mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profiles): add firefox glxtest & vaapitest profiles.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-07-12 21:59:13 +01:00
parent 1eda41dbc6
commit db35aa9249
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
5 changed files with 71 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apparmor.d/groups/browsers/firefox
View File

@ -134,11 +134,11 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{firefox_lib_dirs}/{,**} r,
@{firefox_lib_dirs}/*.so mr,
@{firefox_lib_dirs}/crashreporter rPx,
@{firefox_lib_dirs}/glxtest rPUx,
@{firefox_lib_dirs}/glxtest rPx,
@{firefox_lib_dirs}/minidump-analyzer rPx,
@{firefox_lib_dirs}/pingsender rPx,
@{firefox_lib_dirs}/plugin-container rPx,
@{firefox_lib_dirs}/vaapitest rPUx,
@{firefox_lib_dirs}/vaapitest rPx,
@{lib}/mozilla/kmozillahelper rPUx,
@{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr,

33
apparmor.d/groups/browsers/firefox-glxtest Normal file
View File

@ -0,0 +1,33 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{firefox_name} = firefox{,.sh,-esr,-bin}
@{firefox_lib_dirs} = @{lib}/@{firefox_name} /opt/@{firefox_name}
@{firefox_config_dirs} = @{HOME}/.mozilla/
@{exec_path} = @{firefox_lib_dirs}/glxtest
profile firefox-glxtest @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/vulkan>
@{exec_path} mr,
owner @{firefox_config_dirs}/firefox/*/.parentlock rw,
owner /tmp/firefox/.parentlock rw,
@{sys}/bus/pci/devices/ r,
@{sys}/devices/pci[0-9]*/**/class r,
include if exists <local/firefox-glxtest>
}

2
apparmor.d/groups/browsers/firefox-pingsender
View File

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{firefox_name} = firefox{,-esr}
@{firefox_name} = firefox{,.sh,-esr,-bin}
@{firefox_lib_dirs} = @{lib}/@{firefox_name}/ /opt/@{firefox_name}/
@{firefox_config_dirs} = @{HOME}/.mozilla/

33
apparmor.d/groups/browsers/firefox-vaapitest Normal file
View File

@ -0,0 +1,33 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{firefox_name} = firefox{,.sh,-esr,-bin}
@{firefox_lib_dirs} = @{lib}/@{firefox_name} /opt/@{firefox_name}
@{exec_path} = @{firefox_lib_dirs}/vaapitest
profile firefox-vaapitest @{exec_path} {
include <abstractions/base>
include <abstractions/dri-enumerate>
include <abstractions/dri-common>
include <abstractions/nvidia>
include <abstractions/vulkan>
@{exec_path} mr,
/etc/igfx_user_feature{,_next}.txt w,
/etc/libva.conf r,
owner @{firefox_config_dirs}/firefox/*/.parentlock rw,
owner @{firefox_config_dirs}/firefox/*/startupCache/*Cache* r,
owner /tmp/firefox/.parentlock rw,
@{sys}/devices/pci[0-9]*/**/{irq,revision,resource} r,
include if exists <local/firefox-vaapitest>
}

2
dists/flags/main.flags
View File

@ -99,7 +99,9 @@ fail2ban-client attach_disconnected,complain
fail2ban-server attach_disconnected,complain
fdisk complain
file-roller complain
firefox-glxtest complain
firefox-kmozillahelper complain
firefox-vaapitest complain
firewalld complain
flatpak-session-helper complain
fsck-ext4 complain