mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-30 06:45:10 +01:00
update apparmor profiles
This commit is contained in:
Mikhail Morfikov
Alexandre Pujol
parent
fb63699153
commit
9eecac80a2
44 changed files with 520 additions and 47 deletions
|
|
@ -28,17 +28,22 @@
|
|||
/var/cache/fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} r,
|
||||
/var/cache/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} r,
|
||||
|
||||
#owner @{HOME}/.fonts/ r,
|
||||
deny @{HOME}/.fonts/ w,
|
||||
owner @{HOME}/.fonts/.uuid{,.NEW,.LCK,.TMP-*} r,
|
||||
deny @{HOME}/.fonts/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
|
||||
# This is to create .uuid file containing an UUID at a font directory. The UUID will be used to
|
||||
# identify the font directory and is used to determine the cache filename if available.
|
||||
# owner /usr/local/share/fonts/ r,
|
||||
owner /usr/local/share/fonts/.uuid r,
|
||||
deny /usr/local/share/fonts/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
/usr/share/**/.uuid r,
|
||||
deny /usr/share/**/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
|
||||
# For Google Fonts downloaded via font-manager
|
||||
owner "@{user_share_dirs}/fonts/Google Fonts/.uuid" r,
|
||||
deny "@{user_share_dirs}/fonts/Google Fonts/.uuid{,.NEW,.LCK,.TMP-*}" w,
|
||||
owner "@{user_share_dirs}/fonts/Google Fonts/**/.uuid" r,
|
||||
deny "@{user_share_dirs}/fonts/Google Fonts/**/.uuid{,.NEW,.LCK,.TMP-*}" w,
|
||||
# For fonts downloaded via font-manager
|
||||
# owner "@{user_share_dirs}/fonts/ r,
|
||||
owner "@{user_share_dirs}/fonts/**/.uuid" r,
|
||||
deny "@{user_share_dirs}/fonts/**/.uuid{,.NEW,.LCK,.TMP-*}" w,
|
||||
|
||||
include if exists <abstractions/fontconfig-cache-read.d>
|
||||
include if exists <abstractions/fontconfig-cache-read.d>
|
||||
|
|
|
|||
|
|
@ -12,17 +12,23 @@
|
|||
owner @{HOME}/.fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} rw,
|
||||
owner @{HOME}/.fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rwk,
|
||||
|
||||
owner @{HOME}/.fonts/ rw,
|
||||
link @{HOME}/.fonts/.uuid.LCK -> @{HOME}/.fonts/.uuid.TMP-*,
|
||||
owner @{HOME}/.fonts/.uuid{,.NEW,.LCK,.TMP-*} r,
|
||||
owner @{HOME}/.fonts/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
|
||||
# This is to create .uuid file containing an UUID at a font directory. The UUID will be used to
|
||||
# identify the font directory and is used to determine the cache filename if available.
|
||||
owner /usr/local/share/fonts/ rw,
|
||||
owner /usr/local/share/fonts/.uuid{,.NEW,.LCK,.TMP-*} rw,
|
||||
link /usr/local/share/fonts/.uuid.LCK -> /usr/local/share/fonts/.uuid.TMP-*,
|
||||
# Should writing to these dirs be blocked?
|
||||
/usr/share/**/.uuid{,.NEW,.LCK,.TMP-*} r,
|
||||
deny /usr/share/**/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
|
||||
# For Google Fonts downloaded via font-manager (###FIXME### when they fix resolving of vars)
|
||||
owner "@{user_share_dirs}/fonts/Google Fonts/.uuid{,.NEW,.LCK,.TMP-*}" rw,
|
||||
link "@{user_share_dirs}/fonts/Google Fonts/.uuid.LCK" -> "/home/*/.local/share/fonts/Google Fonts/.uuid.TMP-*",
|
||||
owner "@{user_share_dirs}/fonts/Google Fonts/**/.uuid{,.NEW,.LCK,.TMP-*}" rw,
|
||||
link "@{user_share_dirs}/fonts/Google Fonts/**/.uuid.LCK" -> "/home/*/.local/share/fonts/Google Fonts/**/.uuid.TMP-*",
|
||||
# For fonts downloaded via font-manager (###FIXME### when they fix resolving of vars)
|
||||
owner @{user_share_dirs}/fonts/ rw,
|
||||
owner @{user_share_dirs}/fonts/**/.uuid{,.NEW,.LCK,.TMP-*} rw,
|
||||
link @{user_share_dirs}/fonts/**/.uuid.LCK -> /home/*/.local/share/fonts/**/.uuid.TMP-*,
|
||||
|
||||
include if exists <abstractions/fontconfig-cache-write.d>
|
||||
include if exists <abstractions/fontconfig-cache-write.d>
|
||||
|
|
|
|||
21
apparmor.d/abstractions/video
Normal file
21
apparmor.d/abstractions/video
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# System devices
|
||||
@{sys}/class/video4linux/ r,
|
||||
@{sys}/class/video4linux/** r,
|
||||
|
||||
owner /dev/shm/libv4l-* rw,
|
||||
/dev/video[0-9]* rw,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/video4linux/video[0-9]*/dev r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{modalias,speed} r,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/product_{name,version} r,
|
||||
@{sys}/devices/virtual/dmi/id/board_{vendor,name,version} r,
|
||||
|
||||
# Include additions to the abstraction
|
||||
include if exists <abstractions/video.d>
|
||||
|
|
@ -8,7 +8,8 @@ include <tunables/global>
|
|||
@{SIGNAL_INSTALLDIR} = "/opt/Signal{, Beta}"
|
||||
@{SIGNAL_HOMEDIR} = "@{user_config_dirs}/Signal{, Beta}"
|
||||
|
||||
@{exec_path} = @{SIGNAL_INSTALLDIR}/signal-desktop{,-beta}
|
||||
#@{exec_path} = @{SIGNAL_INSTALLDIR}/signal-desktop{,-beta} # (#FIXME#)
|
||||
@{exec_path} = "/opt/Signal{, Beta}/signal-desktop{,-beta}" # (#FIXME#)
|
||||
profile signal-desktop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
|
@ -22,14 +23,36 @@ profile signal-desktop @{exec_path} {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} mr,
