diff --git a/apparmor.d/groups/akonadi/akonadi_indexing_agent b/apparmor.d/groups/akonadi/akonadi_indexing_agent index 968e255e..98b33eca 100644 --- a/apparmor.d/groups/akonadi/akonadi_indexing_agent +++ b/apparmor.d/groups/akonadi/akonadi_indexing_agent @@ -35,7 +35,7 @@ profile akonadi_indexing_agent @{exec_path} { owner @{user_config_dirs}/akonadi_indexing_agentrc r, owner @{user_config_dirs}/akonadi/#[0-9]* rw, - owner @{user_config_dirs}/akonadi/agent_config_akonadi_indexing_agent{,.*} rwlk, + owner @{user_config_dirs}/akonadi/agent_config_akonadi_indexing_agent* rwlk, owner @{user_config_dirs}/akonadi/akonadiconnectionrc r, owner @{user_config_dirs}/kdedefaults/kdeglobals r, owner @{user_config_dirs}/kdedefaults/kwinrc r, diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 15274eab..c154d3ad 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -130,6 +130,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{bin}/{,ba,da}sh rix, @{bin}/basename rix, + @{bin}/expr rix, @{firefox_lib_dirs}/{,**} r, @{firefox_lib_dirs}/*.so mr, @@ -212,13 +213,16 @@ profile firefox @{exec_path} flags=(attach_disconnected) { /tmp/ r, /var/tmp/ r, + owner /tmp/@{firefox_name}/ rw, + owner /tmp/@{firefox_name}/* rwk, owner /tmp/* rw, owner /tmp/firefox_*/ rw, owner /tmp/firefox_*/* rwk, - owner /tmp/@{firefox_name}/ rw, - owner /tmp/@{firefox_name}/* rwk, owner /tmp/mozilla_*/ rw, owner /tmp/mozilla_*/* rw, + owner /tmp/MozillaBackgroundTask-*-removeDirectory/ rw, + owner /tmp/MozillaBackgroundTask-*-removeDirectory/** rwk, + owner /tmp/Mozillato-be-removed-cachePurge-* k, owner /tmp/Temp-*/ rw, @{run}/mount/utab r, @@ -240,6 +244,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{sys}/devices/system/cpu/present r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/background.slice/*/cpu.max r, + @{PROC}/@{pid}/net/arp r, @{PROC}/@{pid}/net/if_inet6 r, @{PROC}/@{pid}/net/route r, diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index fc5b2702..41551698 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -173,8 +173,12 @@ profile pulseaudio @{exec_path} { @{run}/systemd/users/@{uid} r, + @{run}/udev/data/+pci* r, @{run}/udev/data/+sound:card[0-9]* r, # For sound @{run}/udev/data/c116:[0-9]* r, # for ALSA + @{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254 + @{run}/udev/data/c24[0-9]:[0-9]* r, + @{run}/udev/data/c25[0-4]:[0-9]* r, @{sys}/class/sound/ r, @{sys}/devices/**/sound/**/{uevent,pcm_class} r, diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index 59b0214c..4153c11e 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -30,6 +30,7 @@ profile xdg-settings @{exec_path} { @{bin}/dbus-launch rCx -> dbus, @{bin}/dbus-send rCx -> dbus, + @{bin}/kreadconfig5 rPx, @{bin}/xdg-mime rPx, @{bin}/xprop rPx, diff --git a/apparmor.d/groups/freedesktop/xrdb b/apparmor.d/groups/freedesktop/xrdb index fa6a86db..73c87be0 100644 --- a/apparmor.d/groups/freedesktop/xrdb +++ b/apparmor.d/groups/freedesktop/xrdb @@ -40,6 +40,7 @@ profile xrdb @{exec_path} { owner /tmp/xauth-[0-9]*-_[0-9] r, @{run}/sddm/\{@{uuid}\} r, + @{run}/sddm/xauth_?????? r, # file_inherit owner /dev/tty[0-9]* rw, diff --git a/apparmor.d/groups/freedesktop/xset b/apparmor.d/groups/freedesktop/xset index d428daf4..5f2e0ba7 100644 --- a/apparmor.d/groups/freedesktop/xset +++ b/apparmor.d/groups/freedesktop/xset @@ -16,6 +16,7 @@ profile xset @{exec_path} { owner @{HOME}/.Xauthority r, @{run}/sddm/\{@{uuid}\} r, + @{run}/sddm/xauth_?????? r, # file_inherit owner /dev/tty[0-9]* rw, diff --git a/apparmor.d/groups/freedesktop/xsetroot b/apparmor.d/groups/freedesktop/xsetroot index 599aa865..6915528a 100644 --- a/apparmor.d/groups/freedesktop/xsetroot +++ b/apparmor.d/groups/freedesktop/xsetroot @@ -24,8 +24,8 @@ profile xsetroot @{exec_path} { owner @{user_share_dirs}/sddm/xorg-session.log w, @{run}/sddm/\{@{uuid}\} r, - @{run}/user/@{uid}/xauth_* rl, @{run}/sddm/xauth_?????? r, + @{run}/user/@{uid}/xauth_* rl, include if exists } diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index 758c5aaa..bf037b1b 