mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-15 16:03:51 +01:00
feat(profile): removed unused profile: spacefm.
This commit is contained in:
parent
a20360fd7d
commit
8348e1dbb5
@ -1,98 +0,0 @@
|
|||||||
# apparmor.d - Full set of apparmor profiles
|
|
||||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
|
||||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
|
||||||
|
|
||||||
abi <abi/3.0>,
|
|
||||||
|
|
||||||
include <tunables/global>
|
|
||||||
|
|
||||||
@{exec_path} = @{bin}/spacefm
|
|
||||||
profile spacefm @{exec_path} {
|
|
||||||
include <abstractions/base>
|
|
||||||
include <abstractions/gtk>
|
|
||||||
include <abstractions/fonts>
|
|
||||||
include <abstractions/fontconfig-cache-read>
|
|
||||||
include <abstractions/freedesktop.org>
|
|
||||||
include <abstractions/nameservice-strict>
|
|
||||||
include <abstractions/thumbnails-cache-read>
|
|
||||||
include <abstractions/disks-read>
|
|
||||||
include <abstractions/consoles>
|
|
||||||
|
|
||||||
# This should be tightened when the "profile has merged rule with conflicting x modifiers" error
|
|
||||||
# will be fixed. (#FIXME#)
|
|
||||||
include <abstractions/app-launcher-user>
|
|
||||||
include <abstractions/app-launcher-root>
|
|
||||||
|
|
||||||
# For root window
|
|
||||||
deny capability dac_read_search,
|
|
||||||
deny capability dac_override,
|
|
||||||
|
|
||||||
# Needed?
|
|
||||||
deny capability sys_nice,
|
|
||||||
|
|
||||||
# SpaceFM needs this for killing/terminating processes it initiates.
|
|
||||||
signal (send) set=(term, kill),
|
|
||||||
|
|
||||||
network inet stream,
|
|
||||||
network inet6 stream,
|
|
||||||
network netlink raw,
|
|
||||||
|
|
||||||
@{exec_path} mr,
|
|
||||||
|
|
||||||
owner @{PROC}/@{pid}/mountinfo r,
|
|
||||||
owner @{PROC}/@{pid}/mounts r,
|
|
||||||
owner @{PROC}/@{pid}/fd/ r,
|
|
||||||
owner @{PROC}/@{pid}/cgroup r,
|
|
||||||
|
|
||||||
@{sys}/bus/ r,
|
|
||||||
@{sys}/class/ r,
|
|
||||||
|
|
||||||
@{sys}/devices/system/node/ r,
|
|
||||||
@{sys}/devices/system/node/node@{int}/meminfo r,
|
|
||||||
|
|
||||||
@{sys}/fs/cgroup/{,**} r,
|
|
||||||
|
|
||||||
# To read/write files in the system. The read permission is granted for all files, the write
|
|
||||||
# permission only for the owner. Also, dirs like /dev/, /efi/, /proc/, /sys/ are not included in
|
|
||||||
# the list.
|
|
||||||
/ r,
|
|
||||||
/boot/ r,
|
|
||||||
/boot/** r,
|
|
||||||
owner /boot/** rw,
|
|
||||||
/etc/ r,
|
|
||||||
/etc/** r,
|
|
||||||
owner /etc/** rw,
|
|
||||||
/home/ r,
|
|
||||||
/home/** r,
|
|
||||||
/home/** rw,
|
|
||||||
/lost+found/ r,
|
|
||||||
/lost+found/** r,
|
|
||||||
owner /lost+found/** rw,
|
|
||||||
@{MOUNTS}/ r,
|
|
||||||
@{MOUNTS}/** r,
|
|
||||||
owner @{MOUNTS}/** rw,
|
|
||||||
/opt/ r,
|
|
||||||
/opt/** r,
|
|
||||||
owner /opt/** rw,
|
|
||||||
/root/ r,
|
|
||||||
/root/** r,
|
|
||||||
owner /root/** rw,
|
|
||||||
@{run}/ r,
|
|
||||||
@{run}/** r,
|
|
||||||
owner @{run}/** rw,
|
|
||||||
/srv/ r,
|
|
||||||
/srv/** r,
|
|
||||||
owner /srv/** rw,
|
|
||||||
/tmp/ r,
|
|
||||||
/tmp/** r,
|
|
||||||
owner /tmp/** rw,
|
|
||||||
/usr/ r,
|
|
||||||
/usr/** r,
|
|
||||||
owner /usr/** rw,
|
|
||||||
/var/ r,
|
|
||||||
/var/** r,
|
|
||||||
owner /var/** rw,
|
|
||||||
|
|
||||||
include if exists <local/spacefm>
|
|
||||||
}
|
|
Loading…
Reference in New Issue
Block a user