mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Debian 12 Gnome DE

Browse source
This commit is contained in:
nobody43 2023-09-08 14:33:32 +00:00 committed by Alex
parent 0687c32df2
commit d414083113
34 changed files with 150 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/apps/vlc
View file

@ -198,6 +198,7 @@ profile vlc @{exec_path} {
# Silencer
deny @{lib}/@{multiarch}/vlc/{,**} w,
deny @{user_share_dirs}/gvfs-metadata/{*,} r,
profile xdg-screensaver {
include <abstractions/base>

2
apparmor.d/groups/apt/apt-extracttemplates
View file

@ -13,6 +13,8 @@ profile apt-extracttemplates @{exec_path} {
include <abstractions/consoles>
include <abstractions/apt-common>
capability dac_read_search,
@{exec_path} mr,
@{bin}/dpkg rPx -> child-dpkg,

8
apparmor.d/groups/apt/apt-key
View file

@ -15,7 +15,9 @@ profile apt-key @{exec_path} {
@{exec_path} mr,
@{bin}/{,ba,da}sh rix,
@{bin}/{,e}grep rix,
@{bin}/{,e,f}grep rix,
@{bin}/{,m,g}awk rix,
@{bin}/base64 rix,
@{bin}/cat rix,
@{bin}/chmod rix,
@{bin}/cmp rix,
@ -27,6 +29,7 @@ profile apt-key @{exec_path} {
@{bin}/mktemp rix,
@{bin}/readlink rix,
@{bin}/rm rix,
@{bin}/mv rix,
@{bin}/sed rix,
@{bin}/sort rix,
@{bin}/touch rix,
@ -50,7 +53,7 @@ profile apt-key @{exec_path} {
/root/ r,
/etc/apt/trusted.gpg r,
/etc/apt/trusted.gpg.d/{,*.gpg} r,
/etc/apt/trusted.gpg.d/{,*.gpg,*.asc} r,
/tmp/ r,
owner /tmp/apt-key-gpghome.*/{,**} rw,
@ -99,6 +102,7 @@ profile apt-key @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
include if exists <local/apt-key_pgp>
}
include if exists <local/apt-key>

1
apparmor.d/groups/apt/apt-methods-rred
View file

@ -23,6 +23,7 @@ profile apt-methods-rred @{exec_path} {
signal (receive) peer=apt-get,
signal (receive) peer=aptitude,
signal (receive) peer=synaptic,
signal (receive) set=(int) peer=packagekitd,
@{exec_path} mr,

5
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -35,12 +35,17 @@ profile dpkg-preconfigure @{exec_path} {
owner /tmp/*.template.* rw,
owner /tmp/*.config.* rwPUx,
/var/lib/dbus/machine-id r,
owner /var/cache/debconf/ rw,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk,
owner /var/cache/debconf/tmp.ci/ r,
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
@{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
@{run}/user/@{uid}/pk-debconf-socket rw,
owner @{PROC}/@{pid}/fd/ r,
# The following is needed when dpkg-preconfigure uses debcconf GUI frontends.
include <abstractions/gtk>
include <abstractions/fonts>

8
apparmor.d/groups/apt/synaptic
View file

@ -64,8 +64,9 @@ profile synaptic @{exec_path} {
@{exec_path} mr,
@{bin}/{,ba,da}sh rix,
@{bin}/{,e,f}grep rix,
@{bin}/test rix,
@{bin}/{,e}grep rix,
@{bin}/echo rix,
# For update-apt-xapian-index
@{bin}/nice rix,
@ -81,6 +82,7 @@ profile synaptic @{exec_path} {
#@{bin}/dbus-send rCx -> dbus,
deny @{bin}/dbus-launch rx,
deny @{bin}/dbus-send rx,
deny @{bin}/gdbus rx,
@{bin}/ps rPx,
@{bin}/dpkg rPx,
@ -99,6 +101,7 @@ profile synaptic @{exec_path} {
@{bin}/deborphan rPx,
@{bin}/tasksel rPx,
@{bin}/pkexec rPx,
@{bin}/software-properties-gtk rPx,
# Methods to use to download packages from the net
@{lib}/apt/methods/* rPx,
@ -139,6 +142,8 @@ profile synaptic @{exec_path} {
owner @{HOME}/.synaptic/** rwk,
@{run}/synaptic.socket w,
@{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
@ -158,6 +163,7 @@ profile synaptic @{exec_path} {
# file_inherit
owner /dev/tty@{int} rw,
deny @{user_share_dirs}/gvfs-metadata/{*,} r,
profile dbus {
include <abstractions/base>

