mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 00:48:10 +01:00
general_initial
This commit is contained in:
nobody43
Alex
parent
3eb8dd2811
commit
a873af1f26
36 changed files with 640 additions and 110 deletions
|
|
@ -82,6 +82,9 @@
|
|||
# investigate
|
||||
# /dev/ram[0-9]* r,
|
||||
|
||||
# ??
|
||||
@{sys}/devices/pci[0-9]*/*/virtio[0-9]*/host[0-9]*/target*/*/type r,
|
||||
|
||||
# CD-ROM
|
||||
/dev/sr[0-9]* rk,
|
||||
|
||||
|
|
|
|||
|
|
@ -5,5 +5,8 @@
|
|||
owner @{user_cache_dirs}/nvidia/ w,
|
||||
owner @{user_cache_dirs}/nvidia/GLCache/ rw,
|
||||
owner @{user_cache_dirs}/nvidia/GLCache/** rwk,
|
||||
owner @{HOME}/.nv/nvidia-application-profiles-rc r,
|
||||
|
||||
/etc/nvidia/nvidia-application-profiles-rc r,
|
||||
|
||||
unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"),
|
||||
|
|
|
|||
|
|
@ -43,6 +43,8 @@ profile thunderbird @{exec_path} {
|
|||
|
||||
ptrace peer=@{profile_name},
|
||||
|
||||
unix (send, receive) type=stream peer=(addr=none, label=xorg),
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
|
|
@ -76,6 +78,21 @@ profile thunderbird @{exec_path} {
|
|||
member={Change,Notify}
|
||||
peer=(name=ca.desrt.dconf),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/portal/desktop
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/portal/desktops
|
||||
interface=org.freedesktop.portal.Settings
|
||||
member=Read
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/login[0-9]*
|
||||
interface=org.freedesktop.login[0-9]*.Manager
|
||||
member={UserAdded,UserRemoved}
|
||||
peer=(name=:*, label=systemd-logind),
|
||||
|
||||
dbus bind bus=session
|
||||
name=org.mozilla.thunderbird.*,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ include <tunables/global>
|
|||
@{firefox_config_dirs} = @{HOME}/.mozilla/
|
||||
@{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/
|
||||
|
||||
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}
|
||||
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}{-bin,}
|
||||
profile firefox @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
|
|
@ -51,7 +51,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
|
|||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus send bus=session path=/ScreenSaver
|
||||
interface=org.freedesktop.ScreenSaver
|
||||
|
|
@ -110,17 +110,17 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
|
|||
dbus send bus=session path=/org/mozilla/firefox/Remote
|
||||
interface=org.mozilla.firefox
|
||||
member=OpenURL
|
||||
peer=(name=org.mozilla.firefox.* label=firefox),
|
||||
peer=(name=org.mozilla.firefox.* label=@{profile_name}),
|
||||
|
||||
dbus receive bus=session path=/org/mozilla/firefox/Remote
|
||||
interface=org.mozilla.firefox
|
||||
member=OpenURL
|
||||
peer=(name=:* label=firefox),
|
||||
peer=(name=:* label=@{profile_name}),
|
||||
|
||||
dbus bind bus=session
|
||||
dbus bind bus=session
|
||||
name=org.mpris.MediaPlayer2.firefox.*,
|
||||
|
||||
dbus bind bus=session
|
||||
dbus bind bus=session
|
||||
name=org.mozilla.firefox.*,
|
||||
|
||||
deny dbus send bus=system path=/org/freedesktop/hostname[0-9]*,
|
||||
|
|
@ -173,6 +173,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
|
|||
/etc/xul-ext/kwallet5.js r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/@{XDG_DESKTOP_DIR}/ w,
|
||||
owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ w,
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,
|
||||
|
|
@ -259,6 +261,9 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
|
|||
owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
|
||||
owner /dev/tty[0-9]* rw, # File Inherit
|
||||
|
||||
# X-tiny
|
||||
/tmp/.X0-lock r,
|
||||
|
||||
# Silencer
|
||||
deny @{firefox_lib_dirs}/** w,
|
||||
deny @{run}/user/@{uid}/gnome-shell-disable-extensions w,
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,GetConnectionUnixUser}
|
||||
member={RequestName,ReleaseName,GetConnectionUnixUser}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus bind bus=system
|
||||
|
|
@ -50,7 +50,8 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
/{usr/,}{s,}bin/userdel rPx,
|
||||
/{usr/,}bin/passwd rPx,
|
||||
/{usr/,}bin/chage rPx,
|
||||
/usr/share/language-tools/language-validate rPx,
|
||||
/usr/share/language-tools/language-validate rPx,
|
||||
/usr/share/language-tools/set-language-helper rPUx,
|
||||
|
||||
/usr/share/accountsservice/{,**} r,
|
||||
/usr/share/dbus-1/interfaces/*.xml r,
|
||||
|
|
|
|||
|
|
@ -17,6 +17,8 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
|
|||
signal (receive) set=(term hup) peer=gdm*,
|
||||
signal (receive) set=(term hup kill) peer=dbus-daemon,
|
||||
|
||||
unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*", label="{xorg,xkbcomp}"),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
|
|
@ -45,12 +47,12 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
|
|||
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Set
|
||||
peer=(name=:*, label="{gnome-extension-ding,gnome-control-center}"),
|
||||
peer=(name=:*), # all peer's labels
|
||||
|
||||
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
|
||||
interface=org.a11y.atspi.Socket
|
||||
member=Embed
|
||||
peer=(name=:*, label="{gnome-extension-ding,gnome-control-center,spice-vdagent}"),
|
||||
peer=(name=:*), # all peer's labels
|
||||
|
||||
dbus send bus=accessibility path=/org/a11y/atspi/registry
|
||||
interface=org.a11y.atspi.Registry
|
||||
|
|
@ -60,17 +62,17 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
|
|||
dbus receive bus=accessibility path=/org/a11y/atspi/registry
|
||||
interface=org.a11y.atspi.Registry
|
||||
member=GetRegisteredEvents
|
||||
peer=(name=:*, label=gnome-control-center),
|
||||
peer=(name=:*), # all peer's labels
|
||||
|
||||
dbus receive bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
|
||||
interface=org.a11y.atspi.DeviceEventController
|
||||
member={GetKeystrokeListeners,GetDeviceEventListeners}
|
||||
peer=(name=:*, label="{gnome-control-center,xdg-desktop-portal-*}"),
|
||||
peer=(name=:*), # all peer's labels
|
||||
|
||||
dbus send bus=session path=/org/a11y/bus
|
||||
interface=org.a11y.Bus
|
||||
member=GetAddress
|
||||
peer=(name=org.a11y.Bus, label=at-spi-bus-launcher),
|
||||
peer=(name=org.a11y.Bus, label="{at-spi-bus-launcher,unconfined}"),
|
||||
|
||||
dbus receive bus=session path=/
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName},
|
||||
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName,ReleaseName},
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/ColorManager{,/**}
|
||||
interface=org.freedesktop.ColorManager*,
|
||||
|
|
@ -30,8 +30,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
|
||||
interface=org.freedesktop.PolicyKit[0-9].Authority
|
||||
member=Changed
|
||||
peer=(name=:*, label=polkitd),
|
||||
peer=(name=:*, label=polkitd), # all members
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
|
|
