From b263321c73c7da2dfbd7ff4bd9de66bdd961048d Mon Sep 17 00:00:00 2001 From: nobodysu Date: Mon, 23 May 2022 01:44:25 +0300 Subject: [PATCH] Ubuntu compatibility --- apparmor.d/abstractions/nvidia.d/complete | 4 + .../ubuntu-unity7-base.d/complete | 12 +++ apparmor.d/abstractions/vulkan.d/complete | 4 + apparmor.d/groups/apps/thunderbird | 78 ++++++++++++++----- 4 files changed, 78 insertions(+), 20 deletions(-) create mode 100644 apparmor.d/abstractions/ubuntu-unity7-base.d/complete create mode 100644 apparmor.d/abstractions/vulkan.d/complete diff --git a/apparmor.d/abstractions/nvidia.d/complete b/apparmor.d/abstractions/nvidia.d/complete index aef83c51..5e85583f 100644 --- a/apparmor.d/abstractions/nvidia.d/complete +++ b/apparmor.d/abstractions/nvidia.d/complete @@ -5,3 +5,7 @@ owner @{user_cache_dirs}/nvidia/ w, owner @{user_cache_dirs}/nvidia/GLCache/ rw, owner @{user_cache_dirs}/nvidia/GLCache/** rwk, + + @{run}/nvidia-xdriver-* w, + + unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"), diff --git a/apparmor.d/abstractions/ubuntu-unity7-base.d/complete b/apparmor.d/abstractions/ubuntu-unity7-base.d/complete new file mode 100644 index 00000000..1776315e --- /dev/null +++ b/apparmor.d/abstractions/ubuntu-unity7-base.d/complete @@ -0,0 +1,12 @@ + + dbus send + bus=session + path=/org/gtk/vfs/mounttracker + interface=org.gtk.vfs.MountTracker + member=ListMountableInfo, + + dbus send + bus=session + path=/org/gtk/vfs/Daemon + interface=org.gtk.vfs.Daemon + member=ListMonitorImplementations, diff --git a/apparmor.d/abstractions/vulkan.d/complete b/apparmor.d/abstractions/vulkan.d/complete new file mode 100644 index 00000000..c84abb59 --- /dev/null +++ b/apparmor.d/abstractions/vulkan.d/complete @@ -0,0 +1,4 @@ +# apparmor.d - Full set of apparmor profiles +# SPDX-License-Identifier: GPL-2.0-only + + /usr/share/egl/egl_external_platform.d/{,*} r, diff --git a/apparmor.d/groups/apps/thunderbird b/apparmor.d/groups/apps/thunderbird index 93e4ec2f..ee483221 100644 --- a/apparmor.d/groups/apps/thunderbird +++ b/apparmor.d/groups/apps/thunderbird @@ -3,7 +3,6 @@ # SPDX-License-Identifier: GPL-2.0-only # Useful info: # http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird -# abi , @@ -19,6 +18,9 @@ profile thunderbird @{exec_path} { include include include + include + include + include include include include @@ -27,9 +29,14 @@ profile thunderbird @{exec_path} { include include include - include include include + include + include + include + include + include + include if exists ptrace peer=@{profile_name}, @@ -91,10 +98,6 @@ profile thunderbird @{exec_path} { owner @{HOME}/Mail/ rw, owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**, - include - owner @{run}/user/@{uid}/dconf/ rw, - owner @{run}/user/@{uid}/dconf/user rw, - # Fix error in libglib while saving files as /usr/share/glib-2.0/schemas/gschemas.compiled r, @@ -115,6 +118,10 @@ profile thunderbird @{exec_path} { owner @{user_config_dirs}/qt5ct/{,**} r, /usr/share/qt5ct/** r, + # gnome-tiny + /etc/gnome/defaults.list r, + @{run}/mount/utab r, + deny @{sys}/devices/system/cpu/present r, deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r, deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r, @@ -124,6 +131,7 @@ profile thunderbird @{exec_path} { owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/smaps r, + owner @{PROC}/@{pids}/comm r, deny owner @{PROC}/@{pids}/cmdline r, deny owner @{PROC}/@{pids}/environ r, owner @{PROC}/@{pid}/task/ r, @@ -138,9 +146,6 @@ profile thunderbird @{exec_path} { # for dig owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /var/lib/dbus/machine-id r, - /etc/machine-id r, - # TMP files /var/tmp/ r, /tmp/ r, @@ -151,7 +156,7 @@ profile thunderbird @{exec_path} { owner /tmp/mozilla_*/* rw, owner /tmp/MozillaMailnews/ rw, owner /tmp/MozillaMailnews/*.msf rw, - owner /tmp/Temp-@{uuid}/ rw, + owner /tmp/Temp-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*/ rw, deny /dev/ r, /dev/urandom w, @@ -181,15 +186,46 @@ profile thunderbird @{exec_path} { /{usr/,}bin/gpgsm rCx -> gpg, # Allowed apps to open - /{usr/,}lib/firefox/firefox rPUx, - /{usr/,}bin/qpdfview rPUx, + /{usr/,}lib/firefox/firefox rPx, + /{usr/,}bin/qpdfview rPx, /{usr/,}bin/viewnior rPUx, - /{usr/,}bin/engrampa rPUx, - /{usr/,}bin/geany rPUx, + /{usr/,}bin/engrampa rPx, + /{usr/,}bin/geany rPx, # file_inherit owner /dev/tty[0-9]* rw, + owner @{HOME}/.xsession-errors w, + # DBus + dbus send + bus=system + path=/org/freedesktop/RealtimeKit[0-9] + member={Get,MakeThreadHighPriority,MakeThreadRealtime} + peer=(name=org.freedesktop.RealtimeKit[0-9]), + + dbus send + bus=session + path=/ca/desrt/dconf/Writer/user + interface=ca.desrt.dconf.Writer + member={Change,Notify} + peer=(name=ca.desrt.dconf), + + dbus send + bus=system + path=/org/freedesktop/UPower + interface=org.freedesktop.UPower + member=EnumerateDevices + peer=(name=org.freedesktop.UPower), + + # dconf write + owner @{HOME}/.config/dconf/ rw, + owner @{HOME}/.config/dconf/user rw, + owner @{run}/user/@{uids}/dconf/user rw, + + owner @{run}/user/@{uid}/ICEauthority r, + + @{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r, + @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, profile gpg { include @@ -203,7 +239,7 @@ profile thunderbird @{exec_path} { /{usr/,}bin/gpg mr, /{usr/,}bin/gpg-connect-agent mr, /{usr/,}bin/gpgsm mr, - /{usr/,}bin/gpg-agent rix, + /{usr/,}bin/gpg-agent rix, owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, @@ -238,6 +274,7 @@ profile thunderbird @{exec_path} { deny owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw, owner /tmp/ns* rw, + include if exists } profile open { @@ -249,7 +286,7 @@ profile thunderbird @{exec_path} { /{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, /{usr/,}bin/{,ba,da}sh rix, - /{usr/,}bin/gawk rix, + /{usr/,}bin/{,m,g}awk rix, /{usr/,}bin/readlink rix, /{usr/,}bin/basename rix, @@ -258,15 +295,16 @@ profile thunderbird @{exec_path} { owner @{run}/user/@{uid}/ r, # Allowed apps to open - /{usr/,}lib/firefox/firefox rPUx, - /{usr/,}bin/qpdfview rPUx, + /{usr/,}lib/firefox/firefox rPx, + /{usr/,}bin/qpdfview rPx, /{usr/,}bin/viewnior rPUx, - /{usr/,}bin/engrampa rPUx, - /{usr/,}bin/geany rPUx, + /{usr/,}bin/engrampa rPx, + /{usr/,}bin/geany rPx, # file_inherit owner @{HOME}/.xsession-errors w, + include if exists } include if exists