From ab7f45bc3126f6d6a472e4eea79a356de46806ad Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:26:47 +0100 Subject: [PATCH] feat(profile): general update. --- apparmor.d/groups/bus/dbus-session | 6 ++--- apparmor.d/groups/gnome/gnome-control-center | 3 +++ apparmor.d/groups/gnome/gnome-shell | 9 +++---- apparmor.d/groups/gnome/nautilus | 6 +---- apparmor.d/groups/kde/kreadconfig | 2 +- apparmor.d/groups/kde/kwalletmanager | 1 - apparmor.d/groups/kde/plasma-discover | 2 +- apparmor.d/groups/network/wg | 7 +++++ apparmor.d/groups/network/wg-quick | 4 ++- apparmor.d/groups/pacman/makepkg | 2 ++ apparmor.d/profiles-a-f/e2fsck | 1 + apparmor.d/profiles-a-f/fdisk | 6 +---- .../profiles-a-f/flatpak-session-helper | 12 +++++---- apparmor.d/profiles-a-f/fwupdmgr | 23 ++++++---------- apparmor.d/profiles-g-l/git | 7 ++--- apparmor.d/profiles-g-l/hypnotix | 26 +----------------- apparmor.d/profiles-g-l/linuxqq | 1 - apparmor.d/profiles-m-r/mpv | 27 +------------------ apparmor.d/profiles-m-r/partprobe | 1 + apparmor.d/profiles-m-r/resize2fs | 1 + apparmor.d/profiles-s-z/YACReader | 2 -- apparmor.d/profiles-s-z/sfdisk | 8 +----- apparmor.d/profiles-s-z/steam | 1 - apparmor.d/profiles-s-z/steam-runtime | 2 +- apparmor.d/profiles-s-z/thunderbird | 3 +-- apparmor.d/profiles-s-z/udisksd | 1 + 26 files changed, 53 insertions(+), 111 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index b06eaa51..fa630505 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -4,7 +4,7 @@ # Profile for session dbus, regardless of the dbus implementation used. # It does not specify an attachment path as it would be the same than -# "dbus-system". It is intended to be used only via "Px ->" or via +# "dbus-system". It is intended to be used only via "Px ->" or via # systemd drop-in AppArmorProfile= setting. abi , @@ -24,9 +24,7 @@ profile dbus-session flags=(attach_disconnected) { unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none), - signal (receive) set=(term hup) peer=gdm-session-worker, - signal (receive) set=(term hup) peer=gdm-session, - signal (receive) set=(term hup) peer=gdm, + signal (receive) set=(term hup) peer=gdm{,-*}, signal (send) set=(term hup kill) peer=dbus-accessibility, signal (send) set=(term hup kill) peer=dconf-service, signal (send) set=(term hup kill) peer=xdg-*, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 7643844c..1f3bb42d 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -153,6 +153,9 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/temp* r, @{sys}/firmware/acpi/pm_profile r, + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw, @{PROC}/cmdline r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index b6420b34..d4ce1c50 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -181,16 +181,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/glib-compile-schemas rPx, @{bin}/ibus-daemon rPx, @{bin}/Xwayland rPx, + @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @{lib}/mutter-x11-frames rPx, #aa:exec polkit-agent-helper @{sh_path} rCx -> shell, @{lib}/gio-launch-desktop rCx -> open, @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, - - # nm-openvpn-auth-dialog - @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, - + @{user_share_dirs}/gnome-shell/extensions/*/** rPUx, /usr/share/gnome-shell/extensions/*/** rPUx, @@ -294,11 +292,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw, owner @{run}/user/@{uid}/systemd/notify rw, - owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + owner /dev/shm/.org.chromium.Chromium.@{rand6} r, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, /tmp/.X@{int}-lock rw, /tmp/dbus-@{rand8} rw, + owner @{tmp}/.org.chromium.Chromium.