mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(dbus): add initial polkit abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-01 20:42:41 +00:00
parent 7f38dd255e
commit d6888a65c4
Failed to generate hash of commit
16 changed files with 35 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
apparmor.d/abstractions/bus/polkit Normal file
View file

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=polkitd),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization
peer=(name=org.freedesktop.PolicyKit1, label=polkitd),
dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=Changed
peer=(name=:*, label=polkitd),
include if exists <abstractions/bus/polkit.d>

1
apparmor.d/groups/apt/apt
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile apt @{exec_path} flags=(attach_disconnected) { profile apt @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/apt-common> include <abstractions/apt-common>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

1
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,accountsservice/}accounts-daemon @{exec_path} = @{lib}/{,accountsservice/}accounts-daemon
profile accounts-daemon @{exec_path} flags=(attach_disconnected) { profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/wutmp> include <abstractions/wutmp>

1
apparmor.d/groups/freedesktop/colord
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,colord/}colord @{exec_path} = @{lib}/{,colord/}colord
profile colord @{exec_path} flags=(attach_disconnected) { profile colord @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/devices-usb> include <abstractions/devices-usb>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

1
apparmor.d/groups/gnome/gnome-shell
View file

@ -12,6 +12,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/app-launcher-user> include <abstractions/app-launcher-user>
include <abstractions/audio> include <abstractions/audio>
include <abstractions/bus/atspi> include <abstractions/bus/atspi>
include <abstractions/bus/polkit>
include <abstractions/dbus-accessibility-strict> include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-gtk> include <abstractions/dbus-gtk>
include <abstractions/dbus-network-manager-strict> include <abstractions/dbus-network-manager-strict>

1
apparmor.d/groups/network/ModemManager
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/ModemManager @{exec_path} = @{bin}/ModemManager
profile ModemManager @{exec_path} flags=(attach_disconnected) { profile ModemManager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dri-enumerate> include <abstractions/dri-enumerate>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>

1
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-hostnamed @{exec_path} = @{lib}/systemd/systemd-hostnamed
profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/systemd-common> include <abstractions/systemd-common>

1
apparmor.d/profiles-a-f/boltd
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/boltd @{exec_path} = @{lib}/boltd
profile boltd @{exec_path} flags=(attach_disconnected) { profile boltd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

6
apparmor.d/profiles-a-f/fwupd
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,fwupd/}fwupd @{exec_path} = @{lib}/{,fwupd/}fwupd
profile fwupd @{exec_path} flags=(complain,attach_disconnected) { profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/disks-read> include <abstractions/disks-read>
@ -60,11 +61,6 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
member=Changed member=Changed
peer=(label=fwupdmgr), peer=(label=fwupdmgr),
dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties
member={Changed,GetAll}
peer=(label=polkitd),
dbus receive bus=system path=/ dbus receive bus=system path=/
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member={GetAll,SetHints,GetPlugins,GetRemotes} member={GetAll,SetHints,GetPlugins,GetRemotes}

6
apparmor.d/profiles-m-r/pkexec
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile pkexec @{exec_path} { profile pkexec @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/authentication> include <abstractions/authentication>
include <abstractions/bus/polkit>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -36,11 +37,6 @@ profile pkexec @{exec_path} {
member=GetAll member=GetAll
peer=(name=:*), peer=(name=:*),
dbus (send) bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member={EnumerateActions,CheckAuthorization,RegisterAuthenticationAgent,UnregisterAuthenticationAgent}
peer=(name=:*),
dbus (receive) bus=system path=/org/freedesktop/PolicyKit1*/Authority dbus (receive) bus=system path=/org/freedesktop/PolicyKit1*/Authority
interface=org.freedesktop.PolicyKit1*.Authority interface=org.freedesktop.PolicyKit1*.Authority
member=Changed member=Changed

1
apparmor.d/profiles-m-r/pkttyagent
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/pkttyagent @{exec_path} = @{bin}/pkttyagent
profile pkttyagent @{exec_path} { profile pkttyagent @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

1
apparmor.d/profiles-m-r/power-profiles-daemon
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/power-profiles-daemon @{exec_path} = @{lib}/power-profiles-daemon
profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

1
apparmor.d/profiles-s-z/snapd
View file

@ -13,6 +13,7 @@ include <tunables/global>
profile snapd @{exec_path} { profile snapd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/authentication> include <abstractions/authentication>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/disks-write> include <abstractions/disks-write>
include <abstractions/fontconfig-cache-write> include <abstractions/fontconfig-cache-write>

1
apparmor.d/profiles-s-z/system-config-printer
View file

@ -11,6 +11,7 @@ include <tunables/global>
@{exec_path} += /usr/share/system-config-printer/system-config-printer.py @{exec_path} += /usr/share/system-config-printer/system-config-printer.py
profile system-config-printer @{exec_path} flags=(complain) { profile system-config-printer @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/dconf-write> include <abstractions/dconf-write>

1
apparmor.d/profiles-s-z/udisksd
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,udisks2/}udisksd @{exec_path} = @{lib}/{,udisks2/}udisksd
profile udisksd @{exec_path} flags=(attach_disconnected) { profile udisksd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/disks-write> include <abstractions/disks-write>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

5
apparmor.d/profiles-s-z/zsysd
View file

@ -9,16 +9,13 @@ include <tunables/global>
@{exec_path} = @{bin}/zsysd @{bin}/zsysctl @{exec_path} = @{bin}/zsysd @{bin}/zsysctl
profile zsysd @{exec_path} flags=(complain) { profile zsysd @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
capability sys_ptrace, capability sys_ptrace,
capability sys_admin, capability sys_admin,
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization,
@{exec_path} rmix, @{exec_path} rmix,
/{usr/,}{local/,}{s,}bin/zfs rPx, /{usr/,}{local/,}{s,}bin/zfs rPx,
/{usr/,}{local/,}{s,}bin/zpool rPx, /{usr/,}{local/,}{s,}bin/zpool rPx,