@ -43,10 +42,15 @@ profile colord @{exec_path} flags=(attach_disconnected) {
|
|||
member=GetAll
|
||||
peer=(name=:*, label="{gsd-color,colord-sane,gnome-control-center}"),
|
||||
|
||||
dbus (send, receive) bus=system path=/org/freedesktop/ColorManager
|
||||
dbus send bus=system path=/org/freedesktop/ColorManager
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*, label=colord),
|
||||
peer=(name=:*, label=@{profile_name}),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/ColorManager/**
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*, label=@{profile_name}),
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.ColorManager,
|
||||
|
|
@ -67,8 +71,9 @@ profile colord @{exec_path} flags=(attach_disconnected) {
|
|||
owner /var/lib/colord/.cache/** rw,
|
||||
owner /var/lib/colord/{mapping,storage}.db{,-journal} rwk,
|
||||
|
||||
@{system_share_dirs}/mime/mime.cache r,
|
||||
/var/lib/gdm{3,}/.local/share/icc/edid-*.icc r,
|
||||
/var/lib/flatpak/exports/share/mime/mime.cache r,
|
||||
@{system_share_dirs}/mime/mime.cache r,
|
||||
|
||||
@{user_share_dirs}/icc/edid-*.icc r,
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{libexec}/{,colord/}colord-sane
|
||||
profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
|
||||
profile colord-sane @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/devices-usb>
|
||||
|
|
@ -26,7 +26,7 @@ profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
|
|||
member={GetAPIVersion,GetState,ServiceBrowserNew,Ping}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]
|
||||
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]*
|
||||
interface=org.freedesktop.Avahi.ServiceBrowser
|
||||
member={CacheExhausted,AllForNow},
|
||||
|
||||
|
|
@ -46,7 +46,11 @@ profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
|
|||
@{sys}/bus/scsi/devices/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/{vendor,model,type} r,
|
||||
|
||||
@{PROC}/sys/dev/parport/parport[0-9]*/base-addr r,
|
||||
@{PROC}/sys/dev/parport/parport[0-9]*/irq r,
|
||||
@{PROC}/sys/dev/parport/ r,
|
||||
|
||||
/dev/parport[0-9]* r,
|
||||
|
||||
include if exists <local/colord-sane>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{libexec}/{,colord/}colord-session
|
||||
profile colord-session @{exec_path} flags=(complain) {
|
||||
profile colord-session @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{libexec}/{,dconf/}dconf-service
|
||||
@{exec_path} = @{libexec}/{,dconf/}dconf-service
|
||||
profile dconf-service @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-session-strict>
|
||||
|
|
@ -22,13 +22,12 @@ profile dconf-service @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
dbus send bus=session path=/ca/desrt/dconf/Writer/user
|
||||
interface=ca.desrt.dconf.Writer
|
||||
member=Notify
|
||||
peer=(name=org.freedesktop.DBus), # all peer's labels
|
||||
peer=(name=org.freedesktop.DBus), # all members and peer's labels
|
||||
|
||||
dbus receive bus=session path=/ca/desrt/dconf/Writer/user
|
||||
interface=ca.desrt.dconf.Writer
|
||||
member=Change
|
||||
peer=(name=:*, label=gnome-control-center),
|
||||
peer=(name=:*), # all peer's labels
|
||||
|
||||
dbus receive bus=session path=/
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
|
|
|
|||
|
|
@ -21,13 +21,17 @@ profile polkitd @{exec_path} {
|
|||
|
||||
ptrace (read),
|
||||
|
||||
dbus (send) bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit1/*
|
||||
interface=org.freedesktop.{DBus.Introspectable,DBus.Properties,PolicyKit1.*}, # all members
|
||||
|
||||
dbus (send) bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
dbus send bus=system path=/org/gnome/PolicyKit1/*
|
||||
interface=org.freedesktop.PolicyKit1.AuthenticationAgent
|
||||
peer=(name=:*), # all members
|
||||
|
||||
dbus (bind) bus=system
|
||||
name=org.freedesktop.PolicyKit1,
|
||||
|
|
|
|||
|
|
@ -22,6 +22,7 @@ profile pulseaudio @{exec_path} {
|
|||
include <abstractions/hosts_access>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/X-strict>
|
||||
include <abstractions/freedesktop.org>
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
|
|
@ -113,10 +114,8 @@ profile pulseaudio @{exec_path} {
|
|||
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
|
||||
/{usr/,}lib/pulse-*/modules/*.so mr,
|
||||
|
||||
/usr/share/applications/{,**} r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/pulseaudio/{,**} r,
|
||||
/usr/share/ubuntu/applications/{,*} r,
|
||||
|
||||
/var/lib/snapd/desktop/applications/ r,
|
||||
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
member=Get
|
||||
peer=(name=org.freedesktop.login[0-9]),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/login[0-9]/session/_[0-9]*
|
||||
dbus receive bus=system path=/org/freedesktop/login[0-9]/session/*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged
|
||||
peer=(name=:*, label=systemd-logind),
|
||||
|
|
@ -41,8 +41,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
dbus (send, receive) bus=session path=/org/gnome/keyring/daemon
|
||||
interface=org.gnome.keyring.Daemon
|
||||
member=GetControlDirectory
|
||||
peer=(name="{org.gnome.keyring,:*}", label=gnome-keyring-daemon), # itself
|
||||
peer=(name="{org.gnome.keyring,:*}", label=@{profile_name}), # all members
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
|
|
@ -54,6 +53,41 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
member=SearchItems
|
||||
peer=(name=:*, label=gnome-shell),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets/aliases/default
|
||||
interface=org.freedesktop.Secret.Collection
|
||||
member=CreateItem
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets/aliases/default
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/secrets/collection/login
|
||||
interface=org.freedesktop.Secret.Collection
|
||||
member=ItemCreated
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/secrets/collection/login
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets
|
||||
interface=org.freedesktop.Secret.Service
|
||||
member={ReadAlias,OpenSession}
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets/collection/login/[0-9]*
|
||||
interface=org.freedesktop.Secret.Item
|
||||
member=GetSecret
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets{,/collection/**}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/portal/desktop
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
|
|
@ -64,6 +98,11 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
member=Introspect
|
||||
peer=(name=:*, label=gnome-shell),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets
|
||||
interface=org.freedesktop.Secret.Service
|
||||
member={GetSecrets,SearchItems}
|
||||
peer=(name=:*), # label="{unconfined,remmina}"),
|
||||
|
||||
dbus bind bus=session
|
||||
name=org.gnome.keyring,
|
||||
|
||||
|
|
@ -88,6 +127,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{HOME}/.local/ w,
|
||||