6
apparmor.d/groups/bus/ibus-x11
View file

@ -21,6 +21,12 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
unix (connect, receive, send) type=stream peer=(label=ibus-daemon),
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
network netlink raw,
dbus send bus=session path=/org/a11y/bus
interface=org.a11y.Bus
member=GetAddress

5
apparmor.d/groups/children/child-open
View file

@ -76,7 +76,7 @@ profile child-open {
@{bin}/gnome-calculator rPUx,
@{bin}/gnome-disk-image-mounter rPx,
@{bin}/gnome-disks rPx,
@{bin}/gwenview rPUx,
@{bin}/gwenview rPUx,
@{bin}/kgx rPx,
@{bin}/okular rPx,
@{bin}/qbittorrent rPx,
@ -88,8 +88,9 @@ profile child-open {
@{bin}/thunderbird rPx,
@{bin}/transmission-gtk rPx,
@{bin}/viewnior rPUx,
@{bin}/vlc rPUx,
@{bin}/vlc rPUx,
@{bin}/xarchiver rPx,
@{bin}/xbrlapi rPx,
@{lib}/libreoffice/program/{soffice,soffice.bin,oosplash} rPUx,

1
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -47,6 +47,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
@{bin}/cat rix,
@{bin}/chage rPx,
@{bin}/passwd rPx,
@{bin}/chpasswd rPx,
@{bin}/userdel rPx,
@{bin}/usermod rPx,
@{bin}/locale rPUx,

1
apparmor.d/groups/freedesktop/geoclue
View file

@ -75,6 +75,7 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
/etc/geoclue/{,**} r,
/var/lib/nscd/services r,
/var/lib/dbus/machine-id r,
@{run}/systemd/journal/socket rw,

1
apparmor.d/groups/freedesktop/plymouthd
View file

@ -19,6 +19,7 @@ profile plymouthd @{exec_path} {
network netlink raw,
signal (send) peer=unconfined,
signal (send) set=(rtmin+23) peer=systemd-shutdown,
ptrace (read) peer=plymouth,

1
apparmor.d/groups/freedesktop/xdg-user-dirs-update
View file

@ -48,6 +48,7 @@ profile xdg-user-dirs-update @{exec_path} {
owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/ w,
owner @{HOME}/@{XDG_TEMPLATES_DIR}/ w,
owner @{HOME}/@{XDG_VIDEOS_DIR}/ w,
owner @{user_config_dirs}/ w,
owner @{user_config_dirs}/user-dirs.dirs rw,
owner @{user_config_dirs}/user-dirs.dirs@{rand6} rw,

6
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -19,6 +19,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
capability dac_override,
capability dac_read_search,
capability fowner,
capability fsetid,
capability kill,
capability net_admin,
capability setgid,
@ -107,5 +108,10 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
/dev/tty rw,
/dev/tty@{int} rw,
# Add user; set password on first login
/etc/.pwd.lock wk,
/etc/nshadow rw,
/etc/shadow w,
include if exists <local/gdm-session-worker>
}

1
apparmor.d/groups/gnome/gnome-control-center
View file

@ -132,6 +132,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.cat_installer/ca.pem r,
owner @{HOME}/.cert/nm-openvpn/*.pem r,
owner @{HOME}/.face r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_cache_dirs}/gnome-control-center/{,**} rw,
owner @{user_cache_dirs}/thumbnails/{,**} rw,

3
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -153,9 +153,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{lib}/gnome-session-failed rix,
@{lib}/gsd-* rPx,
# TODO: rCx gio-launch-desktop and put all the following program in this
# subprofile. Not done yet as it breaks compatibility with Ubuntu/Debian
@{lib}/gio-launch-desktop rix,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
@{bin}/aa-notify rPx,
@{bin}/baloo_file rPx,

