Add all gsd-* profiles.

This commit is contained in:
Alexandre Pujol 2021-04-02 10:26:15 +01:00
parent e3d08f3de7
commit b6152def16
Failed to generate hash of commit
18 changed files with 554 additions and 0 deletions

View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-a11y-settings
profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-a11y-settings>
}

View file

@ -0,0 +1,38 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-color
profile gsd-color @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/gtk>
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/mime/mime.cache r,
/usr/share/X11/xkb/** r,
/var/lib/gdm/.local/share/icc/ r,
/var/lib/gdm/.local/share/icc/edid-*.icc r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner @{user_share_dirs}/icc/ r,
owner @{user_share_dirs}/icc/edid-*.icc r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-color>
}

View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-datetime
profile gsd-datetime @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-datetime>
}

View file

@ -0,0 +1,16 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-disk-utility-notify
profile gsd-disk-utility-notify @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/gsd-disk-utility-notify>
}

View file

@ -0,0 +1,36 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-housekeeping
profile gsd-housekeeping @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/thumbnails-cache-read>
@{exec_path} mr,
/etc/fstab r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
owner @{user_cache_dirs}/thumbnails/fail/gnome-thumbnail-factory/ r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner @{PROC}/@{pids}/mountinfo r,
@{run}/mount/utab r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-housekeeping>
}

View file

@ -0,0 +1,31 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-keyboard
profile gsd-keyboard @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/gtk>
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/X11/xkb/** r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-keyboard>
}

View file

@ -0,0 +1,49 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-media-keys
profile gsd-media-keys @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/fonts>
include <abstractions/gtk>
network netlink raw,
@{exec_path} mr,
/etc/machine-id r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/X11/xkb/** r,
owner @{user_config_dirs}/pulse/client.conf r,
owner @{user_config_dirs}/pulse/cookie rk,
/var/lib/gdm/.config/pulse/client.conf r,
owner @{run}/user/[0-9]*/pulse/ r,
@{run}/systemd/inhibit/[0-9]*.ref rw,
/dev/shm/ r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{sys}/devices/platform/**/uevent r,
@{sys}/devices/**/usb[0-9]/{,**} r,
include if exists <local/gsd-media-keys>
}

View file

@ -0,0 +1,57 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-power
profile gsd-power @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/fonts>
include <abstractions/gtk>
network netlink raw,
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/X11/xkb/** r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
@{sys}/bus/ r,
@{sys}/class/ r,
@{sys}/class/backlight/ r,
@{sys}/devices/pci[0-9]*/**/class r,
@{sys}/devices/pci[0-9]*/**/backlight/**/brightness rw,
@{sys}/devices/pci[0-9]*/**/backlight/**/{max_brightness,actual_brightness} r,
@{sys}/devices/pci[0-9]*/**/backlight/**/{uevent,type} r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/brightness rw,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{max_brightness,actual_brightness} r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{uevent,type,enabled} r,
@{sys}/devices/platform/**/leds/*backlight*/uevent r,
@{sys}/devices/platform/**/leds/*backlight*/max_brightness r,
@{sys}/devices/platform/**/leds/*backlight*/brightness rw,
@{run}/udev/data/+backlight:* r,
@{run}/udev/data/+leds:*backlight* r,
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{PROC}/cmdline r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-power>
}

View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-print-notifications
profile gsd-print-notifications @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
network inet stream,
network inet6 stream,
signal (send) set=(hup) peer=gsd-printer,
@{exec_path} mr,
/{usr/,}lib/gsd-printer rPx,
owner @{PROC}/@{pid}/fd/ r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-print-notifications>
}

View file

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-printer
profile gsd-printer @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
signal (receive) set=(hup) peer=gsd-print-notifications,
@{exec_path} mr,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-printer>
}

View file

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-rfkill
profile gsd-rfkill @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
network netlink raw,
@{exec_path} mr,
/sys/devices/virtual/misc/rfkill/uevent r,
/dev/rfkill rw,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-rfkill>
}

View file

@ -0,0 +1,18 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-screensaver-proxy
profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
@{exec_path} mr,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-screensaver-proxy>
}

View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-sharing
profile gsd-sharing @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-sharing>
}

View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-smartcard
profile gsd-smartcard @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-smartcard>
}

View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-sound
profile gsd-sound @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
@{exec_path} mr,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-sound>
}

View file

@ -0,0 +1,22 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-usb-protection
profile gsd-usb-protection @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
include if exists <local/gsd-usb-protection>
}

View file

@ -0,0 +1,36 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-wacom
profile gsd-wacom @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/gtk>
@{exec_path} mr,
/etc/machine-id r,
/usr/share/libwacom/{,*} r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/mime/mime.cache r,
/usr/share/X11/xkb/** r,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner /dev/tty[0-9]* rw,
include if exists <local/gsd-wacom>
}

View file

@ -0,0 +1,46 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gsd-xsettings
profile gsd-xsettings @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
@{exec_path} mr,
/{usr/,}bin/xrdb rPx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/drirc.d/{,*} r,
/etc/xdg/Xwayland-session.d/ r,
/etc/xdg/Xwayland-session.d/00-xrdb rix,
owner @{user_cache_dirs}/mesa_shader_cache/index rw,
include <abstractions/dconf>
owner @{run}/user/[0-9]*/dconf/ rw,
owner @{run}/user/[0-9]*/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
@{sys}/devices/pci[0-9]*/**/{device,vendor,uevent} r,
@{sys}/devices/pci[0-9]*/**/{subsystem_device,subsystem_vendor} r,
owner @{run}/user/@{pid}/.mutter-Xwaylandauth.[a-zA-z0-9]* r,
owner @{PROC}/@{pid}/fd/ r,
/dev/dri/ r,
/dev/tty rw,
/dev/tty[0-9]* rw,
include if exists <local/gsd-xsettings>
}