mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): start using new abstractions (2)

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-19 23:42:30 +00:00
parent b7140c9b2b
commit a79a3f3311
Failed to generate hash of commit
52 changed files with 68 additions and 313 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/browsers/firefox
View file

@ -196,7 +196,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/@{pci}/drm/card@{int}/ r, @{sys}/devices/@{pci}/drm/card@{int}/ r,
@{sys}/devices/@{pci}/drm/renderD128/ r, @{sys}/devices/@{pci}/drm/renderD128/ r,
@{sys}/devices/@{pci}/drm/renderD129/ r, @{sys}/devices/@{pci}/drm/renderD129/ r,
@{sys}/devices/system/cpu/present r,
@{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/background.slice/*/cpu.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/background.slice/*/cpu.max r,

7
apparmor.d/groups/gnome/gnome-characters
View file

@ -13,13 +13,10 @@ profile gnome-characters @{exec_path} {
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/vulkan>
dbus bind bus=session name=org.gnome.Characters, dbus bind bus=session name=org.gnome.Characters,
dbus receive bus=session path=/org/gnome/Characters/SearchProvider dbus receive bus=session path=/org/gnome/Characters/SearchProvider
@ -31,12 +28,10 @@ profile gnome-characters @{exec_path} {
@{bin}/gjs-console rix, @{bin}/gjs-console rix,
/usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/libdrm/*.ids r,
/usr/share/org.gnome.Characters/org.gnome.Characters.*.gresource r, /usr/share/org.gnome.Characters/org.gnome.Characters.*.gresource r,
/usr/share/nvidia/nvidia-application-profiles-*-rc r, /usr/share/nvidia/nvidia-application-profiles-*-rc r,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/status r, owner @{PROC}/@{pid}/status r,

6
apparmor.d/groups/gnome/gnome-contacts
View file

@ -14,16 +14,12 @@ profile gnome-contacts @{exec_path} {
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/gstreamer> include <abstractions/gstreamer>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/vulkan>
network netlink raw, network netlink raw,

9
apparmor.d/groups/gnome/gnome-contacts-search-provider
View file

@ -10,21 +10,16 @@ include <tunables/global>
profile gnome-contacts-search-provider @{exec_path} { profile gnome-contacts-search-provider @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/opencl> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/openssl> include <abstractions/openssl>
signal (send) set=(term) peer=unconfined, signal (send) set=(term) peer=unconfined,
@{exec_path} mr, @{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/mime/mime.cache r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
owner @{user_share_dirs}/folks/{,**/} rw, owner @{user_share_dirs}/folks/{,**/} rw,
owner @{user_share_dirs}/folks/relationships.ini rw, owner @{user_share_dirs}/folks/relationships.ini rw,
owner @{user_share_dirs}/mime/mime.cache r,
owner @{user_cache_dirs}/folks/{,**/} rw, owner @{user_cache_dirs}/folks/{,**/} rw,

15
apparmor.d/groups/gnome/gnome-control-center
View file

@ -15,15 +15,11 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
include <abstractions/dbus-session> include <abstractions/dbus-session>
include <abstractions/dbus> include <abstractions/dbus>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/gstreamer> include <abstractions/gstreamer>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,
@ -65,7 +61,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
/usr/share/backgrounds/{,**} r, /usr/share/backgrounds/{,**} r,
/usr/share/cups/data/testprint r, /usr/share/cups/data/testprint r,
/usr/share/desktop-base/**.{xml,png,svg} r, /usr/share/desktop-base/**.{xml,png,svg} r,
/usr/share/egl/{,**} r,
/usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r, /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
/usr/share/gnome-background-properties/{,**} r, /usr/share/gnome-background-properties/{,**} r,
/usr/share/gnome-bluetooth{-*,}/{,**} r, /usr/share/gnome-bluetooth{-*,}/{,**} r,
@ -73,7 +68,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
/usr/share/gnome-control-center/{,**} r, /usr/share/gnome-control-center/{,**} r,
/usr/share/gnome-shell/search-providers/{,**} r, /usr/share/gnome-shell/search-providers/{,**} r,
/usr/share/gnome/gnome-version.xml r, /usr/share/gnome/gnome-version.xml r,
/usr/share/libdrm/*.ids r,
/usr/share/language-tools/main-countries r, /usr/share/language-tools/main-countries r,
/usr/share/pipewire/client.conf r, /usr/share/pipewire/client.conf r,
/usr/share/thumbnailers/{,*} r, /usr/share/thumbnailers/{,*} r,
@ -146,18 +140,17 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw,
@{PROC}/cmdline r,
@{PROC}/zoneinfo r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid r,
owner @{PROC}/@{pid}/maps r, owner @{PROC}/@{pid}/maps r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/statm r,
owner @{PROC}/@{pid}/task/*/comm rw, owner @{PROC}/@{pid}/task/*/comm rw,
owner @{PROC}/@{pid}/loginuid r,
@{PROC}/cmdline r,
@{PROC}/zoneinfo r,
/dev/ r, /dev/ r,
/dev/media@{int} r, /dev/media@{int} r,

6
apparmor.d/groups/gnome/gnome-control-center-goa-helper
View file

@ -16,16 +16,12 @@ profile gnome-control-center-goa-helper @{exec_path} {
include <abstractions/bus/org.freedesktop.Avahi> include <abstractions/bus/org.freedesktop.Avahi>
include <abstractions/bus/org.gtk.vfs.MountTracker> include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,

9
apparmor.d/groups/gnome/gnome-control-center-print-renderer
View file

@ -13,25 +13,18 @@ profile gnome-control-center-print-renderer @{exec_path} {
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/vulkan>
@{exec_path} mr, @{exec_path} mr,
/usr/share/egl/{,**} r,
/usr/share/libdrm/*.ids r,
/usr/share/pixmaps/{,**} r, /usr/share/pixmaps/{,**} r,
/var/lib/flatpak/exports/share/icons/{,**} r, /var/lib/flatpak/exports/share/icons/{,**} r,
/var/lib/flatpak/exports/share/mime/mime.cache r, /var/lib/flatpak/exports/share/mime/mime.cache r,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
include if exists <local/gnome-control-center-print-renderer> include if exists <local/gnome-control-center-print-renderer>
} }

