mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-31 07:17:22 +01:00
feat(profile): general update.
This commit is contained in:
Alexandre Pujol
parent
9e7c4c7ec8
commit
ab7f45bc31
26 changed files with 53 additions and 111 deletions
|
|
@ -4,7 +4,7 @@
|
|||
|
||||
# Profile for session dbus, regardless of the dbus implementation used.
|
||||
# It does not specify an attachment path as it would be the same than
|
||||
# "dbus-system". It is intended to be used only via "Px ->" or via
|
||||
# "dbus-system". It is intended to be used only via "Px ->" or via
|
||||
# systemd drop-in AppArmorProfile= setting.
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -24,9 +24,7 @@ profile dbus-session flags=(attach_disconnected) {
|
|||
|
||||
unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none),
|
||||
|
||||
signal (receive) set=(term hup) peer=gdm-session-worker,
|
||||
signal (receive) set=(term hup) peer=gdm-session,
|
||||
signal (receive) set=(term hup) peer=gdm,
|
||||
signal (receive) set=(term hup) peer=gdm{,-*},
|
||||
signal (send) set=(term hup kill) peer=dbus-accessibility,
|
||||
signal (send) set=(term hup kill) peer=dconf-service,
|
||||
signal (send) set=(term hup kill) peer=xdg-*,
|
||||
|
|
|
|||
|
|
@ -153,6 +153,9 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
|
|||
@{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/temp* r,
|
||||
@{sys}/firmware/acpi/pm_profile r,
|
||||
|
||||
@{sys}/fs/cgroup/user.slice/cpu.max r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
|
||||
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
|
|
|||
|
|
@ -181,16 +181,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
@{bin}/glib-compile-schemas rPx,
|
||||
@{bin}/ibus-daemon rPx,
|
||||
@{bin}/Xwayland rPx,
|
||||
@{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx,
|
||||
@{lib}/mutter-x11-frames rPx,
|
||||
#aa:exec polkit-agent-helper
|
||||
|
||||
@{sh_path} rCx -> shell,
|
||||
@{lib}/gio-launch-desktop rCx -> open,
|
||||
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open,
|
||||
|
||||
# nm-openvpn-auth-dialog
|
||||
@{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx,
|
||||
|
||||
|
||||
@{user_share_dirs}/gnome-shell/extensions/*/** rPUx,
|
||||
/usr/share/gnome-shell/extensions/*/** rPUx,
|
||||
|
||||
|
|
@ -294,11 +292,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw,
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
|
||||
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
|
||||
owner /dev/shm/.org.chromium.Chromium.@{rand6} r,
|
||||
owner /dev/shm/wayland.mozilla.ipc.@{int} rw,
|
||||
|
||||
/tmp/.X@{int}-lock rw,
|
||||
/tmp/dbus-@{rand8} rw,
|
||||
owner @{tmp}/.org.chromium.Chromium.@{rand6} r,
|
||||
owner @{tmp}/@{rand6}.shell-extension.zip rw,
|
||||
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -33,17 +33,13 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
#aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell
|
||||
#aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
|
||||
#aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member={GetAll,ListActivatableNames}
|
||||
peer=(name=org.freedesktop.DBus, label=dbus-session),
|
||||
|
||||
dbus send bus=session path=/org/gtk/Notifications
|
||||
interface=org.gtk.Notifications
|
||||
member=AddNotification
|
||||
peer=(name=org.gtk.Notifications, label=gnome-shell),
|
||||
|
||||
dbus (send, receive) bus=session path=/org/gtk/Application/CommandLine
|
||||
interface=org.gtk.private.CommandLine
|
||||
member=Print
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/kreadconfig5
|
||||
@{exec_path} = @{bin}/kreadconfig{,5}
|
||||
profile kreadconfig @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/kde-strict>
|
||||
|
|
|
|||
|
|
@ -45,7 +45,6 @@ profile kwalletmanager @{exec_path} {
|
|||
@{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
/dev/shm/ r,
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
include if exists <local/kwalletmanager>
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ profile plasma-discover @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/kreadconfig5 rPx,
|
||||
@{bin}/kreadconfig{,5} rPx,
|
||||
|
||||
@{bin}/gpg rCx -> gpg,
|
||||
@{bin}/gpgconf rCx -> gpg,
|
||||
|
|
|
|||
|
|
@ -11,11 +11,18 @@ profile wg @{exec_path} {
|
|||
include <abstractions/base>
|
||||
|
||||
capability net_admin,
|
||||
capability net_bind_service,
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/wireguard/{,**} rw,
|
||||
|
||||
include if exists <local/wg>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
profile wg-quick @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
|
@ -21,7 +22,8 @@ profile wg-quick @{exec_path} {
|
|||
@{bin}/ip rPx,
|
||||
@{bin}/nft rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/resolvectl rPx,
|
||||
@{bin}/resolvconf rPx,
|
||||
@{bin}/resolvectl rPUx,
|
||||
@{bin}/sort rix,
|
||||
@{bin}/stat rix,
|
||||
@{bin}/sysctl rix,
|
||||
|
|
|
|||
|
|
@ -48,6 +48,8 @@ profile makepkg @{exec_path} {
|
|||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
owner @{tmp}/.git_vtag_tmp@{rand6} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
owner @{run}/user/@{uid}/gnupg/ r,
|
||||
owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw,
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/e2fsck @{bin}/fsck.ext2 @{bin}/fsck.ext3 @{bin}/fsck.ext4
