mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Profile update.

Browse source
This commit is contained in:
Alexandre Pujol 2021-05-08 19:06:48 +01:00
parent 0d566a43b9
commit bfa2293379
Failed to generate hash of commit
21 changed files with 64 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/bus/dbus-daemon
View file

@ -53,7 +53,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
@{sys}/module/apparmor/parameters/enabled r,
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{run}/systemd/sessions/[0-9].ref rw,
@{run}/systemd/sessions/[0-9]*.ref rw,
@{run}/systemd/users/@{uid} r,
owner @{run}/user/@{uid}/dbus-1/ rw,
owner @{run}/user/@{uid}/dbus-1/services/ rw,

2
apparmor.d/groups/desktop/at-spi-bus-launcher
View file

@ -32,7 +32,7 @@ profile at-spi-bus-launcher @{exec_path} {
owner @{HOME}/.Xauthority r,
/var/lib/lightdm/.Xauthority r,
@{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,

2
apparmor.d/groups/desktop/at-spi2-registryd
View file

@ -22,7 +22,7 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.Xauthority r,
/var/lib/lightdm/.Xauthority r,
@{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
# file_inherit
owner @{HOME}/.xsession-errors w,

2
apparmor.d/groups/desktop/blueman
View file

@ -76,7 +76,7 @@ profile blueman @{exec_path} flags=(attach_disconnected) {
/var/lib/dbus/machine-id r,
/etc/machine-id r,
@{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
# file_inherit
/dev/dri/card[0-9]* rw,

4
apparmor.d/groups/desktop/colord
View file

@ -30,8 +30,6 @@ profile colord @{exec_path} flags=(attach_disconnected) {
/usr/share/color/icc/{,**} r,
owner @{run}/systemd/sessions/[0-9] r,
@{sys}/class/drm/ r,
@{sys}/class/video4linux/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]/card[0-9]-{HDMI,VGA,LVDS,DP,eDP}-*/{enabled,edid} r,
@ -45,7 +43,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
@{user_share_dirs}/icc/edid-*.icc r,
@{run}/systemd/sessions/[0-9] r,
@{run}/systemd/sessions/[0-9]* r,
include if exists <local/colord>
}

5
apparmor.d/groups/gnome/gdm
View file

@ -28,6 +28,7 @@ profile gdm @{exec_path} {
/usr/share/gdm/gdm.schemas r,
/usr/share/wayland-sessions/*.desktop r,
/usr/share/xsessions/*.desktop r,
/etc/gdm/custom.conf r,
/etc/locale.conf r,
@ -38,8 +39,8 @@ profile gdm @{exec_path} {
@{run}/gdm/gdm.pid rw,
@{run}/gdm/greeter/ rw,
@{run}/systemd/seats/seat[0-9]* r,
@{run}/systemd/sessions/[0-9] r,
@{run}/systemd/sessions/[0-9].ref r,
@{run}/systemd/sessions/[0-9]* r,
@{run}/systemd/sessions/[0-9]*.ref r,
@{run}/systemd/userdb/ r,
@{run}/systemd/users/@{uid} r,

2
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -54,7 +54,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
/usr/share/wayland-sessions/*.desktop r,
@{run}/faillock/[a-zA-z0-9]* rwk,
@{run}/systemd/sessions/[0-9].ref rw,
@{run}/systemd/sessions/[0-9]*.ref rw,
@{run}/systemd/users/@{uid} r,
@{run}/utmp rwk,

3
apparmor.d/groups/gnome/gdm-x-session
View file

@ -20,6 +20,9 @@ profile gdm-x-session @{exec_path} flags=(attach_disconnected) {
/usr/share/gdm/gdm.schemas r,
/var/lib/gdm/.cache/gdm/Xauthority rw,
@{run}/user/@{uid}/gdm/ w,
@{run}/user/@{uid}/gdm/Xauthority rw,
owner @{PROC}/@{pid}/fd/ r,
/dev/tty[0-9]* rw,