8
apparmor.d/groups/gnome/gnome-control-center-search-provider
View file

@ -11,11 +11,8 @@ profile gnome-control-center-search-provider @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/vulkan>
dbus bind bus=session name=org.gnome.Settings.SearchProvider, dbus bind bus=session name=org.gnome.Settings.SearchProvider,
dbus receive bus=session path=/org/gnome/Settings/SearchProvider dbus receive bus=session path=/org/gnome/Settings/SearchProvider
@ -24,10 +21,7 @@ profile gnome-control-center-search-provider @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/usr/share/nvidia/nvidia-application-profiles-*-rc r,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
include if exists <local/gnome-control-center-search-provider> include if exists <local/gnome-control-center-search-provider>
} }

10
apparmor.d/groups/gnome/gnome-extension-manager
View file

@ -10,17 +10,11 @@ include <tunables/global>
profile gnome-extension-manager @{exec_path} { profile gnome-extension-manager @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common> include <abstractions/gnome-strict>
include <abstractions/dri-enumerate> include <abstractions/graphics>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,

11
apparmor.d/groups/gnome/gnome-extensions-app
View file

@ -10,15 +10,9 @@ include <tunables/global>
profile gnome-extensions-app @{exec_path} { profile gnome-extensions-app @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common> include <abstractions/gnome-strict>
include <abstractions/dri-enumerate> include <abstractions/graphics>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/vulkan>
@{exec_path} mr, @{exec_path} mr,
@ -30,7 +24,6 @@ profile gnome-extensions-app @{exec_path} {
/usr/share/gnome-shell/org.gnome.Extensions* r, /usr/share/gnome-shell/org.gnome.Extensions* r,
/usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/terminfo/** r, /usr/share/terminfo/** r,
/usr/share/X11/xkb/{,**} r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pids}/stat r, owner @{PROC}/@{pids}/stat r,

8
apparmor.d/groups/gnome/gnome-music
View file

@ -12,17 +12,13 @@ profile gnome-music @{exec_path} {
include <abstractions/audio> include <abstractions/audio>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/gstreamer> include <abstractions/gstreamer>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-intel>
include <abstractions/opencl-mesa>
include <abstractions/opencl-nvidia>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/python> include <abstractions/python>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/vulkan>
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@ -35,8 +31,6 @@ profile gnome-music @{exec_path} {
@{bin}/python3.[0-9]* rix, @{bin}/python3.[0-9]* rix,
@{lib}/python3.[0-9]*/site-packages//gnomemusic/__pycache__/{,**} rw, @{lib}/python3.[0-9]*/site-packages//gnomemusic/__pycache__/{,**} rw,
/usr/share/egl/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/grilo-plugins/grl-lua-factory/{,*} r, /usr/share/grilo-plugins/grl-lua-factory/{,*} r,
/usr/share/org.gnome.Music/{,**} r, /usr/share/org.gnome.Music/{,**} r,
/usr/share/tracker3/{,**} r, /usr/share/tracker3/{,**} r,

7
apparmor.d/groups/gnome/gnome-remote-desktop-daemon
View file

@ -11,10 +11,8 @@ profile gnome-remote-desktop-daemon @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common> include <abstractions/graphics>
include <abstractions/dri-enumerate>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/vulkan>
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@ -25,8 +23,5 @@ profile gnome-remote-desktop-daemon @{exec_path} {
owner @{run}/user/@{uid}/wayland-@{int} rw, owner @{run}/user/@{uid}/wayland-@{int} rw,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
include if exists <local/gnome-remote-desktop-daemon> include if exists <local/gnome-remote-desktop-daemon>
} }

6
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -19,12 +19,9 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.gnome.Mutter.IdleMonitor> include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
include <abstractions/bus/org.gnome.ScreenSaver> include <abstractions/bus/org.gnome.ScreenSaver>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/vulkan>
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@ -110,7 +107,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/usr/share/gdm/greeter-dconf-defaults r, /usr/share/gdm/greeter-dconf-defaults r,
/usr/share/gdm/greeter/applications/{,**} r, /usr/share/gdm/greeter/applications/{,**} r,
/usr/share/gdm/greeter/autostart/{,*.desktop} r, /usr/share/gdm/greeter/autostart/{,*.desktop} r,
/usr/share/glvnd/egl_vendor.d/ r,
/usr/share/gnome-session/hardware-compatibility r, /usr/share/gnome-session/hardware-compatibility r,
/usr/share/gnome-session/sessions/*.session r, /usr/share/gnome-session/sessions/*.session r,
/usr/share/gnome/autostart/{,*.desktop} r, /usr/share/gnome/autostart/{,*.desktop} r,

