mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-31 07:17:22 +01:00
feat(profile): rewrite the gnome startup process.
The changes in the dbus stack required to rewrite how gnome startup is handled by our various profiles.
This commit is contained in:
Alexandre Pujol
parent
af5171e39d
commit
9be9b442a9
5 changed files with 73 additions and 88 deletions
|
|
@ -13,9 +13,8 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
capability sys_nice,
|
||||
|
||||
signal (receive) set=(term hup kill) peer=dbus-daemon,
|
||||
signal (receive) set=(term hup kill) peer=gdm*,
|
||||
signal (receive) set=(kill) peer=gdm-wayland-session//dbus,
|
||||
signal (receive) set=(term hup kill) peer=dbus-session,
|
||||
signal (receive) set=(term hup kill) peer=gdm,
|
||||
|
||||
# dbus: own bus=session name=org.freedesktop.impl.portal.PermissionStore
|
||||
|
||||
|
|
|
|||
|
|
@ -9,25 +9,15 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/{,gdm/}gdm-{x,wayland}-session
|
||||
profile gdm-session @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bash>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.systemd1-session>
|
||||
include <abstractions/bus/org.gnome.DisplayManager>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/zsh>
|
||||
|
||||
signal (receive) set=(hup term) peer=gdm-session-worker,
|
||||
signal (receive) set=(hup) peer=@{systemd},
|
||||
signal (receive) set=(term) peer=gdm,
|
||||
signal (send) set=(kill) peer=xdg-permission-store,
|
||||
signal (send) set=(term) peer=dbus-daemon,
|
||||
signal (send) set=(term) peer=dbus-run-session,
|
||||
signal (send) set=(term) peer=gnome-session-binary,
|
||||
signal (send) set=term peer=xorg,
|
||||
signal (send) set=(term) peer=dbus-session,
|
||||
signal (send) set=(term) peer=xorg,
|
||||
|
||||
dbus receive bus=session
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
|
|
@ -36,60 +26,22 @@ profile gdm-session @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/cat rix,
|
||||
@{bin}/env rix,
|
||||
@{bin}/grep rix,
|
||||
@{bin}/head rix,
|
||||
@{bin}/id rix,
|
||||
@{bin}/locale rix,
|
||||
@{bin}/locale-check rix,
|
||||
@{bin}/manpath rix,
|
||||
@{bin}/qmake rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/sort rix,
|
||||
@{bin}/tr rix,
|
||||
@{bin}/tty rix,
|
||||
@{bin}/uname rix,
|
||||
|
||||
@{bin}/{true,false} rix,
|
||||
@{bin}/dbus-daemon rix,
|
||||
@{bin}/dbus-run-session rix,
|
||||
@{bin}/dpkg-query rpx,
|
||||
@{bin}/flatpak rPUx,
|
||||
@{bin}/gjs-console rPx,
|
||||
@{bin}/gnome-session rix,
|
||||
@{bin}/gsettings rPx,
|
||||
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rix,
|
||||
@{lib}/at-spi2-registryd rix,
|
||||
@{lib}/dconf-service rPx,
|
||||
@{lib}/gnome-session-binary rPx,
|
||||
@{lib}/xdg-permission-store rPx,
|
||||
@{bin}/env rix,
|
||||
@{bin}/gnome-session rPx,
|
||||
@{bin}/dbus-run-session rPx -> dbus-session,
|
||||
@{bin}/dbus-daemon rPx -> dbus-session,
|
||||
|
||||
# only: xorg
|
||||
@{bin}/Xorg rPx,
|
||||
/etc/gdm{3,}/Prime/Default rix,
|
||||
/etc/gdm{3,}/Xsession rPx,
|
||||
@{bin}/Xorg rPx,
|
||||
/etc/gdm{3,}/Prime/Default rix,
|
||||
/etc/gdm{3,}/Xsession rPx,
|
||||
|
||||
/usr/share/dbus-1/{,**} r,
|
||||
/usr/share/dconf/profile/gdm r,
|
||||
/usr/share/defaults/at-spi2/accessibility.conf r,
|
||||
/usr/share/gdm{3,}/gdm.schemas r,
|
||||
/usr/share/gdm{3,}/greeter-dconf-defaults r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/im-config/{,**} r,
|
||||
/usr/share/libdebuginfod-common/debuginfod.sh r,
|
||||
|
||||
@{etc_ro}/profile.d/{,*} r,
|
||||
/etc/dbus-1/{,**} r,
|
||||
/etc/debuginfod/{,*} r,
|
||||
/etc/default/im-config r,
|
||||
/etc/default/locale r,
|
||||
/etc/gdm{3,}/custom.conf r,
|
||||
/etc/gdm{3,}/daemon.conf r,