10
apparmor.d/groups/gnome/gdm-xsession
View file

@ -13,7 +13,7 @@ profile gdm-xsession @{exec_path} {
include <abstractions/consoles>
include <abstractions/nameservice-strict>
@{exec_path} r,
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/zsh rix,
@ -21,22 +21,26 @@ profile gdm-xsession @{exec_path} {
/{usr/,}bin/gnome-session rix,
/{usr/,}bin/gsettings rix,
/{usr/,}bin/id rix,
/{usr/,}bin/tty rix,
/{usr/,}bin/dbus-update-activation-environment rCx -> dbus,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/xhost rPx,
/{usr/,}lib/gnome-session-binary rPx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/etc/X11/{,**} r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
profile dbus {
include <abstractions/base>
/{usr/,}bin/dbus-update-activation-environment mr,
# file_inherit
owner @{HOME}/.xsession-errors w,
}
include if exists <local/gdm-xsession>

3
apparmor.d/groups/gnome/gjs-console
View file

@ -52,7 +52,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
@{run}/user/@{uid}/wayland-cursor-shared-* rw,
/dev/ r,
/dev/tty rw,

13
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/gnome-session-binary
profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gtk>
include <abstractions/nameservice-strict>
@ -40,12 +42,15 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/usr/share/applications/org.gnome.Shell.desktop r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/gnome-session/hardware-compatibility r,
/usr/share/gnome-session/sessions/*.session r,
owner @{user_config_dirs}/gnome-session/saved-session/ r,
owner @{user_config_dirs}/gtk-3.0/bookmarks rw,
owner @{user_config_dirs}/gtk-3.0/bookmarks.[0-9A-Z]* rw,
owner @{user_cache_dirs}/mesa_shader_cache/index rw,
# Users xdg
owner @{user_config_dirs}/user-dirs.dirs r,
owner @{user_config_dirs}/user-dirs.locale r,
@ -66,18 +71,22 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/tmp/.ICE-unix/[0-9]* rw,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/gnome-session-leader-fifo rw,
owner @{run}/user/@{uid}/ICEauthority{,-[a-z]} rwl,
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{run}/systemd/sessions/[0-9] r,
@{run}/systemd/sessions/[0-9].ref rw,
@{run}/systemd/sessions/[0-9]* r,
@{run}/systemd/sessions/[0-9]*.ref rw,
@{run}/systemd/users/@{uid} r,
@{sys}/devices/**/{vendor,device} r,
owner @{PROC}/@{pid}/loginuid r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/cmdline r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
/dev/null r,
/dev/tty rw,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -92,7 +92,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/users/@{uid} r,
@{run}/systemd/sessions/ r,
@{run}/systemd/sessions/[0-9] r,
@{run}/systemd/sessions/[0-9]* r,
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{run}/udev/tags/seat/ r,

16
apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer Normal file
View file

@ -0,0 +1,16 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/gnome-shell-hotplug-sniffer
profile gnome-shell-hotplug-sniffer @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/gnome-shell-hotplug-sniffer>
}

2
apparmor.d/groups/gnome/gsd-color
View file

@ -25,6 +25,8 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm/.local/share/icc/ r,
/var/lib/gdm/.local/share/icc/edid-*.icc r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

2
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -21,6 +21,8 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
/usr/share/icons/{,**} r,
/usr/share/X11/xkb/** r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

1
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -34,6 +34,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm/.config/pulse/client.conf r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/pulse/ r,
@{run}/systemd/inhibit/[0-9]*.ref rw,

3
apparmor.d/groups/gnome/gsd-power
View file

@ -60,7 +60,8 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{run}/user/@{uid}/pulse/ r,
owner @{run}/user/@{uid}/pulse/ r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
@{PROC}/cmdline r,

2
apparmor.d/groups/gnome/gsd-wacom
View file

@ -27,6 +27,8 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
/usr/share/mime/mime.cache r,
/usr/share/X11/xkb/** r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

3
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -39,7 +39,8 @@ profile gsd-xsettings @{exec_path} {
/var/lib/gdm/.config/dconf/user r,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{PROC}/@{pid}/fd/ r,
/dev/tty rw,

3
apparmor.d/profiles-a-l/logrotate
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -54,6 +55,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
/var/lib/logrotate/status rwk,
/var/lib/logrotate/status.tmp rw,
/var/lib/logrotate.status rwk,
/var/lib/logrotate.status.tmp rw,
/var/log/** rw,

1
apparmor.d/profiles-m-z/xhost
View file

@ -15,6 +15,7 @@ profile xhost @{exec_path} {
@{exec_path} mr,
owner @{HOME}/.Xauthority r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
# file_inherit
owner /dev/tty[0-9]* rw,