|
||||
profile e2fsck @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
|
|
|
|||
|
|
@ -10,14 +10,10 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/fdisk
|
||||
profile fdisk @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
# Needed to inform the system of newly created/removed partitions
|
||||
# ioctl(3, BLKRRPART) = -1 EACCES (Permission denied)
|
||||
capability sys_admin,
|
||||
|
||||
# To remove the following errors:
|
||||
# kernel: device-mapper: core: fdisk: sending ioctl 5331 to DM device without required privilege.
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -10,14 +10,14 @@ include <tunables/global>
|
|||
profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/consoles>
|
||||
|
||||
signal (send) set=(hup int) peer=user_unconfined,
|
||||
signal (send) set=(int) peer=@{p_systemd},
|
||||
signal (send) set=(int) peer=flatpak-app,
|
||||
signal send set=(hup int) peer=user_unconfined,
|
||||
signal send set=(int) peer=@{p_systemd},
|
||||
signal send set=(int) peer=flatpak-app,
|
||||
|
||||
#aa:dbus own bus=session name=org.freedesktop.Flatpak
|
||||
|
||||
|
|
@ -27,11 +27,13 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
|
|||
@{bin}/dbus-monitor rPUx,
|
||||
@{bin}/env rix,
|
||||
@{bin}/flatpak rPx,
|
||||
@{bin}/test rix,
|
||||
@{bin}/getent rix,
|
||||
@{bin}/p11-kit rix,
|
||||
@{bin}/pkexec rPx, # TODO: too wide, rCx.
|
||||
@{bin}/printenv rix,
|
||||
@{bin}/ps rPx,
|
||||
@{bin}/test rix,
|
||||
@{bin}/touch rix,
|
||||
@{lib}/p11-kit/p11-kit-remote rix,
|
||||
@{lib}/p11-kit/p11-kit-server rix,
|
||||
/var/lib/flatpak/app/*/**/@{bin}/** rPx -> flatpak-app,
|
||||
|
|
|
|||
|
|
@ -8,17 +8,18 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fwupdmgr
|
||||
profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) {
|
||||
profile fwupdmgr @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
capability sys_nice,
|
||||
|
||||
signal (send),
|
||||
signal send,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
|
@ -30,19 +31,16 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/dbus-launch rCx -> dbus,
|
||||
@{bin}/pkttyagent rPx,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
@{bin}/dbus-launch Cx -> bus,
|
||||
@{bin}/pkttyagent Px,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
||||
owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc}.* rw,
|
||||
owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc} rw,
|
||||
/var/lib/flatpak/exports/share/mime/mime.cache r,
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
@{user_cache_dirs}/dconf/user rw,
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/fwupd/ rw,
|
||||
owner @{user_cache_dirs}/fwupd/lvfs-metadata.xml.gz{,.*} rw,
|
||||
|
||||
|
|
@ -53,14 +51,9 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) {
|
|||
/dev/i2c-@{int} rw,
|
||||
/dev/tty rw,
|
||||
|
||||
profile dbus {
|
||||
profile bus flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{bin}/dbus-launch mr,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
include <abstractions/app/bus>
|
||||
include if exists <local/fwupdmgr_dbus>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -66,9 +66,9 @@ profile git @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{bin}/man rPx,
|
||||
@{bin}/meld rPUx,
|
||||
@{lib}/code/extensions/git/dist/askpass.sh rPx,
|
||||
@{lib}/code/extensions/git/dist/git-editor.sh rPx,
|
||||
/usr/share/aurpublish/*.hook rPx,
|
||||
@{lib}/code/extensions/git/dist/askpass.sh rPx,
|
||||
@{lib}/code/extensions/git/dist/git-editor.sh rPx,
|
||||
/usr/share/aurpublish/*.hook rPx,
|
||||
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
@{bin}/ssh rCx -> ssh,
|
||||
|
|
@ -98,6 +98,7 @@ profile git @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
deny owner @{code_config_dirs}/** rw,
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/* r,
|
||||
deny owner @{user_share_dirs}/vulkan/** r,
|
||||
deny owner @{user_share_dirs}/zed/**/data.mdb rw,
|
||||
deny /usr/share/nvidia/nvidia-application-profiles-* r,
|
||||
deny /dev/shm/.org.chromium.Chromium.@{rand6} rw,
|
||||
|
|
|
|||
|
|
@ -37,8 +37,7 @@ profile hypnotix @{exec_path} {
|
|||
@{bin}/ldconfig rix,
|
||||
@{bin}/mkdir rix,
|
||||
|
||||
@{bin}/xdg-screensaver rCx -> xdg-screensaver,
|
||||
|
||||
@{bin}/xdg-screensaver rPx,
|
||||
@{bin}/youtube-dl rPUx,
|
||||
@{bin}/yt-dlp rPUx,
|
||||
@{lib}/firefox/firefox rPx,