@{rand6} r, owner @{tmp}/@{rand6}.shell-extension.zip rw, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 66f9af69..f00b8d10 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -33,17 +33,13 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + #aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus.Properties member={GetAll,ListActivatableNames} peer=(name=org.freedesktop.DBus, label=dbus-session), - dbus send bus=session path=/org/gtk/Notifications - interface=org.gtk.Notifications - member=AddNotification - peer=(name=org.gtk.Notifications, label=gnome-shell), - dbus (send, receive) bus=session path=/org/gtk/Application/CommandLine interface=org.gtk.private.CommandLine member=Print diff --git a/apparmor.d/groups/kde/kreadconfig b/apparmor.d/groups/kde/kreadconfig index 33cf23a9..4dbe69f9 100644 --- a/apparmor.d/groups/kde/kreadconfig +++ b/apparmor.d/groups/kde/kreadconfig @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/kreadconfig5 +@{exec_path} = @{bin}/kreadconfig{,5} profile kreadconfig @{exec_path} { include include diff --git a/apparmor.d/groups/kde/kwalletmanager b/apparmor.d/groups/kde/kwalletmanager index b1ca562c..e26d09f1 100644 --- a/apparmor.d/groups/kde/kwalletmanager +++ b/apparmor.d/groups/kde/kwalletmanager @@ -45,7 +45,6 @@ profile kwalletmanager @{exec_path} { @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/cmdline r, - /dev/shm/ r, /dev/shm/#@{int} rw, include if exists diff --git a/apparmor.d/groups/kde/plasma-discover b/apparmor.d/groups/kde/plasma-discover index 54211045..d35e8dcd 100644 --- a/apparmor.d/groups/kde/plasma-discover +++ b/apparmor.d/groups/kde/plasma-discover @@ -29,7 +29,7 @@ profile plasma-discover @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/kreadconfig5 rPx, + @{bin}/kreadconfig{,5} rPx, @{bin}/gpg rCx -> gpg, @{bin}/gpgconf rCx -> gpg, diff --git a/apparmor.d/groups/network/wg b/apparmor.d/groups/network/wg index 783fa41f..2ddaee94 100644 --- a/apparmor.d/groups/network/wg +++ b/apparmor.d/groups/network/wg @@ -11,11 +11,18 @@ profile wg @{exec_path} { include capability net_admin, + capability net_bind_service, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, network netlink raw, @{exec_path} mr, + /etc/wireguard/{,**} rw, + include if exists } diff --git a/apparmor.d/groups/network/wg-quick b/apparmor.d/groups/network/wg-quick index 1183a4a5..89d89162 100644 --- a/apparmor.d/groups/network/wg-quick +++ b/apparmor.d/groups/network/wg-quick @@ -10,6 +10,7 @@ include profile wg-quick @{exec_path} { include + capability dac_read_search, capability net_admin, network netlink raw, @@ -21,7 +22,8 @@ profile wg-quick @{exec_path} { @{bin}/ip rPx, @{bin}/nft rix, @{bin}/readlink rix, - @{bin}/resolvectl rPx, + @{bin}/resolvconf rPx, + @{bin}/resolvectl rPUx, @{bin}/sort rix, @{bin}/stat rix, @{bin}/sysctl rix, diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 311135ea..5ac44681 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -48,6 +48,8 @@ profile makepkg @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + owner @{tmp}/.git_vtag_tmp@{rand6} rw, + owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/gnupg/ r, owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, diff --git a/apparmor.d/profiles-a-f/e2fsck b/apparmor.d/profiles-a-f/e2fsck index 8ce1ed3c..a02c8735 100644 --- a/apparmor.d/profiles-a-f/e2fsck +++ b/apparmor.d/profiles-a-f/e2fsck @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/e2fsck @{bin}/fsck.ext2 @{bin}/fsck.ext3 @{bin}/fsck.ext4 profile e2fsck @{exec_path} { include + include include include diff --git a/apparmor.d/profiles-a-f/fdisk b/apparmor.d/profiles-a-f/fdisk index 815e3bc7..8e6ea58f 100644 --- a/apparmor.d/profiles-a-f/fdisk +++ b/apparmor.d/profiles-a-f/fdisk @@ -10,14 +10,10 @@ include @{exec_path} = @{bin}/fdisk profile fdisk @{exec_path} { include + include include - # Needed to inform the system of newly created/removed partitions - # ioctl(3, BLKRRPART) = -1 EACCES (Permission denied) capability sys_admin, - - # To remove the following errors: - # kernel: device-mapper: core: fdisk: sending ioctl 5331 to DM device without required privilege. capability sys_rawio, @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/flatpak-session-helper b/apparmor.d/profiles-a-f/flatpak-session-helper index d27d0c24..54b95b8e 100644 --- a/apparmor.d/profiles-a-f/flatpak-session-helper +++ b/apparmor.d/profiles-a-f/flatpak-session-helper @@ -10,14 +10,14 @@ include profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { include include + include include include include - include - signal (send) set=(hup int) peer=user_unconfined, - signal (send) set=(int) peer=@{p_systemd}, - signal (send) set=(int) peer=flatpak-app, + signal send set=(hup int) peer=user_unconfined, + signal send