mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(dbus): rewrite some dbus rules (6).

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-05 00:19:43 +00:00
parent ebf3932e3a
commit c066ef0036
Failed to generate hash of commit
29 changed files with 122 additions and 412 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/bus/desktop
View file

@ -4,7 +4,7 @@
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
member=Read
member={GetAll,Read}
peer=(name="{:*,org.freedesktop.portal.Desktop}", label=xdg-desktop-portal),
dbus send bus=session path=/org/freedesktop/portal/desktop

10
apparmor.d/abstractions/bus/notification Normal file
View file

@ -0,0 +1,10 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
dbus send bus=session path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gjs-console),
include if exists <abstractions/bus/notification.d>

5
apparmor.d/abstractions/bus/udisk
View file

@ -7,6 +7,11 @@
member=GetManagedObjects
peer=(name=:*, label=udisksd),
dbus send bus=system path=/org/freedesktop/UDisks2/**
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=udisksd),
dbus receive bus=system path=/org/freedesktop/UDisks2
interface=org.freedesktop.DBus.ObjectManager
member=InterfacesAdded

26
apparmor.d/abstractions/dbus-gtk
View file

@ -1,26 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
dbus (send) bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*),
dbus (send) bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=ListMonitorImplementations
peer=(name=:*),
dbus (send) bus=session path=/org/gtk/Settings
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*),
dbus (send, receive) bus=session path=/org/freedesktop/Notifications
interface=org.freedesktop.Notifications
peer=(name="{org.freedesktop.Notifications,org.freedesktop.DBus,:*}"), # all members
# Include additions to the abstraction
include if exists <abstractions/dbus-gtk.d>

24
apparmor.d/groups/freedesktop/geoclue
View file

@ -20,13 +20,21 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
network inet6 stream,
network netlink raw,
dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
interface=org.freedesktop.{DBus.Properties,GeoClue2*},
dbus bind bus=system name=org.freedesktop.GeoClue2,
dbus send bus=system path=/org/freedesktop/GeoClue2/*
interface=org.freedesktop.DBus.Properties
peer=(name="{:*,org.freedesktop.DBus}"),
dbus receive bus=system path=/org/freedesktop/GeoClue2/*
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/GeoClue2/*
interface=org.freedesktop.GeoClue2.Manager
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser,ReleaseName,RequestName}
peer=(name=org.freedesktop.DBus),
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/
interface=org.freedesktop.Avahi.Server
@ -36,9 +44,10 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Peer
member=Ping,
dbus send bus=system path=/fi/w[0-9]/wpa_supplicant[0-9]
dbus send bus=system path=/fi/w1/wpa_supplicant1
interface=org.freedesktop.DBus.Properties
member=GetAll,
member=PropertiesChanged
peer=(name=:*, label=wpa-supplicant),
dbus send bus=system path=/org/freedesktop/ModemManager[0-9]
interface=org.freedesktop.DBus.ObjectManager
@ -65,9 +74,6 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus bind bus=system
name=org.freedesktop.GeoClue2,
@{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r,

12
apparmor.d/groups/gnome/gnome-extension-ding
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gnome-extension-ding @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/notification>
include <abstractions/bus/vfs/daemon>
include <abstractions/bus/vfs/metadata>
include <abstractions/bus/vfs/mount>
@ -44,10 +45,10 @@ profile gnome-extension-ding @{exec_path} {
member=GetAll
peer=(name=:*, label=nautilus),
dbus send bus=session path=/org/freedesktop/Notifications
dbus send bus=system path=/net/hadess/SwitcherooControl
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gjs-console),
peer=(name=:*, label=switcheroo-control),
dbus send bus=session path=/org/gnome/Nautilus/FileOperations*
interface=org.freedesktop.DBus.Properties
@ -63,8 +64,11 @@ profile gnome-extension-ding @{exec_path} {
member=Introspect
peer=(name=:*, label=nautilus),
dbus send bus={systemd,session} path=/org/freedesktop/DBus
interface=org.freedesktop.DBus{,.Properties}
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus*
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus*
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,