owner @{HOME}/.local/share/ w,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner @{run}/user/@{uid}/keyring/ rw,
|
||||
owner @{run}/user/@{uid}/keyring/* rw,
|
||||
|
|
|
|||
|
|
@ -18,6 +18,7 @@ profile tracker-extract @{exec_path} {
|
|||
include <abstractions/opencl-nvidia>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/X-strict>
|
||||
include <abstractions/freedesktop.org>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
|
|
@ -28,20 +29,22 @@ profile tracker-extract @{exec_path} {
|
|||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
|
||||
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
|
||||
interface=org.freedesktop.DBus.Peer
|
||||
member=Ping
|
||||
peer=(name=org.freedesktop.Tracker3.Miner.Files),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
|
||||
interface=org.freedesktop.Tracker3.Endpoint
|
||||
member=Query
|
||||
peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner),
|
||||
peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner), # all members
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
|
||||
interface=org.freedesktop.Tracker3.Endpoint
|
||||
member=GraphUpdated
|
||||
peer=(name=:*, label=tracker-miner),
|
||||
peer=(name=:*, label=tracker-miner), # all members
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/Tracker3/Miner/**
|
||||
interface=org.freedesktop.Tracker3.Miner
|
||||
peer=(name=org.freedesktop.DBus, label=tracker-miner), # all members
|
||||
|
||||
dbus send bus=session path=/org/gtk/vfs/mounttracker
|
||||
interface=org.gtk.vfs.MountTracker
|
||||
|
|
@ -63,8 +66,6 @@ profile tracker-extract @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/applications/*.desktop r,
|
||||
/usr/share/applications/mimeinfo.cache r,
|
||||
/usr/share/dconf/profile/gdm r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/hwdata/*.ids r,
|
||||
|
|
@ -85,6 +86,8 @@ profile tracker-extract @{exec_path} {
|
|||
/var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp*} rw,
|
||||
/var/lib/gdm{3,}/greeter-dconf-defaults r,
|
||||
|
||||
/var/lib/lightdm/.cache/gstreamer-1.0/registry.*.bin{,.tmp??????} r,
|
||||
|
||||
/var/lib/flatpak/exports/share/applications/mimeinfo.cache r,
|
||||
/var/lib/flatpak/exports/share/mime/mime.cache r,
|
||||
/var/lib/snapd/desktop/applications/*.desktop r,
|
||||
|
|
|
|||
|
|
@ -58,12 +58,14 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
|
||||
interface=org.freedesktop.Tracker3.Endpoint
|
||||
member=GraphUpdated
|
||||
peer=(name=org.freedesktop.DBus, label=tracker-extract),
|
||||
peer=(name=org.freedesktop.DBus, label=tracker-extract), # all members
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
|
||||
interface=org.freedesktop.Tracker3.Endpoint
|
||||
member=Query
|
||||
peer=(name=:*, label=tracker-extract), # all members
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/Tracker3/Miner/**
|
||||
interface=org.freedesktop.Tracker3.Miner
|
||||
peer=(name=:*, label=tracker-extract),
|
||||
|
||||
dbus receive bus=session path=/{,org}
|
||||
|
|
@ -82,7 +84,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
|
|||
/usr/share/gvfs/remote-volume-monitors/{,*.monitor} r,
|
||||
/usr/share/tracker3-miners/{,**} r,
|
||||
/usr/share/tracker3/{,**} r,
|
||||
/usr/share/ubuntu/applications/ r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
|
|
@ -94,6 +95,10 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
|
|||
/var/lib/gdm{3,}/.local/share/applications/ r,
|
||||
/var/lib/gdm{3,}/greeter-dconf-defaults r,
|
||||
|
||||
/var/lib/lightdm/.config/dconf/user r,
|
||||
/var/lib/lightdm/.cache/tracker3/files/meta.db{,-wal} rwk,
|
||||
/var/lib/lightdm/.cache/tracker3/files/no-need-mtime-check.txt{,.??????} rw,
|
||||
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
# Allow to search user files
|
||||
|
|
|
|||
|
|
@ -12,6 +12,7 @@ profile networkd-dispatcher @{exec_path} {
|
|||
include <abstractions/dbus-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/network1/link/*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
|
|
@ -31,4 +32,4 @@ profile networkd-dispatcher @{exec_path} {
|
|||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/networkd-dispatcher>
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/networkctl
|
||||
profile networkctl @{exec_path} flags=(attach_disconnected,complain) {
|
||||
profile networkctl @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}lib/systemd/systemd-machined
|
||||
profile systemd-machined @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
capability chown,
|
||||
|
|
@ -23,6 +24,44 @@ profile systemd-machined @{exec_path} {
|
|||
capability sys_chroot,
|
||||
capability sys_ptrace,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member=GetConnectionUnixUser
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/systemd1/{,{unit,job}/*}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(name=org.freedesktop.systemd1),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/systemd1{,/{unit,job}/*}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/systemd1
|
||||
interface=org.freedesktop.systemd1.Manager
|
||||
member={StopUnit,UnrefUnit,StartTransientUnit,Subscribe}
|
||||
peer=(name=org.freedesktop.systemd1),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/systemd1
|
||||
interface=org.freedesktop.systemd1.Manager
|
||||
member={JobRemoved,UnitRemoved,Reloading}
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/machine1
|
||||
interface=org.freedesktop.machine1.Manager
|
||||
member={TerminateMachine,GetMachineByPID,CreateMachineWithNetwork}
|
||||
peer=(name=:*, label=libvirtd),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/machine1/machine/*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(name=:*, label=libvirtd),
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.machine1,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/var/lib/machines/{,**} rw,
|
||||
|
|
@ -30,6 +69,7 @@ profile systemd-machined @{exec_path} {
|
|||
|
||||
@{run}/systemd/machines/{,**} rw,
|
||||
@{run}/systemd/userdb/io.systemd.Machine rw,
|
||||
@{run}/systemd/notify w,
|
||||
|
||||
include if exists <local/systemd-machined>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/virtlogd
|
||||
@{exec_path} = /{usr/,}{s,}bin/virtlogd
|
||||
profile virtlogd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/openssl>
|
||||
|
|
@ -30,6 +30,7 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{run}/libvirt/common/system.token rwk,
|
||||
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
||||
@{run}/libvirt/virtlogd-sock rw,
|
||||
@{run}/virtlogd.pid rwk,
|
||||
|
||||
@{sys}/devices/system/node/ r,
|
||||
|
|
@ -43,4 +44,4 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
|
|||
/dev/dri/ r,
|
||||
|
||||
include if exists <local/virtlogd>
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -31,6 +31,7 @@ profile acpi-powerbtn flags=(attach_disconnected) {
