diff --git a/apparmor.d/abstractions/chromium b/apparmor.d/abstractions/chromium index 43fcd882..d8710278 100644 --- a/apparmor.d/abstractions/chromium +++ b/apparmor.d/abstractions/chromium @@ -185,7 +185,7 @@ @{sys}/devices/**/uevent r, @{sys}/devices/pci[0-9]*/**/{in_intensity_sampling_frequency,in_intensity_scale,in_illuminance_raw} r, @{sys}/devices/pci[0-9]*/**/boot_vga r, - @{sys}/devices/pci[0-9]*/**/irq r, + @{sys}/devices/pci[0-9]*/**/{resource,irq} r, @{sys}/devices/pci[0-9]*/**/report_descriptor r, @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r, @{sys}/devices/system/cpu/kernel_max r, diff --git a/apparmor.d/groups/apt/dpkg-genchanges b/apparmor.d/groups/apt/dpkg-genchanges index eabef350..a4905691 100644 --- a/apparmor.d/groups/apt/dpkg-genchanges +++ b/apparmor.d/groups/apt/dpkg-genchanges @@ -18,6 +18,9 @@ profile dpkg-genchanges @{exec_path} flags=(complain) { /usr/share/dpkg/cputable r, /usr/share/dpkg/tupletable r, + /usr/share/lto-disabled-list/lto-disabled-list r, + + /etc/dpkg/origins/* r, # For package building owner @{user_build_dirs}/** rw, diff --git a/apparmor.d/groups/children/child-dpkg b/apparmor.d/groups/children/child-dpkg index 99bd2d17..51ba71c5 100644 --- a/apparmor.d/groups/children/child-dpkg +++ b/apparmor.d/groups/children/child-dpkg @@ -2,10 +2,6 @@ # Copyright (C) 2019-2021 Mikhail Morfikov # SPDX-License-Identifier: GPL-2.0-only -# Note: This profile does not specify an attachment path because it is -# intended to be used only via "Px -> child-dpkg" exec transitions -# from other profiles. - # Note: This profile does not specify an attachment path because it is # intended to be used only via "Px -> child-dpkg" exec transitions from # other profiles. We want to confine the dpkg(1) utility when it diff --git a/apparmor.d/groups/children/child-open b/apparmor.d/groups/children/child-open index 39bc07ae..3bb56f49 100644 --- a/apparmor.d/groups/children/child-open +++ b/apparmor.d/groups/children/child-open @@ -56,9 +56,9 @@ profile child-open { /usr/share/code/{bin/,}code rPx, # Others + /{usr/,}bin/*Foliate rPUx, /{usr/,}bin/discord{,-ptb} rPx, /{usr/,}bin/draw.io rPUx, - /{usr/,}bin/*Foliate rPUx, /{usr/,}bin/dropbox rPx, /{usr/,}bin/engrampa rPx, /{usr/,}bin/eog rPUx, @@ -68,6 +68,7 @@ profile child-open { /{usr/,}bin/geany rPx, /{usr/,}bin/gnome-calculator rPUx, /{usr/,}bin/gnome-disk-image-mounter rPx, + /{usr/,}bin/gnome-disks rPx, /{usr/,}bin/kgx rPUx, /{usr/,}bin/okular rPx, /{usr/,}bin/qbittorrent rPx, diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index b609cd45..38313fc5 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -70,6 +70,8 @@ profile geoclue @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + /usr/share/glib-2.0/schemas/gschemas.compiled r, + /etc/geoclue/{,**} r, @{run}/systemd/journal/socket rw, diff --git a/apparmor.d/groups/freedesktop/xdg-user-dir b/apparmor.d/groups/freedesktop/xdg-user-dir new file mode 100644 index 00000000..9115c358 --- /dev/null +++ b/apparmor.d/groups/freedesktop/xdg-user-dir @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/xdg-user-dir +profile xdg-user-dir @{exec_path} { + include + + @{exec_path} mr, + + /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}bin/env rix, + + owner @{user_config_dirs}/user-dirs.dirs r, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 28ae2ebd..2c82c157 