17
apparmor.d/groups/gnome/gnome-shell
View file

@ -28,6 +28,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.login1.Session> include <abstractions/bus/org.freedesktop.login1.Session>
include <abstractions/bus/org.freedesktop.login1> include <abstractions/bus/org.freedesktop.login1>
include <abstractions/bus/org.freedesktop.NetworkManager> include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/bus/org.freedesktop.Notifications>
include <abstractions/bus/org.freedesktop.PackageKit> include <abstractions/bus/org.freedesktop.PackageKit>
include <abstractions/bus/org.freedesktop.PolicyKit1> include <abstractions/bus/org.freedesktop.PolicyKit1>
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
@ -40,22 +41,16 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.gtk.vfs.Metadata> include <abstractions/bus/org.gtk.vfs.Metadata>
include <abstractions/bus/org.gtk.vfs.MountTracker> include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-write> include <abstractions/fontconfig-cache-write>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/gstreamer> include <abstractions/gstreamer>
include <abstractions/ibus> include <abstractions/ibus>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-intel>
include <abstractions/opencl-mesa>
include <abstractions/opencl-nvidia>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read> include <abstractions/thumbnails-cache-read>
include <abstractions/video> include <abstractions/video>
include <abstractions/vulkan>
capability sys_nice, capability sys_nice,
capability sys_ptrace, capability sys_ptrace,
@ -237,7 +232,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/usr/share/gdm/greeter-dconf-defaults r, /usr/share/gdm/greeter-dconf-defaults r,
/usr/share/gdm/greeter/applications/{,**} r, /usr/share/gdm/greeter/applications/{,**} r,
/usr/share/gnome-shell/{,**} r, /usr/share/gnome-shell/{,**} r,
/usr/share/libdrm/*.ids r,
/usr/share/libgweather/Locations.xml r, /usr/share/libgweather/Locations.xml r,
/usr/share/libinput*/ r, /usr/share/libinput*/ r,
/usr/share/libinput*/{,**/}[0-9][0-9]-*.quirks r, /usr/share/libinput*/{,**/}[0-9][0-9]-*.quirks r,
@ -298,8 +292,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/.goutputstream{,-@{rand6}} rw, owner @{user_config_dirs}/.goutputstream{,-@{rand6}} rw,
owner @{user_config_dirs}/ibus/ w, owner @{user_config_dirs}/ibus/ w,
owner @{user_config_dirs}/monitors.xml{,~} rwl, owner @{user_config_dirs}/monitors.xml{,~} rwl,
owner @{user_config_dirs}/pulse/ r, owner @{user_config_dirs}/pulse/ rw,
owner @{user_config_dirs}/pulse/ w, # change to 'c'
owner @{user_config_dirs}/tiling-assistant/{,**} rw, owner @{user_config_dirs}/tiling-assistant/{,**} rw,
owner @{user_share_dirs}/backgrounds/{,**} rw, owner @{user_share_dirs}/backgrounds/{,**} rw,
@ -358,7 +351,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{sys}/**/uevent r, @{sys}/**/uevent r,
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/class/ r,
@{sys}/class/hwmon/ r, @{sys}/class/hwmon/ r,
@{sys}/class/input/ r, @{sys}/class/input/ r,
@{sys}/class/net/ r, @{sys}/class/net/ r,
@ -369,11 +361,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r, @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
@{sys}/devices/**/power_supply/{,**} r, @{sys}/devices/**/power_supply/{,**} r,
@{sys}/devices/@{pci}/boot_vga r, @{sys}/devices/@{pci}/boot_vga r,
@{sys}/devices/@{pci}/drm/ r,
@{sys}/devices/@{pci}/input@{int}/{properties,name} r, @{sys}/devices/@{pci}/input@{int}/{properties,name} r,
@{sys}/devices/@{pci}/net/*/statistics/{rx_bytes,tx_bytes} r, @{sys}/devices/@{pci}/net/*/statistics/{rx_bytes,tx_bytes} r,
@{sys}/devices/platform/**/input@{int}/{properties,name} r, @{sys}/devices/platform/**/input@{int}/{properties,name} r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
@{sys}/devices/virtual/net/*/statistics/{rx_bytes,tx_bytes} r, @{sys}/devices/virtual/net/*/statistics/{rx_bytes,tx_bytes} r,
@{PROC}/ r, @{PROC}/ r,
@ -387,7 +377,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,

6
apparmor.d/groups/gnome/gnome-software
View file

@ -10,16 +10,12 @@ include <tunables/global>
profile gnome-software @{exec_path} { profile gnome-software @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,

7
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -19,12 +19,10 @@ profile gsd-xsettings @{exec_path} {
include <abstractions/bus/org.gnome.Shell.Introspect> include <abstractions/bus/org.gnome.Shell.Introspect>
include <abstractions/bus/org.gtk.vfs.MountTracker> include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@ -59,7 +57,6 @@ profile gsd-xsettings @{exec_path} {
/usr/share/dconf/profile/gdm r, /usr/share/dconf/profile/gdm r,
/usr/share/gdm/greeter-dconf-defaults r, /usr/share/gdm/greeter-dconf-defaults r,
/usr/share/libdrm/*.ids r,
/etc/X11/Xsession.options r, /etc/X11/Xsession.options r,
@{etc_ro}/xdg/Xwayland-session.d/ r, @{etc_ro}/xdg/Xwayland-session.d/ r,
@ -69,8 +66,6 @@ profile gsd-xsettings @{exec_path} {
/var/lib/gdm{3,}/.config/dconf/user r, /var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm3/greeter-dconf-defaults r, /var/lib/gdm3/greeter-dconf-defaults r,
owner @{user_cache_dirs}/mesa_shader_cache/index rw,
@{run}/systemd/sessions/* r, @{run}/systemd/sessions/* r,
@{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{uid} r,

6
apparmor.d/groups/gnome/mutter-x11-frames
View file

@ -13,13 +13,9 @@ profile mutter-x11-frames @{exec_path} {
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/nvidia>
include <abstractions/vulkan>
@{exec_path} mr, @{exec_path} mr,

10
apparmor.d/groups/gnome/nautilus
View file

@ -20,15 +20,11 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.gtk.Private.RemoteVolumeMonitor> include <abstractions/bus/org.gtk.Private.RemoteVolumeMonitor>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/trash> include <abstractions/trash>
include <abstractions/vulkan>
# mqueue r type=posix /, # mqueue r type=posix /,
@ -100,7 +96,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
@{open_path} rPx -> child-open, @{open_path} rPx -> child-open,
/usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/libdrm/*.ids r,
/usr/share/nautilus/{,**} r, /usr/share/nautilus/{,**} r,
/usr/share/poppler/{,**} r, /usr/share/poppler/{,**} r,
/usr/share/sounds/freedesktop/stereo/*.oga r, /usr/share/sounds/freedesktop/stereo/*.oga r,
@ -139,8 +134,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/**/hwmon@{int}/**/{,name,temp*,fan*} r, @{sys}/devices/**/hwmon@{int}/**/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon/{,name,temp*,fan*} r, @{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r, @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
@{sys}/devices/@{pci}/revision r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
@{PROC}/@{pids}/net/wireless r, @{PROC}/@{pids}/net/wireless r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r, @{PROC}/sys/dev/i915/perf_stream_paranoid r,
@ -149,7 +142,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
/dev/tty rw, /dev/tty rw,
/dev/dri/card@{int} rw,
include if exists <local/nautilus> include if exists <local/nautilus>
} }

