mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-15 16:03:51 +01:00
Ubuntu compatibility
This commit is contained in:
nobodysu
parent
99106a2231
commit
b263321c73
@ -5,3 +5,7 @@
|
||||
owner @{user_cache_dirs}/nvidia/ w,
|
||||
owner @{user_cache_dirs}/nvidia/GLCache/ rw,
|
||||
owner @{user_cache_dirs}/nvidia/GLCache/** rwk,
|
||||
|
||||
@{run}/nvidia-xdriver-* w,
|
||||
|
||||
unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"),
|
||||
|
||||
12
apparmor.d/abstractions/ubuntu-unity7-base.d/complete
Normal file
12
apparmor.d/abstractions/ubuntu-unity7-base.d/complete
Normal file
@ -0,0 +1,12 @@
|
||||
|
||||
dbus send
|
||||
bus=session
|
||||
path=/org/gtk/vfs/mounttracker
|
||||
interface=org.gtk.vfs.MountTracker
|
||||
member=ListMountableInfo,
|
||||
|
||||
dbus send
|
||||
bus=session
|
||||
path=/org/gtk/vfs/Daemon
|
||||
interface=org.gtk.vfs.Daemon
|
||||
member=ListMonitorImplementations,
|
||||
4
apparmor.d/abstractions/vulkan.d/complete
Normal file
4
apparmor.d/abstractions/vulkan.d/complete
Normal file
@ -0,0 +1,4 @@
|
||||
# apparmor.d - Full set of apparmor profiles
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
/usr/share/egl/egl_external_platform.d/{,*} r,
|
||||
@ -3,7 +3,6 @@
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
# Useful info:
|
||||
# http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird
|
||||
#
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
@ -19,6 +18,9 @@ profile thunderbird @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/nvidia>
|
||||
include <abstractions/vulkan>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
@ -27,9 +29,14 @@ profile thunderbird @{exec_path} {
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/ibus>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include if exists <abstractions/ubuntu-unity7-base>
|
||||
|
||||
ptrace peer=@{profile_name},
|
||||
|
||||
@ -91,10 +98,6 @@ profile thunderbird @{exec_path} {
|
||||
owner @{HOME}/Mail/ rw,
|
||||
owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
# Fix error in libglib while saving files as
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
@ -115,6 +118,10 @@ profile thunderbird @{exec_path} {
|
||||
owner @{user_config_dirs}/qt5ct/{,**} r,
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
# gnome-tiny
|
||||
/etc/gnome/defaults.list r,
|
||||
@{run}/mount/utab r,
|
||||
|
||||
deny @{sys}/devices/system/cpu/present r,
|
||||
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
|
||||
@ -124,6 +131,7 @@ profile thunderbird @{exec_path} {
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/statm r,
|
||||
owner @{PROC}/@{pid}/smaps r,
|
||||
owner @{PROC}/@{pids}/comm r,
|
||||
deny owner @{PROC}/@{pids}/cmdline r,
|
||||
deny owner @{PROC}/@{pids}/environ r,
|
||||
owner @{PROC}/@{pid}/task/ r,
|
||||
@ -138,9 +146,6 @@ profile thunderbird @{exec_path} {
|
||||
# for dig
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# TMP files
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
@ -151,7 +156,7 @@ profile thunderbird @{exec_path} {
|
||||
owner /tmp/mozilla_*/* rw,
|
||||
owner /tmp/MozillaMailnews/ rw,
|
||||
owner /tmp/MozillaMailnews/*.msf rw,
|
||||
owner /tmp/Temp-@{uuid}/ rw,
|
||||
owner /tmp/Temp-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*/ rw,
|
||||
|
||||
deny /dev/ r,
|
||||
/dev/urandom w,
|
||||
@ -181,15 +186,46 @@ profile thunderbird @{exec_path} {
|
||||
/{usr/,}bin/gpgsm rCx -> gpg,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
/{usr/,}bin/qpdfview rPUx,
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
/{usr/,}bin/qpdfview rPx,
|
||||
/{usr/,}bin/viewnior rPUx,
|
||||
/{usr/,}bin/engrampa rPUx,
|
||||
/{usr/,}bin/geany rPUx,
|
||||
/{usr/,}bin/engrampa rPx,
|
||||
/{usr/,}bin/geany rPx,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# DBus
|
||||
dbus send
|
||||
bus=system
|
||||
path=/org/freedesktop/RealtimeKit[0-9]
|
||||
member={Get,MakeThreadHighPriority,MakeThreadRealtime}
|
||||
peer=(name=org.freedesktop.RealtimeKit[0-9]),
|
||||
|
||||
dbus send
|
||||
bus=session
|
||||
path=/ca/desrt/dconf/Writer/user
|
||||
interface=ca.desrt.dconf.Writer
|
||||
member={Change,Notify}
|
||||
peer=(name=ca.desrt.dconf),
|
||||
|
||||
dbus send
|
||||
bus=system
|
||||
path=/org/freedesktop/UPower
|
||||
interface=org.freedesktop.UPower
|
||||
member=EnumerateDevices
|
||||
peer=(name=org.freedesktop.UPower),
|
||||
|
||||
# dconf write
|
||||
owner @{HOME}/.config/dconf/ rw,
|
||||
owner @{HOME}/.config/dconf/user rw,
|
||||
owner @{run}/user/@{uids}/dconf/user rw,
|
||||
|
||||
owner @{run}/user/@{uid}/ICEauthority r,
|
||||
|
||||
@{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,
|
||||
@{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
@ -238,6 +274,7 @@ profile thunderbird @{exec_path} {
|
||||
deny owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw,
|
||||
owner /tmp/ns* rw,
|
||||
|
||||
include if exists <local/thunderbird_gpg>
|
||||
}
|
||||
|
||||
profile open {
|
||||
@ -249,7 +286,7 @@ profile thunderbird @{exec_path} {
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/{,m,g}awk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
@ -258,15 +295,16 @@ profile thunderbird @{exec_path} {
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
/{usr/,}bin/qpdfview rPUx,
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
/{usr/,}bin/qpdfview rPx,
|
||||
/{usr/,}bin/viewnior rPUx,
|
||||
/{usr/,}bin/engrampa rPUx,
|
||||
/{usr/,}bin/geany rPUx,
|
||||
/{usr/,}bin/engrampa rPx,
|
||||
/{usr/,}bin/geany rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/thunderbird_open>
|
||||
}
|
||||
|
||||
include if exists <local/thunderbird>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user