6
apparmor.d/groups/gnome/gnome-shell
View file

@ -473,6 +473,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{bin}/Xwayland rPx,
@{lib}/polkit-1/polkit* rPx,
@{lib}/* rPUx,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
/usr/share/gnome-shell/extensions/ding@rastersoft.com/ding.js rPx,
@ -506,8 +507,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/.flatpak-info r,
/etc/fstab r,
/etc/udev/hwdb.bin r,
/etc/pipewire/client.conf.d/{,**} r,
/etc/timezone r,
/etc/udev/hwdb.bin r,
/etc/xdg/menus/gnome-applications.menu r,
/var/lib/gdm{3,}/.cache/ w,
@ -542,6 +544,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/var/lib/snapd/desktop/icons/{,**} r,
owner @{HOME}/.face r,
owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
owner @{HOME}/.var/app/**/ r,
owner @{HOME}/.var/app/**.{png,jpg,svg} r,
@ -555,6 +558,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/ibus/ w,
owner @{user_config_dirs}/monitors.xml{,~} rwl,
owner @{user_config_dirs}/pulse/ r,
owner @{user_config_dirs}/pulse/ w, # change to 'c'
owner @{user_config_dirs}/tiling-assistant/{,**} rw,
owner @{user_share_dirs}/backgrounds/{,**} rw,

4
apparmor.d/groups/gnome/gnome-software
View file

@ -61,6 +61,8 @@ profile gnome-software @{exec_path} {
/var/cache/app-info/xmls/{,**} r,
/var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r,
/var/lib/apt/lists/*.yml.gz r,
/var/lib/flatpak/app/{,**} r,
/var/lib/flatpak/appstream/{,**} r,
/var/lib/flatpak/repo/{,**} r,
@ -68,6 +70,8 @@ profile gnome-software @{exec_path} {
/var/lib/PackageKit/offline-update-competed r,
/var/lib/PackageKit/prepared-update r,
/var/lib/swcatalog/icons/**.png r,
/var/lib/swcatalog/yaml/ r,
/var/tmp/flatpak-cache-*/ rw,
/var/tmp/flatpak-cache-*/** rwkl,

8
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -29,6 +29,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{bin}/pkexec rPx,
/usr/share/gnome-system-monitor/{,**} r,
/usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
# freedesktop.org-strict
/usr/share/pixmaps/{,**} r,
@ -40,13 +41,14 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
/var/lib/snapd/desktop/icons/ r,
owner @{run}/user/@{uid}/doc/ rw,
owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
@{run}/systemd/sessions/* r,
@{run}/systemd/sessions/*.ref r,
@{sys}/devices/@{pci}/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/collisions r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/tx_{bytes,errors,packets} r,

2
apparmor.d/groups/gnome/gsd-color
View file

@ -125,6 +125,8 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
/usr/share/mime/mime.cache r,
/usr/share/X11/xkb/** r,
/etc/timezone r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/.local/share/icc/ rw,

7
apparmor.d/groups/gnome/tracker-extract
View file

@ -95,10 +95,14 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
/etc/fstab r,
/etc/libva.conf r,
# dri-common-strict
/usr/share/drirc.d/{,*.conf} r,
/var/lib/gdm{3,}/.cache/ rw,
/var/lib/gdm{3,}/.cache/tracker3/{,**} rw,
/var/lib/gdm{3,}/.cache/gstreamer-1.0/ rw,
/var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/lightdm/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} r,
@ -130,6 +134,9 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
@{run}/mount/utab r,
@{sys}/devices/pci[0-9]*/*/vendor r,
@{sys}/devices/pci[0-9]*/*/device r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,

2
apparmor.d/groups/gnome/tracker-miner
View file

@ -77,6 +77,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
/etc/fstab r,
/etc/blkid.conf r,
/etc/timezone r,
/var/lib/flatpak/exports/share/applications/{,mimeinfo.cache} r,
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
@ -84,6 +85,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm{3,}/ r,
/var/lib/gdm{3,}/.cache/tracker3/{,tracker3/}files/{,**} rwk,
/var/lib/gdm{3,}/.local/share/applications/ r,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/lightdm/.config/dconf/user r,

