mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-12-25 06:27:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-11-21 20:08:48 +00:00
parent 65f2d21558
commit cb86f1c076
Failed to generate hash of commit
14 changed files with 17 additions and 82 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/freedesktop/geoclue
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/geoclue @{lib}/geoclue-2.0/demos/agent
profile geoclue @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-system>
include <abstractions/bus/fi.w1.wpa_supplicant1>
include <abstractions/bus/org.freedesktop.Avahi>

2
apparmor.d/groups/freedesktop/polkit-agent-helper
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9]
@{exec_path} += @{lib}/polkit-agent-helper-[0-9]
profile polkit-agent-helper @{exec_path} {
profile polkit-agent-helper @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/authentication>
include <abstractions/bus-system>

1
apparmor.d/groups/systemd/systemd-sleep-nvidia
View file

@ -11,6 +11,7 @@ profile systemd-sleep-nvidia @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability perfmon,
capability sys_admin,
capability sys_tty_config,

1
apparmor.d/groups/virt/containerd-shim-runc-v2
View file

@ -50,6 +50,7 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) {
@{sys}/fs/cgroup/kubepods/{,**} rw,
@{sys}/kernel/mm/hugepages/ r,
@{PROC}/@{pid}/task/@{tid}/mountinfo r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/mountinfo r,
@{PROC}/@{pids}/oom_score_adj rw,

2
apparmor.d/profiles-a-f/aa-notify
View file

@ -36,7 +36,7 @@ profile aa-notify @{exec_path} {
owner @{HOME}/.inputrc r,
owner @{HOME}/.terminfo/@{int}/dumb r,
owner @{tmp}/@{rand8} rw,
owner @{tmp}/@{word8} rw,
owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw,
@{PROC}/ r,

4
apparmor.d/profiles-a-f/font-manager
View file

@ -11,11 +11,9 @@ include <tunables/global>
profile font-manager @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gstreamer>
include <abstractions/gtk>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>

2
apparmor.d/profiles-a-f/fwupd
View file

@ -58,7 +58,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) {
@{bin}/gpgsm rCx -> gpg,
/usr/share/fwupd/{,**} r,
/usr/share/hwdata/*.ids r,
/usr/share/hwdata/* r,
/usr/share/mime/mime.cache r,
/etc/fwupd/{,**} rw,

5
apparmor.d/profiles-g-l/gsettings
View file

@ -7,8 +7,9 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/gsettings
profile gsettings @{exec_path} {
profile gsettings @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session>
include <abstractions/dconf-write>
@ -22,8 +23,6 @@ profile gsettings @{exec_path} {
owner @{desktop_config_dirs}/dconf/user rw,
owner @{DESKTOP_HOME}/greeter-dconf-defaults r,
/dev/tty@{int} rw,
include if exists <local/gsettings>
}

61
apparmor.d/profiles-g-l/jami-gnome
View file

@ -1,61 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/jami-gnome
profile jami-gnome @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
network netlink raw,
@{exec_path} mr,
@{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix,
@{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix,
/usr/share/ring/{,**} r,
/usr/share/sounds/jami-gnome/{,**} r,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/jami-gnome/ rw,
owner @{user_cache_dirs}/jami-gnome/** rw,
owner @{user_share_dirs}/jami/ rw,
owner @{user_share_dirs}/jami/** rwkl -> @{user_share_dirs}/jami/,
owner @{user_config_dirs}/autostart/jami-gnome.desktop w,
owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/webkitgtk/deviceidhashsalts/1/ r,
owner @{user_share_dirs}/webkitgtk/databases/indexeddb/v0 w,
owner @{user_share_dirs}/webkitgtk/databases/indexeddb/v1/ w,
@{sys}/firmware/acpi/pm_profile r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/fs/cgroup/** r,
owner @{PROC}/@{pid}/statm r,
owner @{PROC}/@{pid}/smaps r,
deny owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/cgroup r,
@{PROC}/zoneinfo r,
include if exists <local/jami-gnome>
}
# vim:syntax=apparmor

4
apparmor.d/profiles-m-r/passimd
View file

@ -26,9 +26,7 @@ profile passimd @{exec_path} flags=(attach_disconnected) {
/etc/passim.conf r,
/var/lib/passim/{,**} r,
/var/lib/passim/data/{,**} rw,
owner /var/lib/passim/{,**} rw,
owner /var/log/passim/* rw,
@{PROC}/@{pid}/cmdline r,

2
apparmor.d/profiles-m-r/pidof
View file

@ -28,7 +28,7 @@ profile pidof @{exec_path} {
@{PROC}/sys/kernel/osrelease r,
@{PROC}/uptime r,
owner /dev/tty@{int} rw,
/dev/tty@{int} rw,
include if exists <local/pidof>
}

10
apparmor.d/profiles-s-z/sudo
View file

@ -21,15 +21,9 @@ profile sudo @{exec_path} flags=(attach_disconnected) {
network inet dgram,
network inet6 dgram,
ptrace (read),
ptrace read,
signal (send,receive) peer=cockpit-bridge,
signal (send) peer=@{p_systemd},
signal (send) set=(cont,hup,winch) peer=su,
signal (send) set=(winch) peer=child-pager,
signal (send) set=(winch) peer=journalctl,
signal (send) set=(winch) peer=pacman,
signal (send) set=(winch, hup, term) peer=rpm,
signal send set=(winch, hup, term),
@{bin}/@{shells} rUx,
@{lib}/** PUx,

3
apparmor.d/profiles-s-z/udisksd
View file

@ -48,6 +48,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
mount options=(rw move) -> @{MOUNTS}/,
mount options=(rw move) -> @{MOUNTS}/*/,
mount fstype=vfat -> /boot/efi/,
# Allow mounting on temporary mount point
mount -> @{run}/udisks2/temp-mount-*/,
mount / -> @{MOUNTS}/*/,
@ -56,6 +58,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
umount @{MOUNTS}/,
umount @{MOUNTS}/*/,
umount @{run}/udisks2/temp-mount-*/,
umount /boot/efi/,
umount /media/cdrom@{int}/,
signal receive set=int peer=@{p_systemd},

1
apparmor.d/profiles-s-z/virt-manager
View file

@ -89,6 +89,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/net/route r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,