diff --git a/apparmor.d/profiles-s-z/spacefm b/apparmor.d/profiles-s-z/spacefm deleted file mode 100644 index e7a1eb16..00000000 --- a/apparmor.d/profiles-s-z/spacefm +++ /dev/null @@ -1,98 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2020-2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/spacefm -profile spacefm @{exec_path} { - include - include - include - include - include - include - include - include - include - - # This should be tightened when the "profile has merged rule with conflicting x modifiers" error - # will be fixed. (#FIXME#) - include - include - - # For root window - deny capability dac_read_search, - deny capability dac_override, - - # Needed? - deny capability sys_nice, - - # SpaceFM needs this for killing/terminating processes it initiates. - signal (send) set=(term, kill), - - network inet stream, - network inet6 stream, - network netlink raw, - - @{exec_path} mr, - - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/cgroup r, - - @{sys}/bus/ r, - @{sys}/class/ r, - - @{sys}/devices/system/node/ r, - @{sys}/devices/system/node/node@{int}/meminfo r, - - @{sys}/fs/cgroup/{,**} r, - - # To read/write files in the system. The read permission is granted for all files, the write - # permission only for the owner. Also, dirs like /dev/, /efi/, /proc/, /sys/ are not included in - # the list. - / r, - /boot/ r, - /boot/** r, - owner /boot/** rw, - /etc/ r, - /etc/** r, - owner /etc/** rw, - /home/ r, - /home/** r, - /home/** rw, - /lost+found/ r, - /lost+found/** r, - owner /lost+found/** rw, - @{MOUNTS}/ r, - @{MOUNTS}/** r, - owner @{MOUNTS}/** rw, - /opt/ r, - /opt/** r, - owner /opt/** rw, - /root/ r, - /root/** r, - owner /root/** rw, - @{run}/ r, - @{run}/** r, - owner @{run}/** rw, - /srv/ r, - /srv/** r, - owner /srv/** rw, - /tmp/ r, - /tmp/** r, - owner /tmp/** rw, - /usr/ r, - /usr/** r, - owner /usr/** rw, - /var/ r, - /var/** r, - owner /var/** rw, - - include if exists -}