|
||||
# Needed?
|
||||
deny capability sys_ptrace,
|
||||
|
||||
# Signal installation dir
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
# Signal installation dir (#FIXME#)
|
||||
@{SIGNAL_INSTALLDIR}/ r,
|
||||
@{SIGNAL_INSTALLDIR}/** r,
|
||||
@{SIGNAL_INSTALLDIR}/libnode.so mr,
|
||||
@{SIGNAL_INSTALLDIR}/libffmpeg.so mr,
|
||||
@{SIGNAL_INSTALLDIR}/{swiftshader/,}libGLESv2.so mr,
|
||||
@{SIGNAL_INSTALLDIR}/{swiftshader/,}libEGL.so mr,
|
||||
@{SIGNAL_INSTALLDIR}/chrome-sandbox rPx,
|
||||
@{SIGNAL_INSTALLDIR}/resources/app.asar.unpacked/node_modules/**.node mr,
|
||||
@{SIGNAL_INSTALLDIR}/resources/app.asar.unpacked/node_modules/**.so mr,
|
||||
@{SIGNAL_INSTALLDIR}/resources/app.asar.unpacked/node_modules/**.so.[0-9]* mr,
|
||||
|
||||
# Signal home dirs
|
||||
@{SIGNAL_HOMEDIR}/ rw,
|
||||
|
|
@ -42,13 +65,17 @@ profile signal-desktop @{exec_path} {
|
|||
# Signal wants the /tmp/ dir to be mounted with the "exec" flag. If this is not acceptable in
|
||||
# your system, use the TMPDIR variable to set some other tmp dir.
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.* mrw,
|
||||
owner /tmp/.org.chromium.Chromium.*/ rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
|
||||
owner /tmp/.org.chromium.Chromium.*/SS w,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
/var/tmp/ r,
|
||||
owner @{SIGNAL_HOMEDIR}/tmp/.org.chromium.Chromium.* mrw,
|
||||
|
||||
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
@{sys}/devices/pci[0-9]*/**/{irq,vendor,device} r,
|
||||
@{sys}/devices/virtual/tty/tty[0-9]/active r,
|
||||
@{sys}/fs/cgroup/** r,
|
||||
|
||||
@{PROC}/ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
|
@ -56,6 +83,10 @@ profile signal-desktop @{exec_path} {
|
|||
owner @{PROC}/@{pids}/task/ r,
|
||||
owner @{PROC}/@{pids}/task/@{tid}/status r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
owner @{PROC}/@{pids}/statm r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
@{PROC}/vmstat r,
|
||||
|
||||
deny /dev/shm/ r,
|
||||
|
|
@ -64,6 +95,7 @@ profile signal-desktop @{exec_path} {
|
|||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# No new privs
|
||||
/{usr/,}bin/xdg-settings rPUx,
|
||||
|
||||
/{usr/,}bin/getconf rix,
|
||||
|
|
|
|||
|
|
@ -9,14 +9,15 @@ include <tunables/global>
|
|||
@{SIGNAL_INSTALLDIR} = "/opt/Signal{, Beta}"
|
||||
@{SIGNAL_HOMEDIR} = "@{user_config_dirs}/Signal{, Beta}"
|
||||
|
||||
@{exec_path} = @{SIGNAL_INSTALLDIR}/signal-desktop{,-beta}
|
||||
#@{exec_path} = @{SIGNAL_INSTALLDIR}/chrome-sandbox # (#FIXME#)
|
||||
@{exec_path} = "/opt/Signal{, Beta}/chrome-sandbox"
|
||||
profile signal-desktop-chrome-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{SIGNAL_INSTALLDIR}/signal-desktop rPx,
|
||||
@{SIGNAL_INSTALLDIR}/signal-desktop{,-beta} rPx,
|
||||
|
||||
include if exists <local/signal-desktop-chrome-sandbox>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2015-2020 Mikhail Morfikov
|
||||
# Copyright (C) 2015-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
# Useful info:
|
||||
# http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird
|
||||
|
|
|
|||
|
|
@ -12,11 +12,11 @@
|
|||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
include <tunables/global>
|
||||
#include <tunables/global>
|
||||
|
||||
profile libreoffice-oopslash /usr/lib/libreoffice/program/oosplash flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/X>
|
||||
profile libreoffice-oosplash /usr/lib/libreoffice/program/oosplash flags=(complain) {
|
||||
#include <abstractions/base>
|
||||
#include <abstractions/X>