7
apparmor.d/groups/gnome/org.gnome.NautilusPreviewer
View file

@ -11,15 +11,12 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/gstreamer> include <abstractions/gstreamer>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/private-files-strict> include <abstractions/private-files-strict>
include <abstractions/video> include <abstractions/video>
include <abstractions/vulkan>
network netlink raw, network netlink raw,
@ -41,12 +38,12 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
@{sys}/devices/@{pci}/revision r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
@{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cgroup r,
@{PROC}/zoneinfo r, @{PROC}/zoneinfo r,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/@{tid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/stat r,

8
apparmor.d/groups/gnome/tracker-extract
View file

@ -16,12 +16,10 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/disks-read> include <abstractions/disks-read>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gnome-strict> include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/gstreamer> include <abstractions/gstreamer>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/openssl> include <abstractions/openssl>
network netlink raw, network netlink raw,
@ -50,7 +48,6 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
/etc/blkid.conf r, /etc/blkid.conf r,
/etc/fstab r, /etc/fstab r,
/etc/libva.conf r,
/var/lib/gdm{3,}/.cache/ rw, /var/lib/gdm{3,}/.cache/ rw,
/var/lib/gdm{3,}/.cache/tracker3/{,**} rw, /var/lib/gdm{3,}/.cache/tracker3/{,**} rw,
@ -69,7 +66,6 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
owner @{MOUNTS}/{,**} r, owner @{MOUNTS}/{,**} r,
owner /tmp/*/{,**} r, owner /tmp/*/{,**} r,
owner @{user_cache_dirs}/ w,
owner @{user_cache_dirs}/tracker3/ w, owner @{user_cache_dirs}/tracker3/ w,
owner @{user_cache_dirs}/tracker3/files/{,**} rwk, owner @{user_cache_dirs}/tracker3/files/{,**} rwk,
owner @{user_share_dirs}/gvfs-metadata/** r, owner @{user_share_dirs}/gvfs-metadata/** r,
@ -86,8 +82,6 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,
/dev/dri/card@{int} rw,
/dev/dri/renderD128 rw,
/dev/media@{int} r, /dev/media@{int} r,
/dev/video@{int} rw, /dev/video@{int} rw,

5
apparmor.d/groups/kde/DiscoverNotifier
View file

@ -9,13 +9,10 @@ include <tunables/global>
@{exec_path} = @{lib}/DiscoverNotifier @{exec_path} = @{lib}/DiscoverNotifier
profile DiscoverNotifier @{exec_path} { profile DiscoverNotifier @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,

4
apparmor.d/groups/kde/baloo
View file

@ -12,10 +12,8 @@ profile baloo @{exec_path} {
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/disks-read> include <abstractions/disks-read>
include <abstractions/fontconfig-cache-write> include <abstractions/fontconfig-cache-write>
include <abstractions/fonts> include <abstractions/desktop>
include <abstractions/freedesktop.org>
include <abstractions/private-files-strict> include <abstractions/private-files-strict>
include <abstractions/qt5>
network netlink raw, network netlink raw,

5
apparmor.d/groups/kde/baloorunner
View file

@ -9,13 +9,10 @@ include <tunables/global>
@{exec_path} = @{lib}/baloorunner @{exec_path} = @{lib}/baloorunner
profile baloorunner @{exec_path} { profile baloorunner @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
@{exec_path} mr, @{exec_path} mr,

5
apparmor.d/groups/kde/dolphin
View file

@ -11,13 +11,11 @@ profile dolphin @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/devices-usb> include <abstractions/devices-usb>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
include <abstractions/X-strict> include <abstractions/X-strict>
network netlink raw, network netlink raw,
@ -36,7 +34,6 @@ profile dolphin @{exec_path} {
/usr/share/kio/{,**} r, /usr/share/kio/{,**} r,
/usr/share/kservices5/{,**} r, /usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/{,**} r, /usr/share/kservicetypes5/{,**} r,
/usr/share/mime/ r,
/etc/fstab r, /etc/fstab r,
/etc/machine-id r, /etc/machine-id r,

6
apparmor.d/groups/kde/kaccess
View file

@ -9,11 +9,9 @@ include <tunables/global>
@{exec_path} = @{bin}/kaccess @{exec_path} = @{bin}/kaccess
profile kaccess @{exec_path} { profile kaccess @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common> include <abstractions/graphics>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
@{exec_path} mr, @{exec_path} mr,
@ -42,8 +40,6 @@ profile kaccess @{exec_path} {
owner @{run}/user/@{uid}/xauth_@{rand6} r, owner @{run}/user/@{uid}/xauth_@{rand6} r,
@{sys}/devices/@{pci}/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
/dev/tty r, /dev/tty r,
include if exists <local/kaccess> include if exists <local/kaccess>

1
apparmor.d/groups/kde/kactivitymanagerd
View file

@ -24,7 +24,6 @@ profile kactivitymanagerd @{exec_path} {
/usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/kf5/kactivitymanagerd/{,**} r, /usr/share/kf5/kactivitymanagerd/{,**} r,
/usr/share/kservices5/{,**} r, /usr/share/kservices5/{,**} r,
/usr/share/mime/{,**} r,
/etc/xdg/kdeglobals r, /etc/xdg/kdeglobals r,
/etc/machine-id r, /etc/machine-id r,

