mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): add totem.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-06-24 18:01:41 +01:00
parent 09bcdf20d8
commit 8da557ba04
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 86 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

85
apparmor.d/profiles-s-z/totem Normal file
View File

@ -0,0 +1,85 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/totem
profile totem @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/bus-accessibility>
include <abstractions/bus/org.a11y>
include <abstractions/bus/org.freedesktop.ScreenSaver>
include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/common/gnome>
include <abstractions/gstreamer>
include <abstractions/user-download-strict>
network netlink raw,
signal (send) set=(kill) peer=totem//bwrap,
#aa:dbus own bus=session name=org.mpris.MediaPlayer2.totem
#aa:dbus talk bus=session name=org.gnome.Nautilus label=nautilus
#aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon
#aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
@{exec_path} mr,
@{bin}/bwrap rCx -> bwrap,
/usr/share/xml/iso-codes/{,**} r,
/usr/share/grilo-plugins/{,**} r,
/usr/share/thumbnailers/{,**} r,
owner @{user_music_dirs}/{,**} rw,
owner @{user_pictures_dirs}/{,**} rw,
owner @{user_torrents_dirs}/{,**} rw,
owner @{user_videos_dirs}/{,**} rw,
owner @{user_cache_dirs}/gnome-desktop-thumbnailer/gstreamer-1.0/{,**} r,
owner @{user_share_dirs}/grilo-plugins/ rw,
owner @{user_share_dirs}/grilo-plugins/** rwlk,
owner @{tmp}/flatpak-seccomp-@{rand6} rw,
owner @{tmp}/gnome-desktop-thumbnailer-@{rand6}/{,**} rw,
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=** r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/task/@{tid}/comm w,
deny @{user_share_dirs}/gvfs-metadata/* r,
profile bwrap flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/common/bwrap>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gstreamer>
capability dac_override,
@{bin}/bwrap mr,
@{bin}/totem-video-thumbnailer rix,
owner @{tmp}/flatpak-seccomp-@{rand6} rw,
owner @{tmp}/gnome-desktop-file-to-thumbnail.* rw,
owner @{user_cache_dirs}/gnome-desktop-thumbnailer/{,**} rw,
@{PROC}/sys/vm/mmap_min_addr r,
owner @{PROC}/@{pid}/task/@{tid}/comm w,
/dev/ r,
include if exists <local/totem_bwrap>
}
include if exists <local/totem>
}
# vim:syntax=apparmor

1
dists/flags/main.flags
View File

@ -356,6 +356,7 @@ systemd-udevd attach_disconnected,complain
systemd-user-sessions complain
systemd-userwork attach_disconnected,complain
systemsettings complain
totem attach_disconnected,complain
tracker-writeback complain
udev-dmi-memory-id complain
udisksctl complain