|
||||
|
||||
/etc/libreoffice/ r,
|
||||
/etc/libreoffice/** r,
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
#
|
||||
# Copyright (C) 2016 Canonical Ltd.
|
||||
# Copyright (C) 2018 Software in the Public Interest, Inc.
|
||||
# Copyright (C) 2021 Google LLC
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
|
@ -223,6 +224,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
|
|||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/* r,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/random_seed rk,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/tofu.db rwk,
|
||||
}
|
||||
|
||||
# probably should become a subprofile like gpg above, but then it doesn't
|
||||
|
|
|
|||
|
|
@ -90,6 +90,10 @@ profile vlc @{exec_path} {
|
|||
owner @{MOUNTS}/**/ r,
|
||||
owner /{home,media}/**.@{vlc_ext} rw,
|
||||
|
||||
# For SMB shares
|
||||
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
|
||||
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**.@{vlc_ext} r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
|
|
|
|||
40
apparmor.d/groups/apt/apt-forktracer
Normal file
40
apparmor.d/groups/apt/apt-forktracer
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/apt-forktracer
|
||||
profile apt-forktracer @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
include <abstractions/apt-common>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
||||
|
||||
/usr/share/apt-forktracer/{,**} r,
|
||||
|
||||
/var/lib/apt/lists/ r,
|
||||
/var/lib/apt/lists/*_InRelease r,
|
||||
|
||||
/usr/share/distro-info/debian.csv r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
include if exists <local/apt-forktracer>
|
||||
}
|
||||
|
|
@ -59,6 +59,7 @@ profile apt-key @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
|
|||
|
|
@ -78,6 +78,10 @@ profile apt-methods-gpgv @{exec_path} {
|
|||
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
|
||||
# Local keyring storage
|
||||
/etc/keyrings/ r,
|
||||
/etc/keyrings/*.gpg r,
|
||||
|
||||
# For package building
|
||||
@{BUILD_DIR}/** rwkl -> @{BUILD_DIR}/**,
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ profile apt-cacher-ng /usr/sbin/apt-cacher-ng flags=(complain) {
|
|||
/var/lib/apt-cacher-ng/** r,
|
||||
/{,var/}run/apt-cacher-ng/* rw,
|
||||
@{APT_CACHER_NG_CACHE_DIR}/ r,
|
||||
@{APT_CACHER_NG_CACHE_DIR}/** rw,
|
||||
@{APT_CACHER_NG_CACHE_DIR}/** rwl,
|
||||
/var/log/apt-cacher-ng/ r,
|
||||
/var/log/apt-cacher-ng/* rw,
|
||||
/{,var/}run/systemd/notify w,
|
||||
|
|
|
|||
|
|
@ -130,6 +130,10 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
|
|||
/etc/mime.types r,
|
||||
/etc/mailcap r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
# Set default browser
|
||||
/{usr/,}bin/update-mime-database rPx,
|
||||
owner @{user_config_dirs}/ r,
|
||||
|
|
|
|||
|
|
@ -65,7 +65,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
/dev/dri/card[0-9]* rw,
|
||||
/dev/input/event[0-9]* rw,
|
||||
|
||||
/tmp/dbus-[0-9a-zA-Z]* rw,
|
||||
owner /tmp/dbus-[0-9a-zA-Z]* rw,
|
||||
|
||||
# file_inherit
|
||||
/dev/tty[0-9]* rw,
|
||||
|
|
|
|||
|
|
@ -79,6 +79,7 @@ profile cron @{exec_path} {
|
|||
/etc/cron.{hourly,daily,weekly,monthly}/apt-listbugs rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/apt-show-versions rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/bsdmainutils rPUx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/checksecurity rPUx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/debtags rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/exim4-base rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/logrotate rPx,