2
apparmor.d/groups/gnome/gnome-session-ctl
View file

@ -18,7 +18,7 @@ profile gnome-session-ctl @{exec_path} {
dbus send bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
member={StartUnit,StopUnit}
peer=(name=org.freedesktop.systemd1),
peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager

3
apparmor.d/groups/gnome/gnome-shell
View file

@ -13,8 +13,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/audio>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/bus/desktop>
include <abstractions/bus/gnome-screensaver>
include <abstractions/bus/network-manager>
include <abstractions/bus/polkit>
include <abstractions/bus/session-manager>
include <abstractions/bus/upower>
include <abstractions/bus/vfs/metadata>
include <abstractions/bus/vfs/mount>

41
apparmor.d/groups/gnome/gsd-color
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile gsd-color @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/session-manager>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -23,6 +25,10 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus bind bus=session name=org.gnome.SettingsDaemon.Color,
dbus receive bus=session path=/org/gnome/SettingsDaemon/Color
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus (send, receive) bus=system path=/org/freedesktop/ColorManager{,/devices/*}
interface=org.freedesktop.ColorManager*,
@ -31,36 +37,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus receive bus=session path=/org/gnome/SettingsDaemon/Color
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/Mutter/DisplayConfig
interface=org.gnome.Mutter.DisplayConfig
member={GetResources,GetCrtcGamma}
@ -71,11 +47,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect

13
apparmor.d/groups/gnome/gsd-disk-utility-notify
View file

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -9,24 +9,17 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-disk-utility-notify
profile gsd-disk-utility-notify @{exec_path} {
include <abstractions/base>
include <abstractions/bus/udisk>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.DBus.{Properties,ObjectManager},
dbus send bus=system path=/org/freedesktop/UDisks2
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus bind bus=session name=org.gnome.Disks.NotificationMonitor,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.gnome.Disks.NotificationMonitor,
@{exec_path} mr,
include if exists <local/gsd-disk-utility-notify>

1
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/locale>
include <abstractions/bus/session-manager>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>

32
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -13,6 +13,8 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/atspi>
include <abstractions/bus/hostname>
include <abstractions/bus/login>
include <abstractions/bus/session-manager>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -40,31 +42,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=upowerd),
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/Shell
interface=org.freedesktop.DBus.Properties
member=GetAll
@ -110,11 +87,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
member=WatchFired
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect

23
apparmor.d/groups/gnome/gsd-power
View file

@ -13,6 +13,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/atspi>
include <abstractions/bus/gnome-screensaver>
include <abstractions/bus/login>
include <abstractions/bus/session-manager>
include <abstractions/bus/upower>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
@ -34,19 +35,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
peer=(name="{org.freedesktop.DBus,:*}", label="{gsd-media-keys,gnome-shell}"),
dbus send bus=session path=/org/gnome/SessionManager{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=session path=/org/gnome/SessionManager{,/**}
interface=org.gnome.SessionManager
peer=(name=:*),
dbus receive bus=session path=/org/gnome/SessionManager{,/**}
interface=org.gnome.SessionManager{,.*}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/Mutter/**
interface=org.freedesktop.DBus.{Properties,ObjectManager}
peer=(name=:*, label=gnome-shell),
@ -79,9 +67,14 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=power-profiles-daemon),
dbus send bus=system path=/org/freedesktop/systemd1
dbus send bus=system path=/org/freedesktop/login1/session/auto
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
member=GetAll
peer=(name=:*, label=systemd-logind),
dbus send bus=system path=/org/freedesktop/login1/session/auto
interface=org.freedesktop.login1.Session
member=SetBrightness
peer=(name=:*, label=systemd-logind),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable

48
apparmor.d/groups/gnome/gsd-print-notifications
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-print-notifications
profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/session-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
@ -21,50 +22,23 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
dbus bind bus=session name=org.gnome.SettingsDaemon.PrintNotifications,
dbus (send,receive) bus=system path=/Client[0-9]*/ServiceBrowser[0-9]*
dbus send bus=system path=/Client@{int}/ServiceBrowser@{int}
interface=org.freedesktop.Avahi.ServiceBrowser
member={CacheExhausted,AllForNow,CacheExhausted,AllForNow,Free},
peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int}
interface=org.freedesktop.Avahi.ServiceBrowser
peer=(name=:*, label=avahi-daemon),
dbus send bus=system path=/
interface=org.freedesktop.Avahi.Server
peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
dbus send bus=system path=/
interface=org.freedesktop.DBus.Peer
member=Ping,
dbus send bus=system path=/
interface=org.freedesktop.Avahi.Server
member={GetAPIVersion,GetState,ServiceBrowserNew},
dbus receive bus=system path=/
interface=org.freedesktop.Avahi.Server
member=StateChanged,
member=Ping
peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
dbus receive bus=system path=/org/cups/cupsd/Notifier
interface=org.cups.cupsd.Notifier,
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect

25
apparmor.d/groups/gnome/gsd-printer
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-printer
profile gsd-printer @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/session-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
@ -20,30 +21,6 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
dbus bind bus=system name=com.redhat.PrinterDriversInstaller,
dbus (send,receive) bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
peer=(name=:*),
dbus send bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={EndSession,QueryEndSession,CancelEndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Presence
interface=org.gnome.SessionManager.Presence
member=StatusChanged
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect

31
apparmor.d/groups/gnome/gsd-rfkill
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-rfkill
profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/session-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -16,6 +17,8 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus bind bus=session name=org.gnome.SettingsDaemon.Rfkill,
dbus send bus=system path=/org/freedesktop/hostname[0-9]
interface=org.freedesktop.DBus.Properties
member=Get,
@ -41,31 +44,6 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SettingsDaemon/Rfkill
interface=org.freedesktop.DBus.Properties
member=GetAll
@ -81,9 +59,6 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.gnome.SettingsDaemon.Rfkill,
@{exec_path} mr,
@{sys}/devices/virtual/misc/rfkill/uevent r,

32
apparmor.d/groups/gnome/gsd-screensaver-proxy
View file

@ -9,46 +9,20 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-screensaver-proxy
profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/session-manager>
include <abstractions/dbus-session-strict>
signal (receive) set=(term, hup) peer=gdm*,
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus bind bus=session name=org.freedesktop.ScreenSaver,
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus bind bus=session name=org.gnome.SettingsDaemon.ScreensaverProxy,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.freedesktop.ScreenSaver,
dbus bind bus=session
name=org.gnome.SettingsDaemon.ScreensaverProxy,
@{exec_path} mr,
owner /dev/tty@{int} rw,

31
apparmor.d/groups/gnome/gsd-sharing
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-sharing
profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/session-manager>
include <abstractions/bus/network-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -16,6 +17,8 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus bind bus=session name=org.gnome.SettingsDaemon.Sharing,
dbus send bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
@ -56,31 +59,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
member=CheckPermissions
peer=(name=:*, label=NetworkManager),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/**}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
member=StopUnit
@ -91,9 +69,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.gnome.SettingsDaemon.Sharing,
dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]*
interface=org.freedesktop.NetworkManager.Connection.Active
member=StateChanged,

31
apparmor.d/groups/gnome/gsd-smartcard
View file

@ -9,37 +9,15 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-smartcard
profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/bus/session-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>
include <abstractions/p11-kit>
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus bind bus=session name=org.gnome.SettingsDaemon.Smartcard,
dbus receive bus=session path=/org/gnome/SettingsDaemon/Smartcard
interface=org.freedesktop.DBus.ObjectManager
@ -56,9 +34,6 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.gnome.SettingsDaemon.Smartcard,
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

