - /usr/share/sounds/{,**} r, /etc/machine-id r, - /etc/pulse/client.conf r, - /etc/pulse/client.conf.d/{,**} r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -37,9 +35,6 @@ profile kalendarac @{exec_path} { owner @{user_config_dirs}/kalendaracrc.@{rand6} rwl, owner @{user_config_dirs}/kalendaracrc.lock rwk, owner @{user_config_dirs}/kmail2rc r, - owner @{user_config_dirs}/pulse/cookie rk, - - owner @{run}/user/@{uid}/pulse/ r, @{PROC}/sys/kernel/core_pattern r, diff --git a/apparmor.d/groups/kde/plasma-discover b/apparmor.d/groups/kde/plasma-discover index 029838f1..2b91d0cc 100644 --- a/apparmor.d/groups/kde/plasma-discover +++ b/apparmor.d/groups/kde/plasma-discover @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/plasma-discover profile plasma-discover @{exec_path} { include + include include include include @@ -46,7 +47,6 @@ profile plasma-discover @{exec_path} { /usr/share/kservices{5,6}/{,*} r, /usr/share/kservicetypes5/{,*} r, /usr/share/libdiscover/** r, - /usr/share/qt/translations/*.qm r, /etc/appstream.conf r, /etc/flatpak/remotes.d/{,**} r, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index c226b7a1..52ae40f4 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -10,6 +10,7 @@ include profile apport-gtk @{exec_path} { include include + include include include include @@ -54,11 +55,8 @@ profile apport-gtk @{exec_path} { @{lib}/@{multiarch}/ld*.so* rix, /usr/share/apport/root_info_wrapper rix, - /usr/share/alsa/{,**} r, /usr/share/apport/{,**} r, /usr/share/apport/general-hooks/*.py r, - /usr/share/themes/{,**} r, - /usr/share/X11/xkb/{,**} r, /etc/apport/{,**} r, /etc/bash_completion.d/apport_completion r, @@ -67,8 +65,6 @@ profile apport-gtk @{exec_path} { /etc/gtk-3.0/settings.ini r, /etc/init.d/apport r, /etc/logrotate.d/apport r, - /etc/pulse/client.conf r, - /etc/pulse/client.conf.d/{,**} r, /etc/xdg/autostart/*.desktop r, /var/crash/{,*.@{uid}.crash} rw, @@ -78,10 +74,7 @@ profile apport-gtk @{exec_path} { /var/lib/dpkg/info/*.md5sums r, /var/log/installer/media-info r, - owner @{user_config_dirs}/pulse/cookie rk, - - @{run}/snapd.socket rw, - owner @{run}/user/.mutter-Xwaylandauth.@{rand6} rw, + @{run}/snapd.socket rw, /tmp/[a-z0-9]* rw, /tmp/apport_core_* rw, diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index e5275391..a79ba5d5 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -10,6 +10,7 @@ include profile update-manager @{exec_path} flags=(attach_disconnected) { include include + include include include include @@ -59,8 +60,6 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { /usr/share/update-manager/{,**} r, /etc/gtk-3.0/settings.ini r, - /etc/pulse/client.conf r, - /etc/pulse/client.conf.d/{,**} r, /etc/ubuntu-advantage/uaclient.conf r, /etc/update-manager/{,**} r, @@ -74,11 +73,6 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/update-manager-core/{,**} rw, - owner @{user_config_dirs}/pulse/cookie rk, - - owner @{run}/user/@{uid}/pulse/ r, - owner @{run}/user/@{uid}/pulse/native rw, - @{run}/systemd/inhibit/*.ref w, @{PROC}/@{pids}/mountinfo r, @@ -86,7 +80,6 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, /dev/ptmx rw, - /dev/shm/ r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, diff --git a/apparmor.d/profiles-a-f/cawbird b/apparmor.d/profiles-a-f/cawbird index bead485c..6ebd2105 100644 --- a/apparmor.d/profiles-a-f/cawbird +++ b/apparmor.d/profiles-a-f/cawbird @@ -10,16 +10,16 @@ include @{exec_path} = @{bin}/cawbird profile cawbird @{exec_path} { include + include include - include - include + include include + include include + include + include include include - include - include - include network inet dgram, network inet6 dgram, @@ -47,7 +47,6 @@ profile cawbird @{exec_path} { owner @{PROC}/@{pid}/fd/ r, - profile open { include include diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index 89b290fb..ecee0b29 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/element-desktop profile element-desktop @{exec_path} { include + include include include include @@ -49,8 +50,6 @@ profile element-desktop @{exec_path} { owner @{user_config_dirs}/Element/ rw, owner @{user_config_dirs}/Element/** rwkl -> @{user_config_dirs}/Element/**, - owner @{user_config_dirs}/pulse/client.conf r, - owner @{user_config_dirs}/pulse/cookie rk, @{sys}/devices/system/cpu/kernel_max r, @{sys}/devices/virtual/tty/tty@{int}/active r, diff --git a/apparmor.d/profiles-g-l/kodi b/apparmor.d/profiles-g-l/kodi index 3a725fca..55beb1b6 100644 --- a/apparmor.d/profiles-g-l/kodi +++ b/apparmor.d/profiles-g-l/kodi @@ -10,14 +10,12 @@ include @{exec_path} = @{bin}/kodi @{lib}/@{multiarch}/kodi/kodi.bin profile kodi @{exec_path} { include - include - include - include - include + include + include include - include include include + include @{exec_path} mr, @@ -29,6 +27,7 @@ profile kodi @{exec_path} { @{bin}/cat rix, @{bin}/cut rix, @{bin}/date rix, + @{bin}/df rix, @{bin}/dirname rix, @{bin}/find rix, @{bin}/ldconfig rix, @@ -36,9 +35,14 @@ profile kodi @{exec_path} { @{bin}/uname rix, @{bin}/lsb_release rPx -> lsb_release, - @{bin}/df rCx -> df, /usr/share/kodi/{,**} r, + /usr/share/publicsuffix/* r, + + /etc/fstab r, + /etc/machine-id r, + /etc/timezone r, + /var/lib/dbus/machine-id r, owner @{HOME}/.kodi/ rw, owner @{HOME}/.kodi/** rwk, @@ -46,49 +50,20 @@ profile kodi @{exec_path} { owner @{HOME}/core w, owner @{HOME}/kodi_crashlog-@{int}_@{int}.log w, - owner @{HOME}/.icons/default/index.theme r, - - /usr/share/publicsuffix/* r, - - /usr/share/icons/*/index.theme r, - /etc/mime.types r, - - /etc/timezone r, - /etc/fstab r, - - owner @{PROC}/@{pid}/mounts r, - @{PROC}/@{pid}/net/dev r, - @{PROC}/sys/kernel/core_pattern r, - @{PROC}/@{pid}/net/route r, + @{run}/udev/data/* r, @{sys}/**/ r, - @{sys}/devices/**/uevent r, @{sys}/devices/@{pci}/usb@{int}/{bDeviceClass,idProduct,idVendor} r, @{sys}/devices/@{pci}/usb@{int}/**/{bDeviceClass,idProduct,idVendor} r, - @{sys}/devices/system/node/ r, - @{sys}/devices/system/node/node@{int}/meminfo r, + @{sys}/devices/**/uevent r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r, @{sys}/devices/virtual/thermal/thermal_zone@{int}/temp r, - @{run}/udev/data/* r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - profile df { - include - - @{bin}/df mr, - - owner @{PROC}/@{pid}/mountinfo r, - - # file_inherit - /usr/share/kodi/** r, - /sys/devices/virtual/thermal/thermal_zone@{int}/temp r, - /sys/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r, - /home/morfik/.kodi/temp/kodi.log w, - - } + @{PROC}/@{pid}/net/dev r, + @{PROC}/@{pid}/net/route r, + @{PROC}/sys/kernel/core_pattern r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/mountinfo r, include if exists } diff --git a/apparmor.d/profiles-m-r/mono-sgen