|
||||
|
|
|
|||
|
|
@ -34,8 +34,11 @@ profile bluetoothd @{exec_path} {
|
|||
|
||||
@{run}/sdp rw,
|
||||
|
||||
@{run}/udev/data/+hid:* r,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
||||
@{sys}/devices/platform/**/rfkill/**/name r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/uevent r,
|
||||
|
||||
/var/lib/bluetooth/{,**} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@ profile ssh @{exec_path} {
|
|||
|
||||
owner @{HOME}/@{XDG_SSH_DIR}/ r,
|
||||
owner @{HOME}/@{XDG_SSH_DIR}/config r,
|
||||
owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r,
|
||||
owner @{HOME}/@{XDG_SSH_DIR}/known_hosts rw,
|
||||
owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r,
|
||||
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r,
|
||||
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/config r,
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected complain) {
|
|||
/{usr/,}bin/* r,
|
||||
/{usr/,}sbin/* r,
|
||||
@{libexec}/** r,
|
||||
/opt/** r,
|
||||
|
||||
/etc/systemd/coredump.conf r,
|
||||
|
||||
|
|
|
|||
|
|
@ -18,6 +18,9 @@ profile systemd-timesyncd @{exec_path} {
|
|||
|
||||
capability sys_time,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/adjtime r,
|
||||
|
|
|
|||
|
|
@ -36,11 +36,15 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
|
|||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/perl rix,
|
||||
/{usr/,}bin/chgrp rix,
|
||||
/{usr/,}bin/chmod rix,
|
||||
/{usr/,}bin/setfacl rix,
|
||||
/{usr/,}bin/logger rix,
|
||||
/{usr/,}bin/nohup rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/ln rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
|
||||
/{usr/,}{s,}bin/* rPUx,
|
||||
|
||||
|
|
@ -48,6 +52,8 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
|
|||
/{usr/,}lib/systemd/systemd-* rPUx,
|
||||
/{usr/,}lib/crda/* rPUx,
|
||||
|
||||
/{usr,/}lib/pm-utils/power.d/* rPUx,
|
||||
|
||||
/usr/share/hplip/config_usb_printer.py rPUx,
|
||||
|
||||
/etc/console-setup/*.sh rPUx,
|
||||
|
|
|
|||
|
|
@ -20,5 +20,8 @@ profile amixer @{exec_path} {
|
|||
|
||||
owner @{user_config_dirs}/pulse/ r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/amixer>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -22,6 +22,8 @@ profile appstreamcli @{exec_path} flags=(complain) {
|
|||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/appstream-cache-*.mdb rw,
|
||||
owner @{user_cache_dirs}/appstream/ rw,
|
||||
owner @{user_cache_dirs}/appstream/appcache-*.mdb rw,
|
||||
|
||||
/usr/share/appdata/ r,
|
||||
/var/lib/app-info/yaml/ r,
|
||||
|
|
|
|||
|
|
@ -20,6 +20,12 @@ profile cawbird @{exec_path} {
|
|||
include <abstractions/gstreamer>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
|
|
|||
|
|
@ -21,6 +21,11 @@ profile conky @{exec_path} {
|
|||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
||||
# For dig
|
||||
#network inet stream,
|
||||
#network inet6 stream,
|
||||
#network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# Needed tools to render conky output
|
||||
|
|
@ -39,6 +44,10 @@ profile conky @{exec_path} {
|
|||
/{usr/,}bin/wc rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
|
||||
# For external IP address
|
||||
#/{usr/,}bin/dig rix,
|
||||
#owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
|
||||
# To remove the following error:
|
||||
# .conky/Accuweather_conky_script/accuweather: line 917: /usr/bin/pkill: Permission denied
|
||||
/{usr/,}bin/pgrep rix,
|
||||
|
|
|
|||
129
apparmor.d/profiles-a-l/deltachat-desktop
Normal file