35
apparmor.d/groups/gnome/gsd-sound
View file

@ -10,49 +10,20 @@ include <tunables/global>
profile gsd-sound @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/session-manager>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus bind bus=session name=org.gnome.SettingsDaemon.Sound,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus bind bus=session
name=org.gnome.SettingsDaemon.Sound,
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

27
apparmor.d/groups/gnome/gsd-wacom
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/session-manager>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
@ -23,32 +24,6 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus bind bus=session name=org.gnome.SettingsDaemon.Wacom,
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client@{int}}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager/Client@{int}
interface=org.gnome.SessionManager.ClientPrivate
member=EndSessionResponse
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager/Client@{int}
interface=org.gnome.SessionManager.ClientPrivate
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/org/gnome/SettingsDaemon/Wacom
interface=org.freedesktop.DBus.Properties
member=GetAll

5
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -49,6 +49,11 @@ profile gsd-xsettings @{exec_path} {
member=Get
peer=(name=org.gnome.Shell.Introspect, label=gnome-shell),
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User
member=SetInputSources
peer=(name=:*, label=accounts-daemon),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetId

30
apparmor.d/groups/gnome/tracker-extract
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{lib}/tracker-extract-3
profile tracker-extract @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/vfs/daemon>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/deny-sensitive-home>
@ -42,31 +44,21 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
interface=org.gtk.Private.RemoteVolumeMonitor
member={List,IsSupported,MountAdded}
peer=(name=:*, label=gvfs-*-volume-monitor),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMount*
peer=(name=:*, label=gvfsd),
dbus receive bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member={Mounted,ListMounts2}
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=ListMonitorImplementations
peer=(name=:*, label=gvfsd),
dbus receive bus=session path=/org/gtk/Private/RemoteVolumeMonitor
interface=org.gtk.Private.RemoteVolumeMonitor
member={MountAdded,VolumeChanged}
peer=(name=:*, label=gvfs-*-volume-monitor),
dbus send bus=session path=/org/gtk/vfs/metadata
interface=org.gtk.vfs.Metadata
member={GetTreeFromDevice,Remove}
peer=(name=:*, label=gvfsd-metadata),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

2
apparmor.d/groups/gnome/tracker-miner
View file

@ -36,7 +36,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
interface=org.gtk.Private.RemoteVolumeMonitor
member={List,IsSupported}
member={List,IsSupported,VolumeChanged,MountAdded}
peer=(name=:*, label=gvfs-*-volume-monitor),
dbus receive bus=session

10
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/udisk>
include <abstractions/bus/vfs/mount>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -45,11 +46,10 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.ObjectManager
member=InterfacesRemoved
peer=(name=:*, label=udisksd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus receive bus=system path=/org/freedesktop/UDisks2/**
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=udisksd),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable

22
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -17,32 +17,10 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
capability sys_admin, # To set a hostname
dbus bind bus=system name=org.freedesktop.hostname1,
dbus receive bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.hostname1
member=SetHostname
peer=(name=:*, label=systemd//&systemd-networkd),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName,GetConnectionUnixUser}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization
peer=(name=org.freedesktop.PolicyKit1),
dbus receive bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.hostname1
member=Set*Hostname
peer=(name=:*, label=hostnamectl),
@{exec_path} mr,
@{etc_rw}/.#hostname* rw,

1
apparmor.d/profiles-a-f/fwupd
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/bus/udisk>
include <abstractions/bus/upower>
include <abstractions/consoles>
include <abstractions/dbus-strict>

6
apparmor.d/profiles-s-z/udisksd
View file

@ -66,6 +66,12 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.DBus.{Properties,ObjectManager}
peer=(name="{:*,org.freedesktop.DBus}"),
dbus send bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.DBus.{Properties,ObjectManager}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.UDisks2.Job
peer=(name=org.freedesktop.DBus),
dbus (send,receive) bus=system path=/
interface=org.freedesktop.DBus.Introspectable