|
|||
@{PROC} r,
|
||||
@{PROC}/uptime r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
|
||||
deny / r,
|
||||
|
||||
|
|
|
|||
29
apparmor.d/profiles-g-l/loginctl
Normal file
29
apparmor.d/profiles-g-l/loginctl
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}bin/loginctl
|
||||
profile loginctl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
|
||||
capability sys_resource,
|
||||
capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
dbus (send) bus=system path=/org/freedesktop/login[0-9]*
|
||||
interface=org.freedesktop.login[0-9]*.Manager
|
||||
member={ListSessions,GetSession}
|
||||
peer=(name=org.freedesktop.login[0-9]* label=systemd-logind),
|
||||
|
||||
dbus (send) bus=system path=/org/freedesktop/login[0-9]*/session/**
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member={Get,GetAll}
|
||||
peer=(name=org.freedesktop.login[0-9]* label=systemd-logind),
|
||||
|
||||
include if exists <local/loginctl>
|
||||
}
|
||||
|
|
@ -46,6 +46,10 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
|
|||
/{usr/,}bin/mysqladmin rPUx,
|
||||
/{usr/,}bin/systemd-tty-ask-password-agent rPx,
|
||||
/{usr/,}lib/php/php[7-8].[3-4]-fpm-reopenlogs rPUx,
|
||||
/etc/init.d/nginx rPUx,
|
||||
/{usr/,}{s,}bin/squid rPUx,
|
||||
|
||||
/{usr/,}bin/pgrep rCx -> pgrep,
|
||||
|
||||
# no new privs
|
||||
#/{usr/,}bin/systemctl rCx -> systemctl,
|
||||
|
|
@ -98,5 +102,18 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
|
|||
include if exists <local/logrotate_systemctl>
|
||||
}
|
||||
|
||||
profile pgrep {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/pgrep mr,
|
||||
|
||||
# The /proc/ dir and the cmdline file have to be radable to avoid pgrep segfault.
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
include if exists <local/logrotate_pgrep>
|
||||
}
|
||||
|
||||
include if exists <local/logrotate>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}{s,}bin/mount
|
||||
profile mount @{exec_path} flags=(complain) {
|
||||
profile mount @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ profile nmap @{exec_path} {
|
|||
network netlink raw,
|
||||
network packet raw,
|
||||
|
||||
@{exec_path} r,
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/net/dev r,
|
||||
owner @{PROC}/@{pid}/net/if_inet6 r,
|
||||
|
|
|
|||
15
apparmor.d/profiles-m-r/nvidia-detector
Normal file
15
apparmor.d/profiles-m-r/nvidia-detector
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}bin/nvidia-detector
|
||||
profile nvidia-detector @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
include if exists <local/nvidia-detector>
|
||||
}
|
||||
26
apparmor.d/profiles-m-r/nvidia-persistenced
Normal file
26
apparmor.d/profiles-m-r/nvidia-persistenced
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}bin/nvidia-persistenced
|
||||
profile nvidia-persistenced @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nvidia>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability chown,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
/etc/netconfig r,
|
||||
|
||||
@{run}/nvidia-persistenced/{,**} rw,
|
||||
@{run}/nvidia-persistenced/*.pid k,
|
||||
|
||||
include if exists <local/nvidia-persistenced>
|
||||
}
|
||||
|
|
@ -8,7 +8,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/pkexec
|
||||
profile pkexec @{exec_path} flags=(complain) {
|
||||
profile pkexec @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/consoles>
|
||||
|
|
@ -23,7 +23,8 @@ profile pkexec @{exec_path} flags=(complain) {
|
|||
capability setgid, # gdbus
|
||||
capability setuid, # gmain
|
||||
capability sys_ptrace,
|
||||
audit deny capability sys_nice,
|
||||
capability sys_nice,
|
||||
capability sys_resource,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
|
|
@ -54,6 +55,7 @@ profile pkexec @{exec_path} flags=(complain) {
|
|||
# Apps to be run via pkexec
|
||||
/{usr/,}{s,}bin/* rPUx,
|
||||
/{usr/,}lib/gvfs/gvfsd-admin rPUx, #(#FIXME#)
|
||||
@{libexec}/polkit-agent-helper-[0-9] rPx,
|
||||
/{usr/,}lib/polkit-agent-helper-[0-9] rPx,
|
||||
/{usr/,}lib/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
|
||||
/{usr/,}lib/update-notifier/package-system-locked rPx,
|
||||
|
|
|
|||
|
|
@ -31,11 +31,13 @@ profile qbittorrent @{exec_path} {
|
|||
include <abstractions/dbus-accessibility-strict>
|
||||
include <abstractions/dbus-network-manager-strict>
|
||||
include <abstractions/dbus-gtk>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/wayland>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/nvidia>