1
apparmor.d/groups/network/nm-dispatcher
View file

@ -77,6 +77,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
/etc/network/if-*.d/ r,
/etc/network/if-*.d/* rPUx,
/etc/wpa_supplicant/ifupdown.sh rPUx,
include if exists <local/anacron_run_parts>
}

3
apparmor.d/groups/ssh/ssh-agent-launch
View file

@ -17,10 +17,11 @@ profile ssh-agent-launch @{exec_path} {
@{bin}/grep rix,
@{bin}/ssh-agent rPx,
/etc/X11/Xsession.options r,
profile dbus {
include <abstractions/base>
@{bin}/dbus-update-activation-environment mr,
include if exists <local/ssh-agent-launch_dbus>

2
apparmor.d/groups/systemd/systemd-oomd
View file

@ -33,7 +33,7 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
@{sys}/fs/cgroup/cgroup.controllers r,
@{sys}/fs/cgroup/memory.pressure r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}0.service/memory.* r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/memory.* r,
@{PROC}/pressure/{cpu,io,memory} r,

7
apparmor.d/groups/systemd/systemd-shutdown
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-shutdown
profile systemd-shutdown @{exec_path} flags=(complain) {
profile systemd-shutdown @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
@ -17,7 +17,8 @@ profile systemd-shutdown @{exec_path} flags=(complain) {
capability sys_ptrace,
capability sys_resource,
signal (send) set=(stop, cont, term, kill),
signal (send) set=(stop, cont, term, kill),
signal (receive) set=(rtmin+23) peer=plymouthd,
@{exec_path} mr,
@ -29,5 +30,7 @@ profile systemd-shutdown @{exec_path} flags=(complain) {
owner @{PROC}/sys/kernel/core_pattern w,
owner @{PROC}/sys/kernel/printk rw,
/dev/watchdog@{int} w,
include if exists <local/systemd-shutdown>
}

10
apparmor.d/groups/ubuntu/software-properties-dbus
View file

@ -35,15 +35,19 @@ profile software-properties-dbus @{exec_path} {
@{bin}/python3.[0-9]* rix,
@{bin}/env rix,
@{bin}/apt-key rPx, # Changing trusted keys
@{bin}/lsb_release rPx -> lsb_release,
/etc/apt/apt.conf.d/10periodic w,
/etc/apt/sources.list{,.save} rw,
/usr/share/python-apt/{,**} r,
/usr/share/distro-info/*.csv r,
/usr/share/xml/iso-codes/{,**} r,
owner /tmp/[a-z0-9]* rw,
owner /tmp/_[a-z0-9]* rw,
owner /tmp/tmp*/{,apt.conf} rw,
owner /tmp/???????? rw,
owner /tmp/tmp????????/ w, # change to 'c'
owner /tmp/tmp????????/apt.conf w,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,

10
apparmor.d/groups/ubuntu/software-properties-gtk
View file

@ -40,6 +40,7 @@ profile software-properties-gtk @{exec_path} {
@{bin}/ r,
@{bin}/python3.[0-9]* r,
@{bin}/{,da,ba}sh rix,
@{bin}/aplay rPx,
@{bin}/apt-key rPx,
@ -49,7 +50,6 @@ profile software-properties-gtk @{exec_path} {
@{bin}/ubuntu-advantage rPx,
/usr/share/distro-info/*.csv r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/mime/mime.cache r,
/usr/share/pixmaps/ r,
@ -59,6 +59,7 @@ profile software-properties-gtk @{exec_path} {
/usr/share/ubuntu-drivers-common/detect/{,**} r,
/usr/share/X11/xkb/{,**} r,
/usr/share/xml/iso-codes/{,**} r,
/usr/share/software-properties/gtkbuilder/* r,
/etc/apport/blacklist.d/{,*} r,
/etc/default/apport r,
@ -70,8 +71,11 @@ profile software-properties-gtk @{exec_path} {
/var/lib/snapd/desktop/icons/ r,
/var/lib/ubuntu-advantage/status.json r,
owner /tmp/[a-z0-9]* rw,
owner /tmp/tmp*/{,apt.conf} rw,
owner /tmp/???????? rw,
owner /tmp/tmp????????/ rw, # change to 'c'
owner /tmp/tmp????????/apt.conf rw,
owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
@{sys}/devices/ r,
@{sys}/devices/**/ r,