8
apparmor.d/groups/kde/kalendarac
View file

@ -9,14 +9,11 @@ include <tunables/global>
@{exec_path} = @{bin}/kalendarac @{exec_path} = @{bin}/kalendarac
profile kalendarac @{exec_path} { profile kalendarac @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
@{exec_path} mr, @{exec_path} mr,
@ -54,9 +51,6 @@ profile kalendarac @{exec_path} {
owner @{run}/user/@{uid}/pulse/ r, owner @{run}/user/@{uid}/pulse/ r,
owner @{run}/user/@{uid}/xauth_@{rand6} rl, owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/sys/kernel/core_pattern r, @{PROC}/sys/kernel/core_pattern r,
/dev/tty r, /dev/tty r,

4
apparmor.d/groups/kde/kiod5
View file

@ -9,11 +9,9 @@ include <tunables/global>
@{exec_path} = @{lib}/kf5/kiod5 @{exec_path} = @{lib}/kf5/kiod5
profile kiod5 @{exec_path} { profile kiod5 @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common> include <abstractions/graphics>
include <abstractions/dri-enumerate>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/vulkan>
network netlink raw, network netlink raw,

10
apparmor.d/groups/kde/kioslave5
View file

@ -10,19 +10,15 @@ include <tunables/global>
profile kioslave5 @{exec_path} { profile kioslave5 @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/nvidia>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read> include <abstractions/thumbnails-cache-read>
include <abstractions/trash> include <abstractions/trash>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,
@ -47,7 +43,6 @@ profile kioslave5 @{exec_path} {
/usr/share/kio_desktop/directory.desktop r, /usr/share/kio_desktop/directory.desktop r,
/usr/share/kservices5/{,**} r, /usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/*.desktop r, /usr/share/kservicetypes5/*.desktop r,
/usr/share/mime/ r,
/usr/share/remoteview/* r, /usr/share/remoteview/* r,
/etc/fstab r, /etc/fstab r,
@ -103,9 +98,6 @@ profile kioslave5 @{exec_path} {
owner @{run}/user/@{uid}/kio_desktop*kioworker.socket rwl, owner @{run}/user/@{uid}/kio_desktop*kioworker.socket rwl,
owner @{run}/user/@{uid}/xauth_@{rand6} rl, owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/sys/kernel/core_pattern r, @{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,

4
apparmor.d/groups/kde/kscreenlocker-greet
View file

@ -11,17 +11,15 @@ include <tunables/global>
@{exec_path} += @{lib}/@{multiarch}/libexec/kscreenlocker_greet @{exec_path} += @{lib}/@{multiarch}/libexec/kscreenlocker_greet
profile kscreenlocker-greet @{exec_path} { profile kscreenlocker-greet @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write> include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/X> include <abstractions/X>
include <abstractions/vulkan>
network netlink raw, network netlink raw,

7
apparmor.d/groups/kde/ksmserver
View file

@ -10,13 +10,11 @@ include <tunables/global>
profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app-launcher-user> include <abstractions/app-launcher-user>
include <abstractions/dri-common>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
include <abstractions/X-strict> include <abstractions/X-strict>
signal (send) set=(usr1,term) peer=kscreenlocker-greet, signal (send) set=(usr1,term) peer=kscreenlocker-greet,
@ -36,7 +34,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/knotifications5/*.notifyrc r, /usr/share/knotifications5/*.notifyrc r,
/usr/share/kservices5/{,**} r, /usr/share/kservices5/{,**} r,
/usr/share/mime/{,**} r,
/etc/xdg/menus/applications-merged/ r, /etc/xdg/menus/applications-merged/ r,
/etc/machine-id r, /etc/machine-id r,
@ -70,8 +67,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{run}/user/@{uid}/KSMserver__[0-9] rw, owner @{run}/user/@{uid}/KSMserver__[0-9] rw,
owner @{run}/user/@{uid}/xauth_@{rand6} rl, owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{sys}/devices/@{pci}/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
@{PROC}/sys/kernel/core_pattern r, @{PROC}/sys/kernel/core_pattern r,
/dev/tty r, /dev/tty r,

5
apparmor.d/groups/kde/ksplashqml
View file

@ -9,13 +9,10 @@ include <tunables/global>
@{exec_path} = @{bin}/ksplashqml @{exec_path} = @{bin}/ksplashqml
profile ksplashqml @{exec_path} { profile ksplashqml @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/vulkan>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
@{exec_path} mr, @{exec_path} mr,

5
apparmor.d/groups/kde/kwalletd5
View file

@ -12,17 +12,14 @@ profile kwalletd5 @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/audio> include <abstractions/audio>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/graphics>
include <abstractions/gtk> include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write> include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
include <abstractions/wayland> include <abstractions/wayland>
include <abstractions/X-strict> include <abstractions/X-strict>

3
apparmor.d/groups/kde/kwalletmanager5
View file

@ -12,12 +12,11 @@ profile kwalletmanager5 @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/audio> include <abstractions/audio>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/graphics>
include <abstractions/gtk> include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write> include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write> include <abstractions/qt5-settings-write>

7
apparmor.d/groups/kde/kwin_wayland
View file

@ -9,15 +9,12 @@ include <tunables/global>
@{exec_path} = @{bin}/kwin_wayland @{exec_path} = @{bin}/kwin_wayland
profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-write> include <abstractions/fontconfig-cache-write>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
include <abstractions/vulkan>
include <abstractions/wayland> include <abstractions/wayland>
capability sys_nice, capability sys_nice,
@ -43,7 +40,6 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
/usr/share/kservicetypes5/{,*.desktop} r, /usr/share/kservicetypes5/{,*.desktop} r,
/usr/share/kwin/{,**} r, /usr/share/kwin/{,**} r,
/usr/share/libinput/{,**} r, /usr/share/libinput/{,**} r,
/usr/share/mime/ r,
/usr/share/plasma/desktoptheme/default/{metadata.json,plasmarc} r, /usr/share/plasma/desktoptheme/default/{metadata.json,plasmarc} r,
/usr/share/qt/translations/*.qm r, /usr/share/qt/translations/*.qm r,
/usr/share/X11/xkb/{,**} r, /usr/share/X11/xkb/{,**} r,
@ -55,7 +51,6 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
/usr/share/plasma/desktoptheme/default/** r, /usr/share/plasma/desktoptheme/default/** r,
/usr/share/desktop-directories/*.directory r, /usr/share/desktop-directories/*.directory r,
owner /var/lib/sddm/.cache/#@{int} rwk, owner /var/lib/sddm/.cache/#@{int} rwk,
owner /var/lib/sddm/.cache/fontconfig/* rwk, owner /var/lib/sddm/.cache/fontconfig/* rwk,
owner /var/lib/sddm/.cache/fontconfig/*-le64.cache-@{int}{,TMP-@{rand6},NEW,LCK} w, owner /var/lib/sddm/.cache/fontconfig/*-le64.cache-@{int}{,TMP-@{rand6},NEW,LCK} w,