|
||||
|
|
@ -63,29 +62,6 @@ profile hypnotix @{exec_path} {
|
|||
# Silencer
|
||||
deny @{lib}/hypnotix/** w,
|
||||
|
||||
profile xdg-screensaver {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{bin}/xdg-screensaver mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/mv rix,
|
||||
@{bin}/{,e}grep rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/which{,.debianutils} rix,
|
||||
@{bin}/xset rix,
|
||||
@{bin}/xautolock rix,
|
||||
@{bin}/dbus-send rix,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
}
|
||||
|
||||
include if exists <local/hypnotix>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -27,7 +27,6 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{sh_path} r,
|
||||
@{bin}/grep rix,
|
||||
@{lib_dirs}/chrome_crashpad_handler ix,
|
||||
@{lib_dirs}/resources/app/{,**} m,
|
||||
|
|
|
|||
|
|
@ -32,8 +32,7 @@ profile mpv @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/xdg-screensaver rCx -> xdg-screensaver,
|
||||
|
||||
@{bin}/xdg-screensaver Px,
|
||||
@{bin}/youtube-dl rPx,
|
||||
@{bin}/yt-dlp rPx,
|
||||
|
||||
|
|
@ -81,30 +80,6 @@ profile mpv @{exec_path} {
|
|||
/dev/input/event@{int} r,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile xdg-screensaver {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{bin}/xdg-screensaver mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/mv rix,
|
||||
@{bin}/{,e}grep rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/which{,.debianutils} rix,
|
||||
@{bin}/xset rix,
|
||||
@{bin}/xautolock rix,
|
||||
@{bin}/dbus-send rix,
|
||||
@{bin}/xscreensaver-command rix,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
}
|
||||
|
||||
include if exists <local/mpv>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/partprobe
|
||||
profile partprobe @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/resize2fs
|
||||
profile resize2fs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
|
|
|
|||
|
|
@ -37,8 +37,6 @@ profile YACReader @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{user_share_dirs}/YACReader/YACReader/ rw,
|
||||
owner @{user_share_dirs}/YACReader/YACReader/** rwlk,
|
||||
|
||||
/dev/shm/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,15 +10,9 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/sfdisk
|
||||
profile sfdisk @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
# Needed to avoid the following error:
|
||||
# ioctl(3, BLKRRPART) = -1 EACCES (Permission denied)
|
||||
#
|
||||
# Checking that no-one is using this disk right now ... FAILED
|
||||
# This disk is currently in use - repartitioning is probably a bad idea.
|
||||
# Umount all file systems, and swapoff all swap partitions on this disk.
|
||||
# Use the --no-reread flag to suppress this check.
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -327,7 +327,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**,
|
||||
owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw,
|
||||
|
||||
/dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6} rw,
|
||||
|
|
|
|||
|
|
@ -42,7 +42,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) {
|
|||
@{app_dirs}/@{runtime}/pressure-vessel/@{bin}/pressure-vessel-* rix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/** mr,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-capsule-capture-libs rix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-platform rix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-* rix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-inspect-library rix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rpx -> steam-game-proton,
|
||||
@{app_dirs}/@{runtime}/run rix,
|
||||
|
|
|
|||
|
|
@ -158,8 +158,7 @@ profile thunderbird @{exec_path} {
|
|||
owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1
|
||||
|
||||
/dev/shm/ r,
|
||||
owner /dev/shm/org.chromium.* rw,
|
||||
owner /dev/shm/org.chromium.@{rand6} rw,
|
||||
owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw,
|
||||
owner /dev/shm/wayland.mozilla.ipc.@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -119,6 +119,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
|
|||
@{sys}/bus/ r,
|
||||
@{sys}/bus/pci/slots/ r,
|
||||
@{sys}/bus/pci/slots/@{int}/address r,
|
||||
@{sys}/bus/scsi/devices/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/nvme-subsystem/ r,
|
||||
@{sys}/class/nvme/ r,
|
||||
|
|
|
|||
Loading…
Reference in a new issue