From a99fbaa0beebe9b16e708de312034335ee73e6cb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 19:47:25 +0100 Subject: [PATCH] feat(profile): restic some well known path. --- apparmor.d/abstractions/common/chromium | 8 ++++---- apparmor.d/abstractions/common/electron | 2 +- apparmor.d/groups/apt/apt-cdrom | 12 ++++++------ apparmor.d/groups/freedesktop/cpupower | 2 +- apparmor.d/groups/freedesktop/xorg | 2 +- apparmor.d/groups/freedesktop/xrdb | 2 +- apparmor.d/groups/network/mullvad-gui | 2 +- apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/profiles-g-l/gtk-youtube-viewer | 2 +- 9 files changed, 17 insertions(+), 17 deletions(-) diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index 2e98c515..28effd76 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -26,10 +26,10 @@ /var/tmp/ r, owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6}/{,**} rw, - owner @{tmp}/scoped_dir*/ rw, - owner @{tmp}/scoped_dir*/SingletonCookie w, - owner @{tmp}/scoped_dir*/SingletonSocket w, - owner @{tmp}/scoped_dir*/SS w, + owner @{tmp}/scoped_dir@{rand6}/ rw, + owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w, + owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w, + owner @{tmp}/scoped_dir@{rand6}/SS w, /dev/shm/ r, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 732129c2..5de09824 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -50,7 +50,7 @@ owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, - owner @{user_share_dirs}/.org.chromium.Chromium.* rw, + owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw, diff --git a/apparmor.d/groups/apt/apt-cdrom b/apparmor.d/groups/apt/apt-cdrom index a2268648..dc3f9c21 100644 --- a/apparmor.d/groups/apt/apt-cdrom +++ b/apparmor.d/groups/apt/apt-cdrom @@ -33,11 +33,11 @@ profile apt-cdrom @{exec_path} flags=(complain) { # @{run}/udev/data/* r, # For cd-roms - /media/cdrom[0-9]/ r, - /media/cdrom[0-9]/**/ r, - /media/cdrom[0-9]/.disk/info r, - /media/cdrom[0-9]/dists/**/binary-*/Packages{,.gz} r, - /media/cdrom[0-9]/dists/**/i18n/Translation-en{,.gz} r, + /media/cdrom@{int}/ r, + /media/cdrom@{int}/**/ r, + /media/cdrom@{int}/.disk/info r, + /media/cdrom@{int}/dists/**/binary-*/Packages{,.gz} r, + /media/cdrom@{int}/dists/**/i18n/Translation-en{,.gz} r, # For pendrives @{MOUNTS}/ r, @@ -63,7 +63,7 @@ profile apt-cdrom @{exec_path} flags=(complain) { /etc/fstab r, - /media/cdrom[0-9]/ r, + /media/cdrom@{int}/ r, include if exists } diff --git a/apparmor.d/groups/freedesktop/cpupower b/apparmor.d/groups/freedesktop/cpupower index 0b1d0ead..58d4f0e8 100644 --- a/apparmor.d/groups/freedesktop/cpupower +++ b/apparmor.d/groups/freedesktop/cpupower @@ -32,7 +32,7 @@ profile cpupower @{exec_path} { @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{min,max}_freq rw, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_setspeed rw, - @{sys}/devices/system/cpu/cpu@{int}/cpuidle/state[0-9]/disable rw, + @{sys}/devices/system/cpu/cpu@{int}/cpuidle/state@{int}/disable rw, @{sys}/devices/system/cpu/cpu@{int}/topology/{physical_package_id,core_id} r, diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 378c8111..878b8500 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -125,7 +125,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{PROC}/ioports r, @{PROC}/mtrr rw, - /dev/fb[0-9] rw, + /dev/fb@{int} rw, /dev/input/event@{int} rw, /dev/shm/#@{int} rw, /dev/shm/shmfd-* rw, diff --git a/apparmor.d/groups/freedesktop/xrdb b/apparmor.d/groups/freedesktop/xrdb index 9bd897be..638f6ebe 100644 --- a/apparmor.d/groups/freedesktop/xrdb +++ b/apparmor.d/groups/freedesktop/xrdb @@ -19,7 +19,7 @@ profile xrdb @{exec_path} { @{bin}/{,*-}cpp-[0-9]* rix, @{sh_path} rix, @{bin}/cpp rix, - @{lib}/gcc/@{multiarch}/@{int}*/cc1 rix, + @{lib}/gcc/@{multiarch}/@{version}/cc1 rix, @{lib}/llvm-[0-9]*/bin/clang rix, /usr/include/stdc-predef.h r, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index 48534d67..91cfaab0 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -6,7 +6,7 @@ abi , include -@{name} = Mullvad*VPN +@{name} = Mullvad?VPN @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 6ab0802b..c1bd7fa3 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -123,7 +123,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r, owner /var/lib/pacman/{,**} rwl, - owner @{tmp}/alpm_*/{,**} rw, + owner @{tmp}/alpm_@{rand6}/{,**} rw, owner @{tmp}/checkup-db-@{int}/sync/{,*.db*} rw, owner @{tmp}/checkup-db-@{int}/db.lck rw, diff --git a/apparmor.d/profiles-g-l/gtk-youtube-viewer b/apparmor.d/profiles-g-l/gtk-youtube-viewer index 9d2bc322..5f2e4fde 100644 --- a/apparmor.d/profiles-g-l/gtk-youtube-viewer +++ b/apparmor.d/profiles-g-l/gtk-youtube-viewer @@ -98,7 +98,7 @@ profile gtk-youtube-viewer @{exec_path} { include @{bin}/xdg-open mr, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr, @{sh_path} rix, @{bin}/{m,g,}awk rix,