5
apparmor.d/groups/kde/kwin_x11
View file

@ -10,15 +10,12 @@ include <tunables/global>
profile kwin_x11 @{exec_path} { profile kwin_x11 @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,

6
apparmor.d/groups/kde/plasma-browser-integration-host
View file

@ -9,14 +9,11 @@ include <tunables/global>
@{exec_path} = @{bin}/plasma-browser-integration-host @{exec_path} = @{bin}/plasma-browser-integration-host
profile plasma-browser-integration-host @{exec_path} { profile plasma-browser-integration-host @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
capability sys_ptrace, capability sys_ptrace,
@ -25,7 +22,6 @@ profile plasma-browser-integration-host @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/usr/share/kservices5/{,**} r, /usr/share/kservices5/{,**} r,
/usr/share/mime/ r,
/etc/xdg/menus/ r, /etc/xdg/menus/ r,
/etc/xdg/taskmanagerrulesrc r, /etc/xdg/taskmanagerrulesrc r,

5
apparmor.d/groups/kde/plasma-discover
View file

@ -10,16 +10,13 @@ include <tunables/global>
profile plasma-discover @{exec_path} { profile plasma-discover @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/vulkan>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,

8
apparmor.d/groups/kde/plasmashell
View file

@ -17,18 +17,15 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/devices-usb> include <abstractions/devices-usb>
include <abstractions/disks-read> include <abstractions/disks-read>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/enchant> include <abstractions/enchant>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/recent-documents-write> include <abstractions/recent-documents-write>
include <abstractions/thumbnails-cache-read> include <abstractions/thumbnails-cache-read>
include <abstractions/vulkan>
include <abstractions/X-strict> include <abstractions/X-strict>
network inet dgram, network inet dgram,
@ -70,7 +67,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
/usr/share/kservicetypes5/{,**} r, /usr/share/kservicetypes5/{,**} r,
/usr/share/lshw/artwork/logo.svg r, /usr/share/lshw/artwork/logo.svg r,
/usr/share/metainfo/{,**} r, /usr/share/metainfo/{,**} r,
/usr/share/mime/{,**} r,
/usr/share/plasma/{,**} r, /usr/share/plasma/{,**} r,
/usr/share/solid/actions/{,**} r, /usr/share/solid/actions/{,**} r,
/usr/share/swcatalog/{,**} r, /usr/share/swcatalog/{,**} r,
@ -174,8 +170,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
@{sys}/devices/@{pci}/name r, @{sys}/devices/@{pci}/name r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/ r, @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/ r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{sys}/devices/virtual/thermal/**/{name,type} r, @{sys}/devices/virtual/thermal/**/{name,type} r,
@{PROC}/ r, @{PROC}/ r,

3
apparmor.d/groups/kde/sddm-greeter
View file

@ -13,9 +13,8 @@ profile sddm-greeter @{exec_path} {
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl> include <abstractions/graphics>
include <abstractions/qt5-compose-cache-write> include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
include <abstractions/qt5> include <abstractions/qt5>

1
apparmor.d/groups/kde/startplasma
View file

@ -28,7 +28,6 @@ profile startplasma @{exec_path} {
/usr/share/knotifications5/{,**} r, /usr/share/knotifications5/{,**} r,
/usr/share/kservices5/{,**} r, /usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/{,**} r, /usr/share/kservicetypes5/{,**} r,
/usr/share/mime/{,**} r,
/usr/share/plasma/{,**} r, /usr/share/plasma/{,**} r,
/etc/machine-id r, /etc/machine-id r,

6
apparmor.d/groups/kde/systemsettings
View file

@ -9,15 +9,12 @@ include <tunables/global>
@{exec_path} = @{bin}/systemsettings @{exec_path} = @{bin}/systemsettings
profile systemsettings @{exec_path} { profile systemsettings @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/mesa> include <abstractions/graphics>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
include <abstractions/qt5> include <abstractions/qt5>
include <abstractions/vulkan>
network netlink raw, network netlink raw,
@ -30,7 +27,6 @@ profile systemsettings @{exec_path} {
/usr/share/kservices5/{,**} r, /usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/{,**} r, /usr/share/kservicetypes5/{,**} r,
/usr/share/kxmlgui5/systemsettings/systemsettingsui.rc r, /usr/share/kxmlgui5/systemsettings/systemsettingsui.rc r,
/usr/share/mime/ r,
/usr/share/plasma/{,**} r, /usr/share/plasma/{,**} r,
/usr/share/systemsettings/{,**} r, /usr/share/systemsettings/{,**} r,
/usr/share/kinfocenter/{,**} r, /usr/share/kinfocenter/{,**} r,

2
apparmor.d/groups/ubuntu/update-manager
View file

@ -51,10 +51,8 @@ profile update-manager @{exec_path} flags=(attach_disconnected) {
@{lib}/apt/methods/http{,s} rPx, @{lib}/apt/methods/http{,s} rPx,
/usr/share/distro-info/{,**} r, /usr/share/distro-info/{,**} r,
/usr/share/themes/{,**} r,
/usr/share/ubuntu-release-upgrader/{,**} r, /usr/share/ubuntu-release-upgrader/{,**} r,
/usr/share/update-manager/{,**} r, /usr/share/update-manager/{,**} r,
/usr/share/X11/{,**} r,
/etc/gtk-3.0/settings.ini r, /etc/gtk-3.0/settings.ini r,
/etc/pulse/client.conf r, /etc/pulse/client.conf r,