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -18,9 +18,10 @@ profile steam @{exec_path} { include include include + include include include - include + include include include @@ -42,40 +43,44 @@ profile steam @{exec_path} { @{exec_path} mrix, /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}bin/{m,g,}awk rix, /{usr/,}bin/*sum rix, /{usr/,}bin/basename rix, /{usr/,}bin/cat rix, /{usr/,}bin/cmp rix, /{usr/,}bin/cp rix, - /{usr/,}bin/timeout rix, /{usr/,}bin/cut rix, /{usr/,}bin/dirname rix, - /{usr/,}bin/{m,g,}awk rix, + /{usr/,}bin/file rix, + /{usr/,}bin/find rix, /{usr/,}bin/getopt rix, /{usr/,}bin/grep rix, /{usr/,}bin/head rix, /{usr/,}bin/ldconfig rix, /{usr/,}bin/ldd rix, /{usr/,}bin/ln rix, + /{usr/,}bin/lsb_release rPx -> lsb_release, /{usr/,}bin/lspci rPx, /{usr/,}bin/mkdir rix, /{usr/,}bin/mv rix, /{usr/,}bin/readlink rix, /{usr/,}bin/realpath rix, /{usr/,}bin/rm rix, + /{usr/,}bin/rmdir rix, /{usr/,}bin/sed rix, /{usr/,}bin/steam-runtime-urlopen rix, /{usr/,}bin/tail rix, /{usr/,}bin/tar rix, + /{usr/,}bin/timeout rix, /{usr/,}bin/touch rix, /{usr/,}bin/tr rix, /{usr/,}bin/uname rix, /{usr/,}bin/which rix, /{usr/,}bin/xdg-icon-resource rPx, + /{usr/,}bin/xdg-user-dir rPx, /{usr/,}bin/xz rix, /{usr/,}bin/zenity rix, /{usr/,}lib{32,64}/ld-linux.so* rix, - /{usr/,}bin/lsb_release rPx -> lsb_release, @{user_share_dirs}/Steam/config/widevine/linux-x64/libwidevinecdm.so mr, @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier/*entry-point rpx, @@ -87,9 +92,9 @@ profile steam @{exec_path} { @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/reaper rpx, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam rix, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime-heavy.sh rix, - @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime{,-heavy}/{setup,run}.sh rix, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime{,-heavy}/{amd64,i386}/usr/bin/* rix, - @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{usr/,}lib{exec,}/**.so* mr, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime{,-heavy}/{setup,run}.sh rix, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{usr/,}lib{exec,}/** mr, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steamwebhelper rix, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steamwebhelper.sh rix, @@ -126,6 +131,7 @@ profile steam @{exec_path} { owner @{user_config_dirs}/ r, owner @{user_config_dirs}/autostart/ r, + owner @{user_config_dirs}/cef_user_data/{,**} r, owner @{user_config_dirs}/unity3d/{,**} rwk, owner @{user_share_dirs}/ r, @@ -176,6 +182,7 @@ profile steam @{exec_path} { @{sys}/devices/**/input/input[0-9]*/ r, @{sys}/devices/**/uevent r, @{sys}/devices/pci[0-9]*/**/class r, + @{sys}/devices/pci[0-9]*/**/i2c-[0-9]*/report_descriptor r, @{sys}/devices/pci[0-9]*/**/sound/card[0-9]*/** r, @{sys}/devices/pci[0-9]*/**/usb[0-9]*/{manufacturer,product,bcdDevice,bInterfaceNumber} r, @{sys}/devices/system/cpu/** r, diff --git a/apparmor.d/profiles-s-z/steam-fossilize b/apparmor.d/profiles-s-z/steam-fossilize index a001c037..9e8014b5 100644 --- a/apparmor.d/profiles-s-z/steam-fossilize +++ b/apparmor.d/profiles-s-z/steam-fossilize @@ -12,7 +12,7 @@ profile steam-fossilize @{exec_path} flags=(attach_disconnected) { include include include - include + include include @{exec_path} mr, @@ -26,11 +26,8 @@ profile steam-fossilize @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/Steam/steamapps/shadercache/[0-9]*/nvidiav[0-9]*/GLCache/ rw, owner @{user_share_dirs}/Steam/steamapps/shadercache/[0-9]*/nvidiav[0-9]*/GLCache/** rwk, - owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw, - owner /dev/shm/fossilize-*-[0-9]*-[0-9]* rw, - @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node[0-9]*/cpumap r, @@ -38,6 +35,8 @@ profile steam-fossilize @{exec_path} flags=(attach_disconnected) { @{PROC}/pressure/io r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner /dev/shm/fossilize-*-[0-9]*-[0-9]* rw, + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, include if exists diff --git a/apparmor.d/profiles-s-z/steam-game b/apparmor.d/profiles-s-z/steam-game index 8b839a40..6c90a0f0 100644 --- a/apparmor.d/profiles-s-z/steam-game +++ b/apparmor.d/profiles-s-z/steam-game @@ -18,7 +18,7 @@ abi , include -@{steamruntime}=@{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier +@{runtime} = @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier @{exec_path} = @{user_share_dirs}/Steam/steamapps/common/*/** profile steam-game @{exec_path} flags=(attach_disconnected) { include @@ -84,13 +84,13 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { /{usr/,}lib/pressure-vessel/from-host/libexec/steam-runtime-tools-*/*-detect-platform rix, /{usr/,}libexec/steam-runtime-tools*/* mrix, - @{steamruntime}/pressure-vessel/bin/pressure-vessel-unruntime rix, - @{steamruntime}/pressure-vessel/bin/pressure-vessel-wrap rix, - @{steamruntime}/pressure-vessel/bin/pv-bwrap rix, - @{steamruntime}/pressure-vessel/bin/steam-runtime-launcher-interface-* rix, - @{steamruntime}/pressure-vessel/lib{,exec}/ r, - @{steamruntime}/pressure-vessel/lib{,exec}/** mrix, - @{steamruntime}/run rix, + @{runtime}/pressure-vessel/bin/pressure-vessel-unruntime rix, + @{runtime}/pressure-vessel/bin/pressure-vessel-wrap rix, + @{runtime}/pressure-vessel/bin/pv-bwrap rix, + @{runtime}/pressure-vessel/bin/steam-runtime-launcher-interface-* rix, + @{runtime}/pressure-vessel/lib{,exec}/ r, + @{runtime}/pressure-vessel/lib{,exec}/** mrix, + @{runtime}/run rix, @{user_share_dirs}/Steam/bin/ r, @{user_share_dirs}/Steam/bin/* mr, @@ -108,6 +108,7 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { @{user_share_dirs}/Steam/steamapps/compatdata/[0-9]*/pfx/**.dll rm, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/{,**} r, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/**.so* mr, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/reaper rix, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-launch-wrapper rm, @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{usr/,}lib{exec,}/** mrix, @@ -235,8 +236,9 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { /dev/hidraw[0-9]* rw, /dev/input/ r, - /dev/uinput rw, + /dev/input/* rw, /dev/tty rw, + /dev/uinput rw, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui index 07661d61..9e38f25a 100644 --- a/apparmor.d/profiles-s-z/steam-gameoverlayui +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -39,6 +39,8 @@ profile steam-gameoverlayui @{exec_path} { owner @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/fontconfig/{,**} rwl, owner @{user_share_dirs}/Steam/userdata/[0-9]*/{,**} rk, + owner /var/cache/fontconfig/ rw, + owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw, owner @{run}/user/@{uid}/gdm/Xauthority r,