diff --git a/apparmor.d/profiles-a-f/element b/apparmor.d/profiles-a-f/element new file mode 100644 index 00000000..721c750a --- /dev/null +++ b/apparmor.d/profiles-a-f/element @@ -0,0 +1,89 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/element-desktop +profile element @{exec_path} { + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + + capability sys_ptrace, + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + @{bin}/electron@{int} rix, + @{lib}/electron@{int}/{,**} r, + @{lib}/electron@{int}/electron rix, + @{lib}/element/{,**} r, + @{lib}/element/app.asar.unpacked/node_modules/**.node mr, + + /opt/intel/oneapi/{compiler,lib,mkl}/**/ r, + /opt/intel/oneapi/{compiler,lib,mkl}/**.so* mr, + + /usr/share/webapps/element/{,**} r, + + /etc/libva.conf r, + /etc/element/{,**} r, + /etc/webapps/element/{,**} r, + + owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/Element/ rw, + owner @{user_config_dirs}/Element/** rwkl -> @{user_config_dirs}/Element/**, + owner @{user_config_dirs}/pulse/client.conf r, + owner @{user_config_dirs}/pulse/cookie rk, + + @{sys}/bus/pci/devices/ r, + @{sys}/devices/@{pci}/class r, + @{sys}/devices/@{pci}/resource r, + @{sys}/devices/@{pci}/irq r, + @{sys}/devices/system/cpu/cpu@{int}/cache/{,**} r, + @{sys}/devices/system/cpu/cpu@{int}/topology/{,**} r, + @{sys}/devices/system/cpu/kernel_max r, + @{sys}/devices/system/cpu/present r, + @{sys}/devices/virtual/tty/tty@{int}/active r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_{cur,min,max}_freq r, + + @{PROC}/ r, + @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/sys/kernel/yama/ptrace_scope r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/comm r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/oom_score_adj w, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/statm r, + owner @{PROC}/@{pid}/status r, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/@{tid}/status r, + + deny / r, + deny @{HOME}/ r, + deny @{user_share_dirs}/gvfs-metadata/* r, + deny /etc/machine-id r, + + include if exists +} \ No newline at end of file diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 092301de..51dfc9cf 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -73,6 +73,7 @@ dolphin complain downloadhelper complain drkonqi complain e2fsck complain +element complain epiphany-webapp-provider complain etckeeper complain fail2ban-client attach_disconnected,complain