|
||||
|
||||
signal send set=(term, kill) peer=qbittorrent//python3,
|
||||
|
||||
|
|
@ -45,17 +47,17 @@ profile qbittorrent @{exec_path} {
|
|||
network inet6 stream,
|
||||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus send bus=session path=/StatusNotifierWatcher
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
member=Introspect
|
||||
peer=(name=org.kde.StatusNotifierWatcher),
|
||||
|
||||
dbus send bus=session path=/StatusNotifierWatcher
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(name=org.kde.StatusNotifierWatcher),
|
||||
|
||||
dbus send bus=session path=/StatusNotifierWatcher
|
||||
interface=org.kde.StatusNotifierWatcher
|
||||
member=RegisterStatusNotifierItem
|
||||
|
|
@ -71,12 +73,12 @@ profile qbittorrent @{exec_path} {
|
|||
member=Activate
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=session path=/StatusNotifierItem
|
||||
dbus send bus=session path=/StatusNotifierWatcher
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*),
|
||||
member=Get
|
||||
peer=(name=org.kde.StatusNotifierWatcher),
|
||||
|
||||
dbus receive bus=session path=/MenuBar
|
||||
dbus receive bus=session path={/StatusNotifierItem,/MenuBar}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*),
|
||||
|
|
@ -90,11 +92,6 @@ profile qbittorrent @{exec_path} {
|
|||
interface=com.canonical.dbusmenu
|
||||
member={GetLayout,GetGroupProperties,AboutToShow,AboutToShowGroup,EventGroup,Event}
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
|
||||
interface=org.a11y.atspi.Socket
|
||||
|
|
@ -223,11 +220,12 @@ profile qbittorrent @{exec_path} {
|
|||
/{usr/,}bin/engrampa rPx,
|
||||
@{FIREFOX_BIN} rPx,
|
||||
|
||||
/{usr/,}bin/{ba,da,}sh rix,
|
||||
/{usr/,}bin/{g,m,}awk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/xfce4-mime-helper rix,
|
||||
/{usr/,}bin/{ba,da,}sh rix,
|
||||
/{usr/,}bin/{g,m,}awk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/xfce4-mime-helper rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
|
|
|
|||
145
apparmor.d/profiles-m-r/remmina
Normal file
145
apparmor.d/profiles-m-r/remmina
Normal file
|
|
@ -0,0 +1,145 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{,usr/}bin/remmina
|
||||
profile remmina @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ibus>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-accessibility-strict>
|
||||
include <abstractions/dbus-gtk>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/secrets{,/collection/login{,/[0-9]*}}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*, label=gnome-keyring-daemon),
|
||||
|
||||
dbus send bus=session path=/StatusNotifierWatcher
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
member=Introspect
|
||||
peer=(name=org.kde.StatusNotifierWatcher),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/secrets
|
||||
interface=org.freedesktop.Secret.Service
|
||||
member={OpenSession,GetSecrets,SearchItems,ReadAlias}
|
||||
peer=(name=:*, label=gnome-keyring-daemon),
|
||||
|
||||
dbus (send, receive) bus=session path=/org/ayatana/NotificationItem/remmina_icon{,/**}
|
||||
peer=(name="{:*,org.freedesktop.DBus}"), # all interfaces and members
|
||||
|
||||
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
|
||||
interface=org.a11y.atspi.Socket
|
||||
member=Embed
|
||||
peer=(name=org.a11y.atspi.Registry),
|
||||
|
||||
dbus send bus=accessibility path=/org/a11y/atspi/registry
|
||||
interface=org.a11y.atspi.Registry
|
||||
member=GetRegisteredEvents
|
||||
peer=(name=org.a11y.atspi.Registry),
|
||||
|
||||
dbus receive bus=accessibility path=/org/a11y/atspi/registry
|
||||
interface=org.a11y.atspi.Registry
|
||||
member=EventListenerDeregistered
|
||||
peer=(name=:*),
|
||||
|
||||
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Set
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/secrets/collection/session
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*, label=gnome-keyring-daemon),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/hostname[0-9]*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=session path=/StatusNotifierWatcher
|
||||
interface=org.kde.StatusNotifierWatcher
|
||||
member=RegisterStatusNotifierItem
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
|
||||
interface=org.a11y.atspi.DeviceEventController
|
||||
member={GetKeystrokeListeners,GetDeviceEventListeners}
|
||||
peer=(name=org.a11y.atspi.Registry),
|
||||
|
||||
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
|
||||
interface=org.gtk.Private.RemoteVolumeMonitor