129
apparmor.d/profiles-a-l/deltachat-desktop
Normal file
|
|
@ -0,0 +1,129 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{DCD_LIBDIR} = /{usr/,}lib/deltachat-desktop
|
||||
@{DCD_LIBDIR} += /{usr/,}lib/deltachat
|
||||
@{DCD_LIBDIR} += /opt/DeltaChat/
|
||||
|
||||
@{exec_path} = /usr/bin/deltachat-desktop
|
||||
@{exec_path} += /opt/DeltaChat/deltachat-desktop
|
||||
#@{exec_path} += @{DCD_LIBDIR}/deltachat-desktop
|
||||
profile deltachat-desktop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{DCD_LIBDIR}/ r,
|
||||
@{DCD_LIBDIR}/** r,
|
||||
@{DCD_LIBDIR}/libffmpeg.so mr,
|
||||
@{DCD_LIBDIR}/{swiftshader/,}libGLESv2.so mr,
|
||||
@{DCD_LIBDIR}/{swiftshader/,}libEGL.so mr,
|
||||
@{DCD_LIBDIR}/resources/app.asar.unpacked/node_modules/**.node mr,
|
||||
@{DCD_LIBDIR}/resources/app.asar.unpacked/node_modules/**.so mr,
|
||||
@{DCD_LIBDIR}/resources/app.asar.unpacked/node_modules/**.so.[0-9]* mr,
|
||||
@{DCD_LIBDIR}/chrome-sandbox rPx,
|
||||
|
||||
owner @{HOME}/.config/DeltaChat/ rw,
|
||||
owner @{HOME}/.config/DeltaChat/** rwk,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.*/ rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
|
||||
owner /tmp/.org.chromium.Chromium.*/SS w,
|
||||
owner /tmp/.org.chromium.Chromium.*/*.png rw,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/[0-9a-f]*/ rw,
|
||||
owner /tmp/[0-9a-f]*/db.sqlite-blobs/ rw,
|
||||
owner /tmp/[0-9a-f]*/db.sqlite rwk,
|
||||
owner /tmp/[0-9a-f]*/db.sqlite-journal rw,
|
||||
|
||||
@{PROC}/ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/status r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
owner @{PROC}/@{pids}/statm r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pids}/oom_{,score_}adj r,
|
||||
deny owner @{PROC}/@{pids}/oom_{,score_}adj w,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
# (#FIXME#)
|
||||
deny @{sys}/bus/pci/devices/ r,
|
||||
|
||||
deny @{sys}/devices/virtual/tty/tty0/active r,
|
||||
|
||||
# no new privs
|
||||
/{usr/,}bin/xdg-settings rPx,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/deltachat-desktop>
|
||||
}
|
||||
|
|
@ -16,6 +16,7 @@ profile dkms-autoinstaller @{exec_path} {
|
|||
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/tput rix,
|
||||
/{usr/,}bin/echo rix,
|
||||
|
||||
/{usr/,}{s,}bin/dkms rPx,
|
||||
|
||||
|
|
|
|||
37
apparmor.d/profiles-a-l/dring
Normal file
37
apparmor.d/profiles-a-l/dring
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/ring/dring
|
||||
profile dring @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/video>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.config/ring/ rw,
|
||||
owner @{HOME}/.config/jami/dring.yml rw,
|
||||
owner @{HOME}/.config/jami/dring.yml.bak w,
|
||||
owner @{HOME}/.local/share/jami/ r,
|
||||
|
||||
@{sys}/class/ r,
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]*/meminfo r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
|
||||
include if exists <local/dring>
|
||||
}
|
||||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/dumpcap
|
||||
profile dumpcap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To capture packekts
|
||||
capability net_raw,
|
||||
|
|
|
|||
24
apparmor.d/profiles-a-l/dunst
Normal file
24
apparmor.d/profiles-a-l/dunst
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/dunst
|
||||
profile dunst @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/xdg/dunst/dunstrc r,
|
||||
owner @{HOME}/.config/dunst/dunstrc r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
include if exists <local/dunst>
|
||||
}
|
||||
24