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -9,6 +9,8 @@ include @{exec_path} = @{lib}/kactivitymanagerd profile kactivitymanagerd @{exec_path} { include + include + include include include @@ -26,6 +28,7 @@ profile kactivitymanagerd @{exec_path} { owner @{user_config_dirs}/kactivitymanagerdrc.lock rwk, owner @{user_share_dirs}/kactivitymanagerd/{,**} rwlk, + owner @{user_share_dirs}/RecentDocuments/*.desktop w, @{PROC}/sys/kernel/core_pattern r, @{PROC}/sys/kernel/random/boot_id r, diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index 10b2e29c..e403a1ad 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -11,6 +11,7 @@ profile kalendarac @{exec_path} { include include include + include include include include diff --git a/apparmor.d/groups/kde/kcminit b/apparmor.d/groups/kde/kcminit index 4064a7b3..eb37c005 100644 --- a/apparmor.d/groups/kde/kcminit +++ b/apparmor.d/groups/kde/kcminit @@ -15,7 +15,8 @@ profile kcminit @{exec_path} { @{exec_path} mr, - @{bin}/xrdb rPx, + @{bin}/xrdb rPx, + @{bin}/xsetroot rPx, /usr/share/icu/[0-9]*.[0-9]*/*.dat r, /usr/share/hwdata/pnp.ids r, diff --git a/apparmor.d/groups/kde/kded5 b/apparmor.d/groups/kde/kded5 index a687db53..d2773365 100644 --- a/apparmor.d/groups/kde/kded5 +++ b/apparmor.d/groups/kde/kded5 @@ -13,6 +13,7 @@ profile kded5 @{exec_path} { include include include + include include include include @@ -38,22 +39,23 @@ profile kded5 @{exec_path} { @{exec_path} mr, - @{lib}/kf5/kconf_update rPx, - @{lib}/utempter/utempter rPx, @{bin}/kcminit rPx, @{bin}/pgrep rCx -> pgrep, @{bin}/setxkbmap rix, @{bin}/xsettingsd rPx, + @{lib}/kf5/kconf_update rPx, + @{lib}/utempter/utempter rPx, /usr/share/hwdata/*.ids r, /usr/share/icu/[0-9]*.[0-9]*/*.dat r, + /usr/share/kconf_update/ r, /usr/share/kded5/{,**} r, + /usr/share/kf5/kcookiejar/* r, /usr/share/khotkeys/{,**} r, /usr/share/knotifications5/{,**} r, /usr/share/kservices5/{,**} r, /usr/share/kservicetypes5/{,**} r, /usr/share/mime/ r, - /usr/share/kconf_update/ r, /etc/fstab r, /etc/machine-id r, @@ -74,28 +76,39 @@ profile kded5 @{exec_path} { owner @{user_config_dirs}/gtk-{3,4}.0/{,**} rwl, owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kconf_updaterc r, - owner @{user_config_dirs}/kded5rc* rwl, + owner @{user_config_dirs}/kcookiejarrc r, + owner @{user_config_dirs}/kdebugrc r, owner @{user_config_dirs}/kded5rc.lock rwk, + owner @{user_config_dirs}/kded5rc* rwl, owner @{user_config_dirs}/kdedefaults/{,**} r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/khotkeysrc.lock rwk, owner @{user_config_dirs}/khotkeysrc* rwl, + owner @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/ktimezonedrc r, - owner @{user_config_dirs}/kwinrc* rwl, owner @{user_config_dirs}/kwinrc.lock rwk, + owner @{user_config_dirs}/kwinrc* rwl, owner @{user_config_dirs}/kxkbrc r, owner @{user_config_dirs}/libaccounts-glib/ rw, owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/plasma-nm r, + owner @{user_config_dirs}/touchpadrc r, owner @{user_config_dirs}/xsettingsd/{,**} rw, owner @{user_share_dirs}/icc/{,edid-*} r, - owner @{user_share_dirs}/kded5/{,**} r, - owner @{user_share_dirs}/kscreen/{,**} rw, + owner @{user_share_dirs}/kcookiejar/#*[0-9] rw, + owner @{user_share_dirs}/kcookiejar/cookies rw, + owner @{user_share_dirs}/kcookiejar/cookies.?????? rwlk, + owner @{user_share_dirs}/kded5/{,**} rw, + owner @{user_share_dirs}/kscreen/{,**} rwl, owner @{user_share_dirs}/ktp/cache.db rwk, - owner @{user_share_dirs}/kcookiejar/#@{hex}* rw, - owner @{user_share_dirs}/kcookiejar/cookies.* rwkl, + owner @{user_share_dirs}/remoteview/ r, + owner @{user_share_dirs}/services5/{,**} r, owner @{run}/user/@{uid}/#[0-9]* rw, + owner @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/kded5*kioworker.socket rwl, owner /tmp/plasma-csd-generator.??????