|
||||
member={IsSupported,List}
|
||||
peer=(name=:*),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/secrets/aliases/default
|
||||
interface=org.freedesktop.Secret.Collection
|
||||
member=CreateItem
|
||||
peer=(name=org.freedesktop.secrets, label=gnome-keyring-daemon),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets/collection/login
|
||||
interface=org.freedesktop.Secret.Collection
|
||||
member=ItemCreated
|
||||
peer=(name=:*, label=gnome-keyring-daemon),
|
||||
|
||||
dbus receive bus=session path=/org/freedesktop/secrets/collection/login
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged
|
||||
peer=(name=:*, label=gnome-keyring-daemon),
|
||||
|
||||
dbus bind bus=session
|
||||
name=org.remmina.Remmina,
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
/etc/timezone r,
|
||||
/etc/ssh/ssh_config r,
|
||||
/etc/ssh/ssh_config.d/{,*} r,
|
||||
/usr/share/remmina/{,**} r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
owner @{user_config_dirs}/autostart/remmina-applet.desktop r,
|
||||
owner @{user_config_dirs}/gtk-3.0/bookmarks r,
|
||||
owner @{user_config_dirs}/freerdp/known_hosts2 rwk,
|
||||
owner @{user_config_dirs}/remmina/{,**} rw,
|
||||
owner @{user_share_dirs}/remmina/{,**} rw,
|
||||
owner @{user_cache_dirs}/remmina/{,**} rw,
|
||||
owner @{HOME}/@{XDG_SSH_DIR}/{,*} r,
|
||||
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
owner @{run}/user/@{uid}/keyring/ssh rw,
|
||||
|
||||
# gtk-tiny
|
||||
/etc/gtk-3.0/settings.ini r,
|
||||
/usr/share/themes/{,**} r,
|
||||
|
||||
# X-strict
|
||||
owner @{HOME}/.Xauthority r,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*", label="{xorg,xkbcomp}"),
|
||||
/etc/X11/{,**} r,
|
||||
|
||||
include if exists <local/remmina>
|
||||
}
|
||||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
profile rustdesk @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/X-strict>
|
||||
include <abstractions/fonts>
|
||||
|
|
@ -18,6 +19,9 @@ profile rustdesk @{exec_path} {
|
|||
include <abstractions/dbus-accessibility-strict>
|
||||
include <abstractions/dbus-gtk>
|
||||
|
||||
capability dac_read_search,
|
||||
capability dac_override,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
|
|
@ -46,15 +50,22 @@ profile rustdesk @{exec_path} {
|
|||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{,usr/}bin/w rPx,
|
||||
/{,usr/}bin/ps rPx,
|
||||
/{,usr/}bin/whoami rPx,
|
||||
/{,usr/}bin/loginctl rPx,
|
||||
/{,usr/}bin/curl rix,
|
||||
/{,usr/}bin/ls rix,
|
||||
|
||||
/{,usr/}bin/python3.[0-9]* rCx -> python,
|
||||
/{,usr/}bin/python3.[0-9]* rPx -> rustdesk_python,
|
||||
/{,usr/}bin/{,ba,da}sh rPx -> rustdesk_shell,
|
||||
|
||||
owner /tmp/[rR]ust[dD]esk/{,**} rw,
|
||||
/etc/gdm{,3}/custom.conf r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
owner @{HOME}/.local/ w,
|
||||
owner @{user_share_dirs}/ w,
|
||||
owner @{user_share_dirs}/logs/ w,
|
||||
owner @{user_share_dirs}/logs/[rR]ust[dD]esk/{,**} rw,
|
||||
owner @{user_config_dirs}/[rR]ust[dD]esk/{,**} rw,
|
||||
|
||||
|
|
@ -64,6 +75,27 @@ profile rustdesk @{exec_path} {
|
|||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
# grep ps
|
||||
@{PROC} r,
|
||||
capability sys_ptrace,
|
||||
ptrace (read),
|
||||
@{PROC}/@{pid}/stat r,
|
||||
@{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/@{pid}/environ r,
|
||||
@{PROC}/@{pid}/io r,
|
||||
@{PROC}/@{pid}/task/ r,
|
||||
@{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
@{PROC}/@{pid}/task/@{tid}/io r,
|
||||
@{PROC}/@{pid}/task/@{tid}/status r,
|
||||
|
||||
# service and GUI intercommunication
|
||||
@{HOME}/.Xauthority r,
|
||||
@{run}/user/@{uid}/.mutter-Xwaylandauth.?????? r,
|
||||
@{run}/user/@{uid}/gdm{,3}/Xauthority r,
|
||||
/tmp/[rR]ust[dD]esk/{,**} rw,
|
||||
/tmp/.X11-unix/ r,
|
||||
/var/lib/lightdm/.Xauthority r,
|
||||
|
||||
# pulse
|
||||
/dev/shm/ r,
|
||||
/etc/pulse/client.conf r,
|
||||
|
|
@ -72,8 +104,11 @@ profile rustdesk @{exec_path} {
|
|||
owner @{run}/user/@{uid}/pulse/native rw,
|
||||
owner @{user_config_dirs}/pulse/ rw,
|
||||
owner @{user_config_dirs}/pulse/cookie rwk,
|
||||
owner @{user_config_dirs}/pulse/*-runtime{,.tmp} rw,
|
||||
owner /tmp/pulse-*/ rw,
|
||||
|
||||
# gtk-tiny
|
||||
/usr/share/themes/{,**} r,
|
||||
/etc/gtk-3.0/settings.ini r,
|
||||
/usr/share/themes/*/gtk-3.0/gtk.css r,
|
||||
|
||||
|
|
@ -84,43 +119,52 @@ profile rustdesk @{exec_path} {
|
|||
# file_inherit, X-tiny
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# excessive?