4
apparmor.d/profiles-a-f/adduser
View file

@ -16,6 +16,8 @@ profile adduser @{exec_path} {
capability chown,
capability dac_override,
capability dac_read_search,
capability setuid,
capability setgid,
capability fowner,
capability fsetid,
@ -40,6 +42,8 @@ profile adduser @{exec_path} {
/etc/adduser.conf r,
/etc/skel/{,.*} r,
@{run}/adduser wk,
# To create user dirs and copy files from /etc/skel/ to them
@{HOME}/ rw,
@{HOME}/.* w,

6
apparmor.d/profiles-a-f/augenrules
View file

@ -18,8 +18,8 @@ profile augenrules @{exec_path} {
@{bin}/chmod rix,
@{bin}/cmp rix,
@{bin}/cp rix,
@{bin}/gawk rix,
@{bin}/grep rix,
@{bin}/{,g,m}awk rix,
@{bin}/{,e,f}grep rix,
@{bin}/ls rix,
@{bin}/mktemp rix,
@{bin}/rm rix,
@ -27,7 +27,7 @@ profile augenrules @{exec_path} {
/etc/audit/audit.rules rw,
/etc/audit/rules.d/{,*} r,
owner /tmp/aurules.* rw,
owner /tmp/aurules.@{rand8} rw,
/dev/tty rw,

34
apparmor.d/profiles-a-f/chpasswd Normal file
View file

@ -0,0 +1,34 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
include <tunables/global>
@{exec_path} = @{bin}/chpasswd
profile chpasswd @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability chown,
capability fsetid,
capability setuid,
signal (receive) set=(term, kill) peer=gnome-control-center,
@{exec_path} mr,
/etc/.pwd.lock wk,
/etc/login.defs r,
/etc/shadow rw,
/etc/shadow.@{int} w,
/etc/shadow.lock w, # change to 'd'
/etc/shadow.lock l -> /etc/shadow.@{int},
/etc/shadow- w,
/etc/shadow+ rw,
/etc/passwd rw,
/etc/passwd.@{int} w,
/etc/passwd.lock w, # change to 'd'
/etc/passwd.lock l -> /etc/passwd.@{int},
include if exists <local/chpasswd>
}

2
apparmor.d/profiles-a-f/cups-browsed
View file

@ -65,5 +65,7 @@ profile cups-browsed @{exec_path} {
@{run}/cups/certs/* r,
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
include if exists <local/cups-browsed>
}

2
apparmor.d/profiles-g-l/ifup
View file

@ -56,6 +56,7 @@ profile ifup @{exec_path} {
/etc/network/if-down.d/ r,
/etc/network/if-down.d/resolvconf rPUx,
/etc/network/if-down.d/resolved rPUx,
/etc/network/if-down.d/openvpn rPUx,
/etc/network/if-down.d/wpasupplicant rPUx,
/etc/wpa_supplicant/ifupdown.sh rPUx,
@ -84,6 +85,7 @@ profile ifup @{exec_path} {
/etc/network/if-up.d/ r,
/etc/network/if-up.d/*resolvconf rPUx,
/etc/network/if-up.d/resolved rPUx,
/etc/network/if-up.d/chrony rPUx,
/etc/network/if-up.d/ethtool rPUx,
/etc/network/if-up.d/ifenslave rPUx,

5
apparmor.d/profiles-m-r/packagekitd
View file

@ -120,6 +120,9 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
/usr/** rwlk -> /usr/**,
/var/** rwlk -> /var/**,
/tmp/apt-changelog-@{rand6}/ w,
/tmp/apt-changelog-@{rand6}/*.changelog rw,
owner /tmp/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw,
owner /tmp/packagekit* rw,
@{run}/systemd/inhibit/*.ref rw,
@ -137,7 +140,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/mountinfo r,
@{PROC}/sys/kernel/random/uuid r,
owner @{PROC}/@{pid}/cmdline r,
@{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,

2
apparmor.d/profiles-s-z/wireplumber
View file

@ -58,6 +58,8 @@ profile wireplumber @{exec_path} {
@{sys}/devices/pci[0-9]*/**/modalias r,
@{sys}/devices/pci[0-9]*/**/video4linux/video[0-9]*/uevent r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,