apparmor.d/profiles-a-l/dunstctl
Normal file
24
apparmor.d/profiles-a-l/dunstctl
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/dunstctl
|
||||
profile dunstctl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/dbus-send rCx -> dbus,
|
||||
|
||||
profile dbus {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/dbus-send mr,
|
||||
}
|
||||
|
||||
include if exists <local/dunstctl>
|
||||
}
|
||||
19
apparmor.d/profiles-a-l/dunstify
Normal file
19
apparmor.d/profiles-a-l/dunstify
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/dunstify
|
||||
profile dunstify @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/dunstify>
|
||||
}
|
||||
|
|
@ -15,6 +15,7 @@ profile gajim @{exec_path} {
|
|||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/video>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
@ -84,10 +85,6 @@ profile gajim @{exec_path} {
|
|||
|
||||
/usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r,
|
||||
|
||||
# For video streaming
|
||||
@{sys}/class/video4linux/ r,
|
||||
/dev/video[0-9]* rw,
|
||||
|
||||
# TMP files locations (first in /tmp/ , /var/tmp/ and @{HOME}/)
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
|
|
|
|||
|
|
@ -127,6 +127,12 @@ profile gpartedbin @{exec_path} {
|
|||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
# For fsck of the btrfs filesystem
|
||||
|
|
@ -135,6 +141,9 @@ profile gpartedbin @{exec_path} {
|
|||
# Started as root so without "owner".
|
||||
@{HOME}/.Xauthority r,
|
||||
|
||||
# For saving reports
|
||||
owner @{HOME}/*.htm w,
|
||||
|
||||
|
||||
profile mount {
|
||||
include <abstractions/base>
|
||||
|
|
|
|||
|
|
@ -43,6 +43,10 @@ profile gsmartcontrol @{exec_path} {
|
|||
# As it's started as root
|
||||
@{HOME}/.Xauthority r,
|
||||
|
||||
# For saving SMART raport
|
||||
owner /root/ r,
|
||||
owner /root/**.txt w,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
|
|
|||
63
apparmor.d/profiles-a-l/jami-gnome
Normal file
63
apparmor.d/profiles-a-l/jami-gnome
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/jami-gnome
|
||||
profile jami-gnome @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.cache/ rw,
|
||||
owner @{HOME}/.cache/jami-gnome/ rw,
|
||||
owner @{HOME}/.cache/jami-gnome/** rw,
|
||||
|
||||
owner @{HOME}/.local/share/jami/ rw,
|
||||
owner @{HOME}/.local/share/jami/** rwkl -> @{HOME}/.local/share/jami/,
|
||||
|
||||
owner @{HOME}/.config/autostart/jami-gnome.desktop w,
|
||||
|
||||
owner @{HOME}/.local/share/ r,
|
||||
owner @{HOME}/.local/share/webkitgtk/deviceidhashsalts/1/ r,
|
||||
owner @{HOME}/.local/share/webkitgtk/databases/indexeddb/v0 w,
|
||||
owner @{HOME}/.local/share/webkitgtk/databases/indexeddb/v1/ w,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/webkit2gtk-4.0/WebKitNetworkProcess rix,
|
||||
/{usr/,}lib/@{multiarch}/webkit2gtk-4.0/WebKitWebProcess rix,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
/usr/share/ring/{,**} r,
|
||||
/usr/share/sounds/jami-gnome/{,**} r,
|
||||
|
||||
owner @{PROC}/@{pid}/statm r,
|
||||
owner @{PROC}/@{pid}/smaps r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/zoneinfo r,
|
||||
|
||||
@{sys}/firmware/acpi/pm_profile r,
|
||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
||||
@{sys}/fs/cgroup/** r,
|
||||
|
||||
include if exists <local/jami-gnome>
|
||||
}
|
||||
|
|
@ -101,6 +101,10 @@ profile mpv @{exec_path} {
|
|||
owner /tmp/mozilla_*/ r,
|
||||
owner /{home,media,tmp/mozilla_*}/**.@{mpv_ext} rw,
|
||||
|
||||
# For SMB shares
|
||||
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