set=(int) peer=@{p_systemd}, + signal send set=(int) peer=flatpak-app, #aa:dbus own bus=session name=org.freedesktop.Flatpak @@ -27,11 +27,13 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { @{bin}/dbus-monitor rPUx, @{bin}/env rix, @{bin}/flatpak rPx, - @{bin}/test rix, @{bin}/getent rix, @{bin}/p11-kit rix, @{bin}/pkexec rPx, # TODO: too wide, rCx. + @{bin}/printenv rix, @{bin}/ps rPx, + @{bin}/test rix, + @{bin}/touch rix, @{lib}/p11-kit/p11-kit-remote rix, @{lib}/p11-kit/p11-kit-server rix, /var/lib/flatpak/app/*/**/@{bin}/** rPx -> flatpak-app, diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 6064c0ff..8f6885b4 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -8,17 +8,18 @@ abi , include @{exec_path} = @{bin}/fwupdmgr -profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) { +profile fwupdmgr @{exec_path} flags=(attach_disconnected) { include include include include + include include include capability sys_nice, - signal (send), + signal send, network inet stream, network inet6 stream, @@ -30,19 +31,16 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) { @{exec_path} mr, - @{bin}/dbus-launch rCx -> dbus, - @{bin}/pkttyagent rPx, - - /usr/share/glib-2.0/schemas/gschemas.compiled r, + @{bin}/dbus-launch Cx -> bus, + @{bin}/pkttyagent Px, /etc/machine-id r, owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc}.* rw, owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc} rw, - /var/lib/flatpak/exports/share/mime/mime.cache r, - owner @{user_cache_dirs}/ rw, @{user_cache_dirs}/dconf/user rw, + owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/fwupd/ rw, owner @{user_cache_dirs}/fwupd/lvfs-metadata.xml.gz{,.*} rw, @@ -53,14 +51,9 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) { /dev/i2c-@{int} rw, /dev/tty rw, - profile dbus { + profile bus flags=(attach_disconnected) { include - include - - @{bin}/dbus-launch mr, - - owner @{HOME}/.Xauthority r, - + include include if exists } diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 30ce7e1e..032da712 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -66,9 +66,9 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/man rPx, @{bin}/meld rPUx, - @{lib}/code/extensions/git/dist/askpass.sh rPx, - @{lib}/code/extensions/git/dist/git-editor.sh rPx, - /usr/share/aurpublish/*.hook rPx, + @{lib}/code/extensions/git/dist/askpass.sh rPx, + @{lib}/code/extensions/git/dist/git-editor.sh rPx, + /usr/share/aurpublish/*.hook rPx, @{bin}/gpg{,2} rCx -> gpg, @{bin}/ssh rCx -> ssh, @@ -98,6 +98,7 @@ profile git @{exec_path} flags=(attach_disconnected) { deny owner @{code_config_dirs}/** rw, deny owner @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_share_dirs}/vulkan/** r, deny owner @{user_share_dirs}/zed/**/data.mdb rw, deny /usr/share/nvidia/nvidia-application-profiles-* r, deny /dev/shm/.org.chromium.Chromium.@{rand6} rw, diff --git a/apparmor.d/profiles-g-l/hypnotix b/apparmor.d/profiles-g-l/hypnotix index 3a9a6131..0a54528b 100644 --- a/apparmor.d/profiles-g-l/hypnotix +++ b/apparmor.d/profiles-g-l/hypnotix @@ -37,8 +37,7 @@ profile hypnotix @{exec_path} { @{bin}/ldconfig rix, @{bin}/mkdir rix, - @{bin}/xdg-screensaver rCx -> xdg-screensaver, - + @{bin}/xdg-screensaver rPx, @{bin}/youtube-dl rPUx, @{bin}/yt-dlp rPUx, @{lib}/firefox/firefox rPx, @@ -63,29 +62,6 @@ profile hypnotix @{exec_path} { # Silencer deny @{lib}/hypnotix/** w, - profile xdg-screensaver { - include - include - - @{bin}/xdg-screensaver mr, - - @{sh_path} rix, - @{bin}/mv rix, - @{bin}/{,e}grep rix, - @{bin}/sed rix, - @{bin}/which{,.debianutils} rix, - @{bin}/xset rix, - @{bin}/xautolock rix, - @{bin}/dbus-send rix, - - owner @{HOME}/.Xauthority r, - - # file_inherit - /dev/dri/card@{int} rw, - network inet stream, - network inet6 stream, - } - include if exists } diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 6961d8cc..dcccd68c 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -27,7 +27,6 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{sh_path} r, @{bin}/grep rix, @{lib_dirs}/chrome_crashpad_handler ix, @{lib_dirs}/resources/app/{,**} m, diff --git a/apparmor.d/profiles-m-r/mpv b/apparmor.d/profiles-m-r/mpv index 88a5078a..da5e4715 100644 --- a/apparmor.d/profiles-m-r/mpv +++ b/apparmor.d/profiles-m-r/mpv @@ -32,8 +32,7 @@ profile mpv @{exec_path} { @{exec_path} mr, - @{bin}/xdg-screensaver rCx -> xdg-screensaver, - + @{bin}/xdg-screensaver Px, @{bin}/youtube-dl rPx, @{bin}/yt-dlp rPx, @@ -81,30 +80,6 @@ profile mpv @{exec_path} { /dev/input/event@{int} r, owner /dev/tty@{int} rw, - profile xdg-screensaver { - include - include - - @{bin}/xdg-screensaver mr, - - @{sh_path} rix, - @{bin}/mv rix, - @{bin}/{,e}grep rix, - @{bin}/sed rix, - @{bin}/which{,.debianutils} rix, - @{bin}/xset rix, - @{bin}/xautolock rix, - @{bin}/dbus-send rix, - @{bin}/xscreensaver-command rix, - - owner @{HOME}/.Xauthority r, - - # file_inherit - /dev/dri/card@{int} rw, - network inet stream, - network inet6 stream, - } - include if exists } diff --git a/apparmor.d/profiles-m-r/partprobe b/apparmor.d/profiles-m-r/partprobe index 9e384c66..0d0d8238 100644 --- a/apparmor.d/profiles-m-r/partprobe +++ b/apparmor.d/profiles-m-r/partprobe @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/partprobe profile partprobe @{exec_path} { include + include include capability sys_admin, diff --git a/apparmor.d/profiles-m-r/resize2fs b/apparmor.d/profiles-m-r/resize2fs index 11484681..698ec99f 100644 --- a/apparmor.d/profiles-m-r/resize2fs +++ b/apparmor.d/profiles-m-r/resize2fs @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/resize2fs profile resize2fs @{exec_path} { include + include include include diff --git a/apparmor.d/profiles-s-z/YACReader b/apparmor.d/profiles-s-z/YACReader index ccbbb249..3038df49 100644 --- a/apparmor.d/profiles-s-z/YACReader +++ b/apparmor.d/profiles-s-z/YACReader @@ -37,8 +37,6 @@ profile YACReader @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/YACReader/YACReader/ rw, owner @{user_share_dirs}/YACReader/YACReader/** rwlk, - /dev/shm/ r, - owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/sfdisk b/apparmor.d/profiles-s-z/sfdisk index 5b75a27e..c82aff77 100644 --- a/apparmor.d/profiles-s-z/sfdisk +++ b/apparmor.d/profiles-s-z/sfdisk @@ -10,15 +10,9 @@ include @{exec_path} = @{bin}/sfdisk profile sfdisk @{exec_path} { include + include include - # Needed to avoid the following error: - # ioctl(3, BLKRRPART) = -1 EACCES (Permission denied) - # - # Checking that no-one is using this disk right now ... FAILED - # This disk is currently in use - repartitioning is probably a bad idea. - # Umount all file systems, and swapoff all swap partitions on this disk. - # Use the --no-reread flag to suppress this check. capability sys_admin, @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 0828786d..447ef9f1 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -327,7 +327,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, - /dev/shm/ r, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw, diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index add024de..e0c6b146 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -42,7 +42,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { @{app_dirs}/@{runtime}/pressure-vessel/@{bin}/pressure-vessel-* rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/** mr, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-capsule-capture-libs rix, - @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-platform rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-* rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-inspect-library rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rpx -> steam-game-proton, @{app_dirs}/@{runtime}/run rix, diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index d6553d99..3d580afe 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -158,8 +158,7 @@ profile thunderbird @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/stat r, owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1 - /dev/shm/ r, - owner /dev/shm/org.chromium.* rw, + owner /dev/shm/org.chromium.@{rand6} rw, owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 76be9768..6f74c826 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -119,6 +119,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{sys}/bus/ r, @{sys}/bus/pci/slots/ r, @{sys}/bus/pci/slots/@{int}/address r, + @{sys}/bus/scsi/devices/ r, @{sys}/class/ r, @{sys}/class/nvme-subsystem/ r, @{sys}/class/nvme/ r,