b/apparmor.d/profiles-m-r/mono-sgen index c64fd661..09ae2bcf 100644 --- a/apparmor.d/profiles-m-r/mono-sgen +++ b/apparmor.d/profiles-m-r/mono-sgen @@ -9,14 +9,12 @@ include @{exec_path} = @{bin}/mono-sgen profile mono-sgen @{exec_path} { include - include - include - include + include include - include + include include include - include + include network inet dgram, network inet6 dgram, @@ -37,18 +35,11 @@ profile mono-sgen @{exec_path} { owner @{user_config_dirs}/openra/{,**} rw, owner @{user_config_dirs}/.mono/{,**} r, - owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw, owner /tmp/*.* rw, owner /tmp/CASESENSITIVETEST* rw, owner /dev/shm/mono.* rw, - @{sys}/devices/@{pci}/uevent r, - @{sys}/devices/@{pci}/vendor r, - @{sys}/devices/@{pci}/device r, - @{sys}/devices/@{pci}/subsystem_vendor r, - @{sys}/devices/@{pci}/subsystem_device r, - owner @{PROC}/@{pid}/fd/ r, include if exists diff --git a/apparmor.d/profiles-m-r/pavucontrol b/apparmor.d/profiles-m-r/pavucontrol index 9bf7292d..0ea2b04a 100644 --- a/apparmor.d/profiles-m-r/pavucontrol +++ b/apparmor.d/profiles-m-r/pavucontrol @@ -10,28 +10,23 @@ include @{exec_path} = @{bin}/pavucontrol profile pavucontrol @{exec_path} { include - include - include + include include + include include - include + include @{exec_path} mr, - # Pavucontrol files - /usr/share/pavucontrol/pavucontrol.glade r, - - # Pavucontrol config files - owner @{user_config_dirs}/ r, - owner @{user_config_dirs}/pavucontrol.ini* rw, + /usr/share/pavucontrol/** r, /var/lib/dbus/machine-id r, /etc/machine-id r, - owner @{PROC}/@{pid}/cmdline r, + owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/pavucontrol.ini* rw, - # Missing icons - /usr/share/**/icons/**/*.png r, + owner @{PROC}/@{pid}/cmdline r, # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-m-r/qtox b/apparmor.d/profiles-m-r/qtox index 25e6890d..74408fe6 100644 --- a/apparmor.d/profiles-m-r/qtox +++ b/apparmor.d/profiles-m-r/qtox @@ -10,18 +10,14 @@ include @{exec_path} = @{bin}/qtox profile qtox @{exec_path} { include - include - include - include - include - include + include + include include - include - include - include - include + include + include include - include + include + include network inet dgram, network inet6 dgram, @@ -31,7 +27,12 @@ profile qtox @{exec_path} { @{exec_path} mr, - @{bin}/xdg-open rCx -> open, + @{open_path} rPx -> child-open, + + /usr/share/qt5ct/** r, + + /var/lib/dbus/machine-id r, + /etc/machine-id r, # For importing old profile owner @{HOME}/**.tox r, @@ -51,50 +52,14 @@ profile qtox @{exec_path} { # To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration owner @{user_config_dirs}/qt5ct/{,**} r, - /usr/share/qt5ct/** r, owner @{PROC}/@{pid}/cmdline r, @{PROC}/sys/kernel/core_pattern r, # for KCrash::initialize() - /usr/share/hwdata/pnp.ids r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - owner /tmp/qipc_{systemsem,sharedmemory}_*@{hex} rw, - @{sys}/devices/system/node/ r, # for ld-linux-x86-64.so -> libnuma1.so - @{sys}/devices/system/node/node@{int}/meminfo r, # for ld-linux-x86-64.so -> libnuma1.so - /dev/ r, /dev/video@{int} rw, - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - @{bin}/viewnior rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - owner @{user_cache_dirs}/qTox/qtox.log w, - deny /dev/video@{int} rw, - - } - include if exists }