|
||||
deny @{PROC} r,
|
||||
# @{PROC} r,
|
||||
# capability sys_ptrace,
|
||||
# ptrace (read),
|
||||
# owner @{PROC}/@{pid}/stat r,
|
||||
# owner @{PROC}/@{pid}/environ r,
|
||||
# owner @{PROC}/@{pid}/io r,
|
||||
# owner @{PROC}/@{pid}/task/ r,
|
||||
# owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
# owner @{PROC}/@{pid}/task/@{tid}/io r,
|
||||
# owner @{PROC}/@{pid}/task/@{tid}/status r,
|
||||
# Do not reveal username (pop-up only)
|
||||
deny /etc/passwd r,
|
||||
|
||||
profile python {
|
||||
# It's possible to disable root-based service ('systemctl disable rustdesk.service') and use RD only on-demand (or as client-only). After that, sudo isn't necessary.
|
||||
# deny /{,usr/}bin/sudo x,
|
||||
/{,usr/}bin/sudo rCx -> sudo,
|
||||
profile sudo {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
/{,usr/}bin/python3.[0-9]* r,
|
||||
capability sys_resource,
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
capability audit_write,
|
||||
|
||||
/{,usr/}bin/{,ba,da}sh rix,
|
||||
/{,usr/}bin/chmod rix,
|
||||
/{,usr/}bin/uname rPx,
|
||||
/usr/share/rustdesk/files/pynput_service.py rPx,
|
||||
network netlink raw,
|
||||
|
||||
/{,usr/}bin/sudo r,
|
||||
|
||||
/etc/sudo.conf r,
|
||||
/etc/sudoers r,
|
||||
/etc/pam.d/* r,
|
||||
/etc/login.defs r,
|
||||
/etc/shadow r,
|
||||
/etc/security/capability.conf r,
|
||||
/etc/security/limits.conf r,
|
||||
/etc/security/limits.d/{,*} r,
|
||||
/etc/security/pam_env.conf r,
|
||||
/etc/sudoers.d/{,*} r,
|
||||
/etc/environment r,
|
||||
/etc/default/locale r,
|
||||
|
||||
/usr/libexec/sudo/libsudo_util.so* mr,
|
||||
/usr/libexec/sudo/sudoers.so mr,
|
||||
|
||||
@{PROC}/1/limits r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/usr/share/[rR]ust[dD]esk/files/{,**} r,
|
||||
owner /tmp/[rR]ust[dD]esk/ w,
|
||||
owner /tmp/[rR]ust[dD]esk/pynput_service rw,
|
||||
/{,usr/}{,local/}bin/rustdesk rPx,
|
||||
/{,usr/}bin/python3.[0-9]* rPx -> rustdesk_python,
|
||||
|
||||
# X-tiny
|
||||
/tmp/.X11-unix/* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
include if exists <local/rustdesk_python>
|
||||
include if exists <local/rustdesk_sudo>
|
||||
}
|
||||
|
||||
include if exists <local/rustdesk>
|
||||
|
|
@ -133,3 +177,61 @@ profile rustdesk_pynput_service /usr/share/rustdesk/files/pynput_service.py {
|
|||
|
||||
include if exists <local/rustdesk_pynput_service>
|
||||
}
|
||||
|
||||
profile rustdesk_python {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
|
||||
capability dac_read_search,
|
||||
capability dac_override,
|
||||
|
||||
/{,usr/}bin/python3.[0-9]* r,
|
||||
|
||||
/{,usr/}bin/{,ba,da}sh rix,
|
||||
/{,usr/}bin/chmod rix,
|
||||
/{,usr/}bin/uname rPx,
|
||||
/usr/share/rustdesk/files/pynput_service.py rPx,
|
||||
|
||||
/usr/local/lib/python3.[0-9]*/dist-packages/pynput/{,**} r,
|
||||
/usr/share/[rR]ust[dD]esk/files/{,**} r,
|
||||
/tmp/[rR]ust[dD]esk/ w,
|
||||
/tmp/[rR]ust[dD]esk/pynput_service rw,
|
||||
|
||||
@{run}/user/@{uid}/gdm{,3}/Xauthority r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
# X-tiny
|
||||
/tmp/.X11-unix/* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
include if exists <local/rustdesk_python>
|
||||
}
|
||||
|
||||
profile rustdesk_shell {
|
||||
include <abstractions/base>
|
||||
|
||||
capability sys_ptrace,
|
||||
capability dac_read_search,
|
||||
deny capability dac_override,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
/{,usr/}bin/{,ba,da}sh r,
|
||||
|
||||
/{,usr/}bin/tr rix,
|
||||
/{,usr/}bin/{,e}grep rix,
|
||||
/{,usr/}bin/tail rix,
|
||||
/{,usr/}bin/xargs rix,
|
||||
/{,usr/}bin/sed rix,
|
||||
/{,usr/}bin/cat rix,
|
||||
|
||||
/{,usr/}bin/ps rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/@{pid}/environ r,
|
||||
|
||||
include if exists <local/rustdesk_shell>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ profile sensors @{exec_path} {
|
|||
@{sys}/devices/**/hwmon*/{name,temp*,*_input} r,
|
||||
@{sys}/devices/**/hwmon*/**/{name,temp*,*_input} r,
|
||||
@{sys}/devices/**/hwmon/hwmon[0-9]*/power[0-9]*_crit r,
|
||||
@{sys}/devices/i2c-[0-9]*/name r,
|
||||
@{sys}/devices/{,platform/*.{i2c,hdmi}/}i2c-[0-9]*/name r,
|
||||
@{sys}/devices/pci[0-9]*/**/name r,
|
||||
@{sys}/devices/platform/**/power_supply/**/hwmon[0-9]*/curr1_max r,
|
||||
@{sys}/devices/virtual/hwmon/hwmon[0-9]* r,
|
||||
|
|
|
|||
|
|
@ -21,5 +21,7 @@ profile smartctl @{exec_path} {
|
|||
/usr/share/smartmontools/** r,