1
apparmor.d/groups/virt/libvirtd
View file

@ -206,7 +206,6 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/system/cpu/cpu@{int}/cache/{,**} r, @{sys}/devices/system/cpu/cpu@{int}/cache/{,**} r,
@{sys}/devices/system/cpu/cpu@{int}/topology/{,**} r, @{sys}/devices/system/cpu/cpu@{int}/topology/{,**} r,
@{sys}/devices/system/cpu/present r, @{sys}/devices/system/cpu/present r,
@{sys}/devices/system/cpu/present/ r,
@{sys}/devices/system/node/ r, @{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/ r, @{sys}/devices/system/node/node@{int}/ r,
@{sys}/devices/system/node/node@{int}/{cpumap,distance,meminfo} r, @{sys}/devices/system/node/node@{int}/{cpumap,distance,meminfo} r,

28
apparmor.d/groups/whonix/torbrowser
View file

@ -23,18 +23,16 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.login1> include <abstractions/bus/org.freedesktop.login1>
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/bus/org.freedesktop.RealtimeKit1> include <abstractions/bus/org.freedesktop.RealtimeKit1>
include <abstractions/bus/org.gtk.Private.RemoteVolumeMonitor>
include <abstractions/desktop>
include <abstractions/enchant>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/fonts> include <abstractions/graphics-full>
include <abstractions/freedesktop.org>
include <abstractions/gstreamer> include <abstractions/gstreamer>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read> include <abstractions/thumbnails-cache-read>
include <abstractions/user-download-strict> include <abstractions/user-download-strict>
include <abstractions/vulkan>
# userns, # userns,
@ -59,14 +57,10 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) {
/usr/share/@{name}/{,**} r, /usr/share/@{name}/{,**} r,
/usr/share/doc/{,**} r, /usr/share/doc/{,**} r,
/usr/share/egl/{,**} r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/libdrm/*.ids r,
/usr/share/xul-ext/kwallet5/* r, /usr/share/xul-ext/kwallet5/* r,
/etc/@{name}.d/{,**} r, /etc/@{name}.d/{,**} r,
/etc/igfx_user_feature{,_next}.txt w, /etc/igfx_user_feature{,_next}.txt w,
/etc/libva.conf r,
/etc/mailcap r, /etc/mailcap r,
/etc/mime.types r, /etc/mime.types r,
/etc/opensc.conf r, /etc/opensc.conf r,
@ -110,20 +104,16 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) {
@{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r, @{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,
@{sys}/class/ r, @{sys}/class/ r,
@{sys}/class/**/ r, @{sys}/class/**/ r,
@{sys}/devices/**/uevent r,
@{sys}/devices/@{pci}/ r, @{sys}/devices/@{pci}/ r,
@{sys}/devices/@{pci}/drm/card@{int}/ r, @{sys}/devices/@{pci}/drm/card@{int}/ r,
@{sys}/devices/@{pci}/drm/renderD[0-9]*/ r, @{sys}/devices/@{pci}/drm/renderD128/ r,
@{sys}/devices/@{pci}/irq r, @{sys}/devices/@{pci}/drm/renderD129/ r,
@{sys}/devices/system/cpu/cpu@{int}/cache/index[0-9]/size r, @{sys}/devices/**/uevent r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
@{sys}/devices/system/cpu/present r,
@{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-1.scope/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-1.scope/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/**/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/**/cpu.max r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/gid_map w, # If kernel.unprivileged_userns_clone = 1 owner @{PROC}/@{pid}/gid_map w, # If kernel.unprivileged_userns_clone = 1
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
@ -140,5 +130,9 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pids}/cmdline r, owner @{PROC}/@{pids}/cmdline r,
owner @{PROC}/@{pids}/environ r, owner @{PROC}/@{pids}/environ r,
# Silencer
deny @{lib_dirs}/** w,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
include if exists <local/torbrowser> include if exists <local/torbrowser>
} }

9
apparmor.d/groups/whonix/torbrowser-glxtest
View file

@ -15,12 +15,8 @@ include <tunables/global>
@{exec_path} = @{lib_dirs}/glxtest @{exec_path} = @{lib_dirs}/glxtest
profile torbrowser-glxtest @{exec_path} { profile torbrowser-glxtest @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common> include <abstractions/graphics>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/vulkan>
include <abstractions/X-strict> include <abstractions/X-strict>
@{exec_path} mr, @{exec_path} mr,
@ -29,9 +25,6 @@ profile torbrowser-glxtest @{exec_path} {
owner /tmp/@{name}/.parentlock rw, owner /tmp/@{name}/.parentlock rw,
@{sys}/bus/pci/devices/ r,
@{sys}/devices/@{pci}/class r,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
include if exists <local/torbrowser-glxtest> include if exists <local/torbrowser-glxtest>

9
apparmor.d/groups/whonix/torbrowser-vaapitest
View file

@ -15,23 +15,16 @@ include <tunables/global>
@{exec_path} = @{lib_dirs}/vaapitest @{exec_path} = @{lib_dirs}/vaapitest
profile torbrowser-vaapitest @{exec_path} { profile torbrowser-vaapitest @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-enumerate> include <abstractions/graphics>
include <abstractions/dri-common>
include <abstractions/nvidia>
include <abstractions/vulkan>
network netlink raw, network netlink raw,
@{exec_path} mr, @{exec_path} mr,
/etc/igfx_user_feature{,_next}.txt w, /etc/igfx_user_feature{,_next}.txt w,
/etc/libva.conf r,
owner /tmp/@{name}/.parentlock rw, owner /tmp/@{name}/.parentlock rw,
@{sys}/devices/@{pci}/{irq,revision,resource} r,
@{sys}/devices/@{pci}/config r,
deny @{config_dirs}/.parentlock rw, deny @{config_dirs}/.parentlock rw,
deny @{config_dirs}/startupCache/** r, deny @{config_dirs}/startupCache/** r,
deny @{user_cache_dirs}/startupCache/* r, deny @{user_cache_dirs}/startupCache/* r,

