mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fixes

Browse Source
This commit is contained in:
nobody43 2023-02-21 15:10:51 +00:00 committed by Alex
parent 01714cc4f0
commit 8b4407ca02
6 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apparmor.d/abstractions/user-download-strict
View File

@ -5,6 +5,10 @@
abi <abi/3.0>, abi <abi/3.0>,
# new user; change to 'c'
owner @{HOME}/@{XDG_DESKTOP_DIR}/ w,
owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ w,
owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/** rwkl -> @{HOME}/@{XDG_DESKTOP_DIR}/**, owner @{HOME}/@{XDG_DESKTOP_DIR}/** rwkl -> @{HOME}/@{XDG_DESKTOP_DIR}/**,

6
apparmor.d/groups/browsers/firefox
View File

@ -7,12 +7,12 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{firefox_name} = firefox{,-esr} @{firefox_name} = firefox{,-esr,-bin}
@{firefox_lib_dirs} = /{usr/,}lib{,32,64}/@{firefox_name} /opt/@{firefox_name} @{firefox_lib_dirs} = /{usr/,}lib{,32,64}/@{firefox_name} /opt/@{firefox_name}
@{firefox_config_dirs} = @{HOME}/.mozilla/ @{firefox_config_dirs} = @{HOME}/.mozilla/
@{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/ @{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}{-bin,} @{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}
profile firefox @{exec_path} flags=(attach_disconnected) { profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/audio> include <abstractions/audio>
@ -173,8 +173,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
/etc/xul-ext/kwallet5.js r, /etc/xul-ext/kwallet5.js r,
owner @{HOME}/ r, owner @{HOME}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/ w,
owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ w,
owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw, owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,

6
apparmor.d/profiles-g-l/loginctl → apparmor.d/groups/systemd/loginctl
View File

@ -1,4 +1,5 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -9,12 +10,17 @@ include <tunables/global>
profile loginctl @{exec_path} { profile loginctl @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/systemd-common>
capability sys_resource, capability sys_resource,
capability net_admin, capability net_admin,
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/less rPx -> child-pager,
/{usr/,}bin/more rPx -> child-pager,
/{usr/,}bin/pager rPx -> child-pager,
dbus (send) bus=system path=/org/freedesktop/login[0-9]* dbus (send) bus=system path=/org/freedesktop/login[0-9]*
interface=org.freedesktop.login[0-9]*.Manager interface=org.freedesktop.login[0-9]*.Manager
member={ListSessions,GetSession} member={ListSessions,GetSession}

9
apparmor.d/groups/virt/virtiofsd
View File

@ -5,9 +5,6 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{LOCAL_SHARED_DIRS} = /var/lib/libvirt/shared
include if exists <local/tunables/virtiofsd>
@{exec_path} = /{,usr/}lib/qemu/virtiofsd @{exec_path} = /{,usr/}lib/qemu/virtiofsd
profile virtiofsd @{exec_path} flags=(attach_disconnected) { profile virtiofsd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
@ -39,9 +36,9 @@ profile virtiofsd @{exec_path} flags=(attach_disconnected) {
/var/lib/libvirt/qemu/*/fs[0-9]*-fs.sock rw, /var/lib/libvirt/qemu/*/fs[0-9]*-fs.sock rw,
# shared folders # shared folders
mount options=(rw, rbind) -> @{LOCAL_SHARED_DIRS}/, mount options=(rw, rbind) -> @{user_vm_shares}/,
pivot_root @{LOCAL_SHARED_DIRS}/, pivot_root @{user_vm_shares}/,
@{LOCAL_SHARED_DIRS}/ r, @{user_vm_shares}/ r,
include if exists <local/virtiofsd> include if exists <local/virtiofsd>
} }

2
apparmor.d/profiles-m-r/remmina
View File

@ -135,7 +135,7 @@ profile remmina @{exec_path} {
/etc/gtk-3.0/settings.ini r, /etc/gtk-3.0/settings.ini r,
/usr/share/themes/{,**} r, /usr/share/themes/{,**} r,
# X-strict # X-tiny
owner @{HOME}/.Xauthority r, owner @{HOME}/.Xauthority r,
owner @{HOME}/.xsession-errors w, owner @{HOME}/.xsession-errors w,
unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*", label="{xorg,xkbcomp}"), unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*", label="{xorg,xkbcomp}"),

2
apparmor.d/tunables/xdg-user-dirs
View File

@ -29,6 +29,7 @@
@{XDG_TORRENTS_DIR}="Torrents" @{XDG_TORRENTS_DIR}="Torrents"
@{XDG_GAMES_DIR}=".games" @{XDG_GAMES_DIR}=".games"
@{XDG_VM_DIR}=".vm" @{XDG_VM_DIR}=".vm"
@{XDG_VM_SHARES}="VM Shares"
@{XDG_WALLPAPERS_DIR}="@{XDG_PICTURES_DIR}/Wallpapers" @{XDG_WALLPAPERS_DIR}="@{XDG_PICTURES_DIR}/Wallpapers"
@{XDG_IMG_DIR}="images" @{XDG_IMG_DIR}="images"
@ -72,6 +73,7 @@
@{user_torrents_dirs}=@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR} @{user_torrents_dirs}=@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}
@{user_videos_dirs}=@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR} @{user_videos_dirs}=@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR}
@{user_vm_dirs}=@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR} @{user_vm_dirs}=@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}
@{user_vm_shares}=@{HOME}/@{XDG_VM_SHARES} @{MOUNTS}/@{XDG_VM_SHARES}
@{user_work_dirs}=@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR} @{user_work_dirs}=@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR}
@{user_password_store_dirs}=@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR} @{user_password_store_dirs}=@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}