|
||||
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**.@{mpv_ext} r,
|
||||
|
||||
# For the SMPlayer's builtin thumbnail generator
|
||||
owner /tmp/smplayer_preview/[0-9]*.{jpg,png} w,
|
||||
|
||||
|
|
|
|||
|
|
@ -23,6 +23,7 @@ profile pactl @{exec_path} {
|
|||
owner @{user_config_dirs}/pulse/ rw,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
owner @{HOME}/.anyRemote/anyremote.stdout w,
|
||||
|
||||
|
|
|
|||
|
|
@ -97,6 +97,10 @@ profile smplayer @{exec_path} {
|
|||
owner /tmp/mozilla_*/ r,
|
||||
owner /{home,media,tmp/mozilla_*}/**.@{smplayer_ext} rw,
|
||||
|
||||
# For SMB shares
|
||||
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
|
||||
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**.@{smplayer_ext} r,
|
||||
|
||||
# SMPlayer config files
|
||||
owner @{user_config_dirs}/smplayer/ rw,
|
||||
owner @{user_config_dirs}/smplayer/* rwkl -> @{user_config_dirs}/smplayer/#[0-9]*[0-9],
|
||||
|
|
|
|||
|
|
@ -12,6 +12,9 @@ profile tune2fs @{exec_path} {
|
|||
include <abstractions/disks-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
|
|
|||
|
|
@ -11,6 +11,9 @@ profile update-initramfs @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
# Needed? (comm="ischroot")
|
||||
#ptrace (read),
|
||||
|
||||
@{exec_path} rix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
# vim:syntax=apparmor
|
||||
include <tunables/global>
|
||||
#include <tunables/global>
|
||||
|
||||
profile tcpdump /usr/sbin/tcpdump {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/user-tmp>
|
||||
profile tcpdump /usr/bin/tcpdump {
|
||||
#include <abstractions/base>
|
||||
#include <abstractions/nameservice>
|
||||
#include <abstractions/user-tmp>
|
||||
|
||||
capability net_raw,
|
||||
capability setuid,
|
||||
|
|
@ -54,11 +54,12 @@ profile tcpdump /usr/sbin/tcpdump {
|
|||
|
||||
# for -r, -F and -w
|
||||
/**.[pP][cC][aA][pP] rw,
|
||||
/**.[cC][aA][pP] rw,
|
||||
|
||||
# for convenience with -r (ie, read pcap files from other sources)
|
||||
/var/log/snort/*log* r,
|
||||
|
||||
/usr/sbin/tcpdump mr,
|
||||
/usr/bin/tcpdump mr,
|
||||
|
||||
include if exists <local/usr.sbin.tcpdump>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ profile utox @{exec_path} {
|
|||
include <abstractions/user-download-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/video>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
network inet dgram,
|
||||
|
|
@ -43,15 +44,6 @@ profile utox @{exec_path} {
|
|||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
# For video support
|
||||
owner /dev/shm/libv4l-* rw,
|
||||
/dev/video[0-9]* rw,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/video4linux/video[0-9]*/dev r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{modalias,speed} r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/product_{name,version} r,
|
||||
@{sys}/devices/virtual/dmi/id/board_{vendor,name,version} r,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
|
|
|
|||
|
|
@ -87,8 +87,11 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
# TMP files
|
||||
/tmp/ r,
|
||||
owner /tmp/.X11-unix/ rw,
|
||||
owner /tmp/.X11-unix/X* rwk,
|
||||
# These are only needed when using abstract sockets. When Xserver is started with
|
||||
# "-nolisten local" , you don't need the following rules.
|
||||
#owner /tmp/.X11-unix/ rw,
|
||||
#owner /tmp/.X11-unix/X* rwk,
|
||||
#
|
||||
owner /tmp/.tX[0-9]-lock rwk,
|
||||
owner /tmp/.X[0-9]-lock rwkl -> /tmp/.tX[0-9]-lock,
|
||||
owner /tmp/server-* rwk,
|
||||
|
|
|
|||
Loading…
Reference in a new issue