14
apparmor.d/profiles-a-f/code
View file

@ -14,16 +14,11 @@ profile code flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/chromium-common> include <abstractions/chromium-common>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/fonts> include <abstractions/graphics>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-intel>
include <abstractions/opencl-mesa>
include <abstractions/opencl-nvidia>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/vulkan>
capability sys_ptrace, capability sys_ptrace,
@ -61,13 +56,11 @@ profile code flags=(attach_disconnected) {
@{lib}/go/bin/* rPUx, @{lib}/go/bin/* rPUx,
@{bin}/python[0-9]* rUx @{bin}/python[0-9]* rUx
/etc/libva.conf r,
/etc/shells r, /etc/shells r,
/etc/lsb-release r, /etc/lsb-release r,
owner @{HOME}/@{XDG_SSH_DIR}/config r, owner @{HOME}/@{XDG_SSH_DIR}/config r,
owner @{code_config_dirs}/ rw,
owner @{code_config_dirs}/** rwkl -> @{code_config_dirs}/**, owner @{code_config_dirs}/** rwkl -> @{code_config_dirs}/**,
owner @{user_projects_dirs}/ r, owner @{user_projects_dirs}/ r,
@ -85,8 +78,7 @@ profile code flags=(attach_disconnected) {
@{sys}/devices/system/cpu/present r, @{sys}/devices/system/cpu/present r,
@{sys}/devices/system/cpu/kernel_max r, @{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/tty/tty[0-9]*/active r, @{sys}/devices/virtual/tty/tty@{int}/active r,
@{sys}/devices/@{pci}/irq r,
@{PROC}/ r, @{PROC}/ r,
@{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/fd/ r,

21
apparmor.d/profiles-a-f/element
View file

@ -11,19 +11,12 @@ profile element @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/chromium-common> include <abstractions/chromium-common>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/dri-common> include <abstractions/desktop>
include <abstractions/dri-enumerate> include <abstractions/graphics>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/nvidia>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/video> include <abstractions/video>
include <abstractions/vulkan>
include <abstractions/X-strict>
capability sys_ptrace, capability sys_ptrace,
@ -49,26 +42,16 @@ profile element @{exec_path} {
/usr/share/webapps/element/{,**} r, /usr/share/webapps/element/{,**} r,
/etc/libva.conf r,
/etc/element/{,**} r, /etc/element/{,**} r,
/etc/webapps/element/{,**} r, /etc/webapps/element/{,**} r,
owner @{user_config_dirs}/ r,
owner @{user_config_dirs}/Element/ rw, owner @{user_config_dirs}/Element/ rw,
owner @{user_config_dirs}/Element/** rwkl -> @{user_config_dirs}/Element/**, owner @{user_config_dirs}/Element/** rwkl -> @{user_config_dirs}/Element/**,
owner @{user_config_dirs}/pulse/client.conf r, owner @{user_config_dirs}/pulse/client.conf r,
owner @{user_config_dirs}/pulse/cookie rk, owner @{user_config_dirs}/pulse/cookie rk,
@{sys}/bus/pci/devices/ r,
@{sys}/devices/@{pci}/class r,
@{sys}/devices/@{pci}/resource r,
@{sys}/devices/@{pci}/irq r,
@{sys}/devices/system/cpu/cpu@{int}/cache/{,**} r,
@{sys}/devices/system/cpu/cpu@{int}/topology/{,**} r,
@{sys}/devices/system/cpu/kernel_max r, @{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/system/cpu/present r,
@{sys}/devices/virtual/tty/tty@{int}/active r, @{sys}/devices/virtual/tty/tty@{int}/active r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_{cur,min,max}_freq r,
@{PROC}/ r, @{PROC}/ r,
@{PROC}/sys/fs/inotify/max_user_watches r, @{PROC}/sys/fs/inotify/max_user_watches r,

11
apparmor.d/profiles-a-f/file-roller
View file

@ -12,14 +12,10 @@ profile file-roller @{exec_path} {
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/fonts> include <abstractions/desktop>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/user-download-strict> include <abstractions/user-download-strict>
include <abstractions/user-write> include <abstractions/user-write>
include <abstractions/wayland>
include <abstractions/X-strict>
# dbus: own bus=session name=org.gnome.ArchiveManager1 # dbus: own bus=session name=org.gnome.ArchiveManager1
# dbus: own bus=session name=org.gnome.FileRoller # dbus: own bus=session name=org.gnome.FileRoller
@ -42,10 +38,5 @@ profile file-roller @{exec_path} {
@{open_path} rPx -> child-open, @{open_path} rPx -> child-open,
/usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r,
/etc/gtk-3.0/settings.ini r,
include if exists <local/file-roller> include if exists <local/file-roller>
} }

6
apparmor.d/profiles-g-l/glxinfo
View file

@ -10,12 +10,8 @@ include <tunables/global>
@{exec_path} = @{bin}/glxinfo @{exec_path} = @{bin}/glxinfo
profile glxinfo @{exec_path} { profile glxinfo @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-common> include <abstractions/graphics>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/vulkan>
include <abstractions/X-strict> include <abstractions/X-strict>
capability sys_admin, capability sys_admin,

3
apparmor.d/profiles-s-z/thunderbird
View file

@ -144,9 +144,6 @@ profile thunderbird @{exec_path} {
@{run}/mount/utab r, @{run}/mount/utab r,
@{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r, @{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,
@{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
@{sys}/devices/system/cpu/present r,
@{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
@{PROC}/@{pids}/net/arp r, @{PROC}/@{pids}/net/arp r,