|
||||
/etc/locale.conf r,
|
||||
/etc/manpath.config r,
|
||||
/etc/shells r,
|
||||
/etc/sysconfig/console r,
|
||||
/etc/sysconfig/displaymanager r,
|
||||
/etc/sysconfig/language r,
|
||||
|
|
@ -97,32 +49,16 @@ profile gdm-session @{exec_path} {
|
|||
/etc/sysconfig/proxy r,
|
||||
/etc/sysconfig/windowmanager r,
|
||||
|
||||
/var/lib/gdm{3,}/.cache/gdm/ rw,
|
||||
/var/lib/gdm{3,}/.cache/gdm/Xauthority rw,
|
||||
/var/lib/gdm{3,}/.config/dconf/user r,
|
||||
/var/lib/gdm{3,}/greeter-dconf-defaults r,
|
||||
owner /var/lib/gdm{3,}/.cache/gdm/ rw,
|
||||
owner /var/lib/gdm{3,}/.cache/gdm/Xauthority rw,
|
||||
owner /var/lib/gdm{3,}/.config/dconf/user r,
|
||||
owner /var/lib/gdm{3,}/greeter-dconf-defaults r,
|
||||
|
||||
owner @{HOME}/.alias r,
|
||||
owner @{HOME}/.i18n r,
|
||||
owner @{run}/gdm{3,}/custom.conf r,
|
||||
|
||||
@{run}/gdm{3,}/custom.conf r,
|
||||
|
||||
@{run}/systemd/userdb/ r,
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
owner @{run}/user/@{uid}/dbus-1/ rw,
|
||||
owner @{run}/user/@{uid}/dbus-1/services/ rw,
|
||||
owner @{run}/user/@{uid}/gdm/ w,
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority rw, # only: xorg
|
||||
|
||||
@{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
@{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/@{pids}/oom_score_adj rw,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gdm-session>
|
||||
|
|
|
|||
|
|
@ -35,9 +35,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
|
|||
signal (receive) set=hup peer=@{systemd},
|
||||
signal (send) set=(hup term) peer=gdm-session,
|
||||
signal (send) set=hup peer=at-spi*,
|
||||
signal (send) set=hup peer=dbus-daemon,
|
||||
signal (send) set=hup peer=dbus-run-session,
|
||||
signal (send) set=hup peer=dconf-service,
|
||||
signal (send) set=hup peer=dbus-session,
|
||||
signal (send) set=hup peer=gjs-console,
|
||||
signal (send) set=hup peer=gnome-*,
|
||||
signal (send) set=hup peer=gsd-*,
|
||||
|
|
|
|||
55
apparmor.d/groups/gnome/gnome-session
Normal file
55
apparmor.d/groups/gnome/gnome-session
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/gnome-session
|
||||
profile gnome-session @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bash>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/zsh>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/cat rix,
|
||||
@{bin}/gettext.sh r,
|
||||
@{bin}/grep rix,
|
||||
@{bin}/locale rix,
|
||||
@{bin}/locale-check rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/tr rix,
|
||||
@{bin}/tty rix,
|
||||
|
||||
@{bin}/flatpak rCx -> flatpak,
|
||||
@{bin}/gsettings rPx,
|
||||
@{lib}/gnome-session-binary rPx,
|
||||
|
||||
/usr/share/im-config/{,**} r,
|
||||
/usr/share/libdebuginfod-common/debuginfod.sh r,
|
||||
|
||||
@{etc_ro}/profile.d/{,*} r,
|
||||
/etc/debuginfod/{,*} r,
|
||||
/etc/default/im-config r,
|
||||
/etc/shells r,
|
||||
/etc/X11/Xsession.d/*im-config_launch r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
profile flatpak {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/flatpak mr,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/gnome-session_flatpak>
|
||||
}
|
||||
|
||||
include if exists <local/gnome-session>
|
||||
}
|
||||
|
|
@ -29,10 +29,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
|||
network inet6 dgram,
|
||||
network netlink raw,
|
||||
|
||||
signal (receive) set=(cont, term, hup) peer=systemd-user,
|
||||
signal (receive) set=(hup) peer=@{systemd},
|
||||
signal (receive) set=(term, hup) peer=gdm*,
|
||||
signal (send) set=(term) peer=at-spi-bus-launcher,
|
||||
signal (send) set=(term) peer=gsd-*,
|
||||
|
||||
# dbus: own bus=session name=org.gnome.SessionManager
|
||||
|
|
|
|||
Loading…
Reference in a new issue