/{,**} rw, diff --git a/apparmor.d/groups/kde/kioslave5 b/apparmor.d/groups/kde/kioslave5 index 7c0bbd7d..db924953 100644 --- a/apparmor.d/groups/kde/kioslave5 +++ b/apparmor.d/groups/kde/kioslave5 @@ -16,6 +16,7 @@ profile kioslave5 @{exec_path} { include include include + include include network inet dgram, @@ -23,7 +24,9 @@ profile kioslave5 @{exec_path} { network inet stream, network inet6 stream, network netlink raw, + network netlink dgram, + signal (receive) set=term peer=firefox-kmozillahelper, signal (receive) set=term peer=plasmashell, @{exec_path} mr, diff --git a/apparmor.d/groups/kde/kscreenlocker-greet b/apparmor.d/groups/kde/kscreenlocker-greet index ac67f910..163c1bda 100644 --- a/apparmor.d/groups/kde/kscreenlocker-greet +++ b/apparmor.d/groups/kde/kscreenlocker-greet @@ -96,6 +96,7 @@ profile kscreenlocker-greet @{exec_path} { @{sys}/devices/system/node/node[0-9]*/meminfo r, @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/loginuid r, @{PROC}/@{pid}/mounts r, @{PROC}/sys/kernel/core_pattern r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 0cb5eddd..de46ca6c 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -145,10 +145,10 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_share_dirs}/plasma/plasmoids/{,**} r, owner @{user_share_dirs}/user-places.xbel r, + @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/#[0-9]* rw, owner @{run}/user/@{uid}/kdesud_:1 w, owner @{run}/user/@{uid}/plasmashell??????.[0-9].kioworker.socket rwl, - owner @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/pulse/ rw, @{sys}/bus/ r, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index f1aebfa3..94fe0814 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/xembedsniproxy profile xembedsniproxy @{exec_path} { include + include include include diff --git a/apparmor.d/profiles-a-f/aa-notify b/apparmor.d/profiles-a-f/aa-notify index 81cb167e..0eeb04e5 100644 --- a/apparmor.d/profiles-a-f/aa-notify +++ b/apparmor.d/profiles-a-f/aa-notify @@ -13,6 +13,8 @@ profile aa-notify @{exec_path} { include include + capability setgid, + capability setuid, capability sys_ptrace, ptrace (read), @@ -24,10 +26,14 @@ profile aa-notify @{exec_path} { /etc/apparmor/*.conf r, /etc/inputrc r, - /usr/share/terminfo/x/xterm-256color r, + /usr/etc/inputrc.keys r, /usr/share/terminfo/d/dumb r, + /usr/share/terminfo/x/xterm r, + /usr/share/terminfo/x/xterm-256color r, + /var/log/audit/audit.log r, + owner @{HOME}/.inputrc r, owner @{HOME}/.terminfo/[0-9]*/dumb r, owner /tmp/[a-z0-9]* rw, diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/profiles-a-f/agetty index 76a3789c..441f77f0 100644 --- a/apparmor.d/profiles-a-f/agetty +++ b/apparmor.d/profiles-a-f/agetty @@ -31,7 +31,9 @@ profile agetty @{exec_path} { /{etc,run,lib,usr/lib}/issue.d/{,*} r, /etc/inittab r, /etc/login.defs r, + /etc/login.defs.d/ r, /etc/os-release r, + /usr/etc/login.defs r, @{run}/resolvconf/resolv.conf r, owner @{run}/agetty.reload rw, diff --git a/apparmor.d/profiles-a-f/augenrules b/apparmor.d/profiles-a-f/augenrules index fad941a0..6f864fdd 100644 --- a/apparmor.d/profiles-a-f/augenrules +++ b/apparmor.d/profiles-a-f/augenrules @@ -14,6 +14,7 @@ profile augenrules @{exec_path} { @{exec_path} mr, @{bin}/auditctl rPx, + @{bin}/cat rix, @{bin}/chmod rix, @{bin}/cmp rix, @{bin}/cp rix, diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index 90be8c59..423f57e1 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -42,6 +42,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) { /usr/src/*/*.ko r, /var/lib/dkms/**/module/*.ko r, /var/lib/dpkg/triggers/* r, + /var/lib/ebtables/lock r, /var/tmp/dracut.*/{,**} rw, owner /boot/System.map-* r, owner /tmp/mkinitcpio.*/{,**} rw, diff --git a/apparmor.d/profiles-m-r/os-prober b/apparmor.d/profiles-m-r/os-prober index a8627231..2db33cf7 100644 --- a/apparmor.d/profiles-m-r/os-prober +++ b/apparmor.d/profiles-m-r/os-prober @@ -21,6 +21,7 @@ profile os-prober @{exec_path} flags=(attach_disconnected) { @{bin}/{,ba,da}sh rix, @{bin}/{e,f,}grep rix, @{bin}/blkid rPx, + @{bin}/cat rix, @{bin}/cut rix, @{bin}/dmraid rPUx, @{bin}/find rix, @@ -34,6 +35,7 @@ profile os-prober @{exec_path} flags=(attach_disconnected) { @{bin}/lvm rPx, @{bin}/mkdir rix, @{bin}/mktemp rix, + @{bin}/multipath rPUx, @{bin}/readlink rix, @{bin}/rm rix, @{bin}/rmdir rix,