mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(abs): improve some common user abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2024-05-07 16:10:09 +01:00
parent eb4beb04dc
commit 9a2f4b5dbe
Failed to generate hash of commit
4 changed files with 15 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/abstractions/app-launcher-user
View file

@ -8,18 +8,13 @@
/usr/share/*/* rPUx, /usr/share/*/* rPUx,
/usr/local/bin/* rPUx, /usr/local/bin/* rPUx,
# Browsers
@{bin}/chromium rPx, @{bin}/chromium rPx,
@{brave_path} rPx, @{brave_path} rPx,
@{chrome_path} rPx, @{chrome_path} rPx,
@{chromium_path} rPx, @{chromium_path} rPx,
@{firefox_path} rPx, @{firefox_path} rPx,
@{opera_path} rPx, @{opera_path} rPx,
# Emails
@{thunderbird_path} rPx, @{thunderbird_path} rPx,
# Office
@{lib}/libreoffice/program/{soffice{,.bin},oosplash} rPUx, @{lib}/libreoffice/program/{soffice{,.bin},oosplash} rPUx,
@{bin}/ r, @{bin}/ r,

47
apparmor.d/abstractions/app-open
View file

@ -14,33 +14,15 @@
@{bin}/flatpak rPUx, @{bin}/flatpak rPUx,
@{bin}/snap rPUx, @{bin}/snap rPUx,
# Files explorer # Labeled programs
@{bin}/nautilus rPx, @{archive_viewers_path} rPUx,
@{bin}/dolphin rPx, @{browsers_path} rPx,
@{document_viewers_path} rPUx,
# Browsers @{emails_path} rPUx,
@{bin}/chromium rPx, @{file_explorers_path} rPx,
@{brave_path} rPx, @{image_viewers_path} rPUx,
@{chrome_path} rPx, @{offices_path} rPUx,
@{chromium_path} rPx, @{text_edirors_path} rPUx,
@{firefox_path} rPx,
@{opera_path} rPx,
# Text editors
@{bin}/code rPUx,
@{bin}/gedit rPUx,
@{bin}/gnome-text-editor rPUx,
/usr/share/code/{bin/,}code rPUx,
# Emails
@{thunderbird_path} rPx,
@{bin}/geany rPUx,
# Documents viewers
@{bin}/evince rPx,
@{bin}/okular rPx,
@{bin}/*{F,f}oliate rPUx,
@{bin}/YACReader rPx,
# Others # Others
@{bin}/blueman-tray rPx, @{bin}/blueman-tray rPx,
@ -48,33 +30,24 @@
@{bin}/draw.io rPUx, @{bin}/draw.io rPUx,
@{bin}/dropbox rPx, @{bin}/dropbox rPx,
@{bin}/element-desktop rPx, @{bin}/element-desktop rPx,
@{bin}/engrampa rPx,
@{bin}/eog rPUx,
@{bin}/extension-manager rPx, @{bin}/extension-manager rPx,
@{bin}/file-roller rPUx,
@{bin}/filezilla rPx, @{bin}/filezilla rPx,
@{bin}/flameshot rPx, @{bin}/flameshot rPx,
@{bin}/flatpak rPUx,
@{bin}/gimp* rPUx, @{bin}/gimp* rPUx,
@{bin}/gnome-calculator rPUx, @{bin}/gnome-calculator rPUx,
@{bin}/gnome-disk-image-mounter rPx, @{bin}/gnome-disk-image-mounter rPx,
@{bin}/gnome-disks rPx, @{bin}/gnome-disks rPx,
@{bin}/gwenview rPUx, @{bin}/gwenview rPUx,
@{bin}/kgx rPx, @{bin}/kgx rPx,
@{bin}/okular rPx,
@{bin}/qbittorrent rPx, @{bin}/qbittorrent rPx,
@{bin}/qpdfview rPx, @{bin}/qpdfview rPx,
@{bin}/smplayer rPx, @{bin}/smplayer rPx,
@{bin}/spacefm rPx,
@{bin}/steam-runtime rPUx, @{bin}/steam-runtime rPUx,
@{bin}/teams rPUx,
@{bin}/telegram-desktop rPx, @{bin}/telegram-desktop rPx,
@{bin}/transmission-gtk rPx, @{bin}/transmission-gtk rPx,
@{bin}/viewnior rPUx, @{bin}/viewnior rPUx,
@{bin}/vlc rPUx, @{bin}/vlc rPUx,
@{bin}/xarchiver rPx,
@{bin}/xbrlapi rPx, @{bin}/xbrlapi rPx,
@{bin}/yelp rPUx,
@{lib}/libreoffice/program/{soffice{,.bin},oosplash} rPUx,
include if exists <abstractions/app-open.d> include if exists <abstractions/app-open.d>

2
apparmor.d/abstractions/common/electron
View file

@ -50,6 +50,8 @@
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{user_share_dirs}/.org.chromium.Chromium.* rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6} rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw, owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonCookie w, owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonCookie w,

6
apparmor.d/abstractions/deny-sensitive-home
View file

@ -40,9 +40,9 @@
deny @{user_share_dirs}/kwalletd/{,**} mrwkl, deny @{user_share_dirs}/kwalletd/{,**} mrwkl,
# User defined private directories # User defined private directories
deny @{user_private_dirs}/** mrxwlk, deny @{user_private_dirs}/{,**} mrxwlk,
deny @{HOMEDIRS}/**/@{XDG_PRIVATE_DIR}/** mrxwlk, deny @{HOMEDIRS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk,
deny @{MOUNTS}/**/@{XDG_PRIVATE_DIR}/** mrxwlk, deny @{MOUNTS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk,
# Deny executable mapping in writable space as allowed in abstractions/fonts # Deny executable mapping in writable space as allowed in abstractions/fonts
deny @{HOME}/.{,cache/}fontconfig/ rw, deny @{HOME}/.{,cache/}fontconfig/ rw,