|
||||
/var/lib/smartmontools/** r,
|
||||
|
||||
@{PROC}/devices r,
|
||||
|
||||
include if exists <local/smartctl>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,13 +13,19 @@ profile thermald @{exec_path} {
|
|||
include <abstractions/dbus-strict>
|
||||
|
||||
capability sys_boot,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
|
||||
|
||||
dbus (bind) bus=system
|
||||
name=org.freedesktop.thermald,
|
||||
|
||||
dbus (send) bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member=RequestName,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
@ -52,6 +58,7 @@ profile thermald @{exec_path} {
|
|||
@{sys}/devices/virtual/thermal/thermal_zone[0-9]*/ r,
|
||||
@{sys}/devices/virtual/thermal/thermal_zone[0-9]*/trip_point_[0-9]*_temp rw,
|
||||
@{sys}/devices/virtual/thermal/thermal_zone[0-9]*/trip_point_[0-9]*_type r,
|
||||
@{sys}/devices/virtual/thermal/thermal_zone[0-9]*/cdev[0-9]*_trip_point r,
|
||||
|
||||
@{sys}/devices/virtual/thermal/cooling_device[0-9]*/ r,
|
||||
@{sys}/devices/virtual/thermal/cooling_device[0-9]*/cur_state rw,
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}{s,}bin/umount
|
||||
profile umount @{exec_path} flags=(complain) {
|
||||
profile umount @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
|
|
|
|||
46
apparmor.d/profiles-s-z/virtiofsd
Normal file
46
apparmor.d/profiles-s-z/virtiofsd
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{LOCAL_SHARED_DIRS} = /var/lib/libvirt/shared
|
||||
|
||||
@{exec_path} = /{,usr/}lib/qemu/virtiofsd
|
||||
profile virtiofsd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability sys_resource,
|
||||
capability sys_admin,
|
||||
capability setpcap,
|
||||
capability dac_read_search,
|
||||
capability dac_override,
|
||||
capability chown,
|
||||
|
||||
unix (send, receive) type=stream peer=(addr=none, label=libvirt-@{uuid}),
|
||||
|
||||
mount options=(rw, rslave) -> /,
|
||||
umount /,
|
||||
mount options=(rw, nosuid, nodev, noexec, relatime) -> @{PROC},
|
||||
mount options=(rw, bind) @{PROC}/1/fd/ -> @{PROC},
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
@{PROC}/sys/fs/file-max r,
|
||||
|
||||
owner @{run}/libvirt/qemu/*.pid rw,
|
||||
|
||||
/var/lib/libvirt/qemu/*/fs[0-9]*-fs.sock rw,
|
||||
|
||||
# shared folders
|
||||
mount options=(rw, rbind) -> @{LOCAL_SHARED_DIRS}/,
|
||||
pivot_root @{LOCAL_SHARED_DIRS}/,
|
||||
@{LOCAL_SHARED_DIRS}/ r,
|
||||
|
||||
include if exists <local/virtiofsd>
|
||||
}
|
||||
|
|
@ -29,6 +29,8 @@ cockpit-ssh complain
|
|||
cockpit-tls complain
|
||||
cockpit-ws complain
|
||||
cockpit-wsinstance-factory complain
|
||||
colord-sane complain
|
||||
colord-session complain
|
||||
containerd-shim-runc-v2 attach_disconnected,complain
|
||||
cups-backend-beh complain
|
||||
cups-backend-brf complain
|
||||
|
|
@ -132,11 +134,11 @@ libvirtd attach_disconnected,complain
|
|||
locale-gen complain
|
||||
localectl complain
|
||||
login complain
|
||||
loginctl complain
|
||||
lvm complain
|
||||
lvmconfig complain
|
||||
lvmdump complain
|
||||
lvmpolld complain
|
||||
lvmpolld complain
|
||||
man complain
|
||||
mdevctl complain
|
||||
mke2fs complain
|
||||
|
|
@ -144,8 +146,11 @@ ModemManager attach_disconnected,complain
|
|||
molly-guard complain
|
||||
mount complain
|
||||
nautilus complain
|
||||
nvidia-detector complain
|
||||
nvidia-persistenced complain
|
||||
needrestart attach_disconnected,complain
|
||||
needrestart-iucode-scan-versions complain
|
||||
networkctl complain
|
||||
networkd-dispatcher complain
|
||||
nft complain
|
||||
nmap complain
|
||||
|
|
@ -159,6 +164,7 @@ pinentry complain
|
|||
pinentry-curses complain
|
||||
pinentry-gnome3 complain
|
||||
pinentry-gtk-2 complain
|
||||
pkexec complain
|
||||
pkttyagent complain
|
||||
plymouth complain
|
||||
plymouth-set-default-theme attach_disconnected,complain
|
||||
|
|
@ -166,6 +172,7 @@ plymouthd complain
|
|||
power-profiles-daemon attach_disconnected,complain
|
||||
qemu-ga complain
|
||||
repo complain
|
||||
remmina complain
|
||||
resolvconf complain
|
||||
run-parts complain
|
||||
runuser complain
|
||||
|
|
@ -258,6 +265,7 @@ update-secureboot-policy complain
|
|||
uptimed complain
|
||||
userdbctl complain
|
||||
virt-manager attach_disconnected,complain
|
||||
virtiofsd complain
|
||||
wg complain
|
||||
wg-quick complain
|
||||
xdg-dbus-proxy attach_disconnected,complain
|
||||
|
|
|
|||
Loading…
Reference in a new issue