mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): update kde profiles.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-07-04 21:38:46 +01:00
parent 897bda824f
commit dcf92e8e88
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
15 changed files with 94 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apparmor.d/groups/bus/dbus-session
View File

@ -11,7 +11,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/dbus-run-session
@{exec_path} = @{bin}/dbus-run-session @{bin}/dbus-update-activation-environment
@{exec_path} += @{bin}/dbus-broker @{bin}/dbus-broker-launch
@{exec_path} += @{bin}/dbus-daemon @{lib}/dbus-1{,.0}/dbus-daemon-launch-helper
profile dbus-session flags=(attach_disconnected) {

11
apparmor.d/groups/kde/DiscoverNotifier
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}DiscoverNotifier
profile DiscoverNotifier @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/graphics>
include <abstractions/kde-strict>
include <abstractions/nameservice-strict>
@ -41,7 +42,7 @@ profile DiscoverNotifier @{exec_path} {
/var/cache/swcatalog/cache/ w,
owner @{user_cache_dirs}/appstream/ r,
owner @{user_cache_dirs}/appstream/** r,
owner @{user_cache_dirs}/appstream/** rw,
owner @{user_cache_dirs}/flatpak/{,**} rw,
owner @{user_cache_dirs}/icon-cache.kcache rw,
@ -53,7 +54,9 @@ profile DiscoverNotifier @{exec_path} {
owner @{user_share_dirs}/flatpak/{,**} rw,
owner @{tmp}/ostree-gpg-*/ rw,
owner @{tmp}/ostree-gpg-@{rand6}/ rw,
owner @{tmp}/ostree-gpg-@{rand6}/pubring.gpg rw,
owner @{tmp}/ostree-gpg-@{rand6}/trustdb.gpg rw,
/dev/tty r,
@ -67,8 +70,8 @@ profile DiscoverNotifier @{exec_path} {
@{HOME}/@{XDG_GPG_DIR}/*.conf r,
@{tmp}/ r,
owner @{tmp}/ostree-gpg-*/ r,
owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
owner @{tmp}/ostree-gpg-@{rand6}/ r,
owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-*/**,
owner @{run}/user/@{uid}/gnupg/ w,

3
apparmor.d/groups/kde/baloo
View File

@ -42,6 +42,9 @@ profile baloo @{exec_path} {
owner @{user_share_dirs}/baloo/{,**} rwk,
@{sys}/bus/ r,
@{sys}/bus/*/devices/ r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/mountinfo r,

3
apparmor.d/groups/kde/dolphin
View File

@ -86,6 +86,9 @@ profile dolphin @{exec_path} {
owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int},
owner @{run}/user/@{uid}/#@{int} rw,
@{sys}/bus/ r,
@{sys}/bus/*/devices/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,

4
apparmor.d/groups/kde/drkonqi-coredump-processor
View File

@ -24,9 +24,9 @@ profile drkonqi-coredump-processor @{exec_path} {
/{run,var}/log/journal/ r,
/{run,var}/log/journal/@{hex32}/ r,
/{run,var}/log/journal/@{hex32}/system.journal r,
/{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal r,
/{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* r,
/{run,var}/log/journal/@{hex32}/user-@{uid}.journal r,
/{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal r,
/{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* r,
/{run,var}/log/journal/remote/ r,
include if exists <local/drkonqi-coredump-processor>

2
apparmor.d/groups/kde/kbuildsycoca5
View File

@ -15,7 +15,7 @@ profile kbuildsycoca5 @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
owner @{user_cache_dirs}/ksycoca5_* rw,
owner @{user_cache_dirs}/ksycoca{5,6}_* rw,
owner link @{user_cache_dirs}/ksycoca5_* -> @{user_cache_dirs}/#@{int},
/dev/tty r,

3
apparmor.d/groups/kde/kde-systemd-start-condition
View File

@ -16,6 +16,9 @@ profile kde-systemd-start-condition @{exec_path} {
/usr/share/desktop-base/kf{5,6}-settings/baloofilerc r,
owner @{user_config_dirs}/baloofilerc r,
owner @{user_config_dirs}/kalendaracrc r,
owner @{user_config_dirs}/kgpgrc r,
owner @{user_config_dirs}/kmixrc r,
owner @{user_config_dirs}/konquerorrc r,
owner @{user_config_dirs}/plasma-welcomerc r,

1
apparmor.d/groups/kde/kded
View File

@ -157,6 +157,7 @@ profile kded @{exec_path} {
@{PROC}/@{pids}/fdinfo/@{int} r,
@{PROC}/@{pids}/fd/info/@{int} r,
@{PROC}/sys/fs/inotify/max_user_{instances,watches} r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,

8
apparmor.d/groups/kde/kglobalacceld
View File

@ -18,10 +18,16 @@ profile kglobalacceld @{exec_path} {
/usr/share/kglobalaccel/{,**} r,
/etc/machine-id r,
/etc/xdg/menus/ r,
owner @{user_cache_dirs}/ksycoca{5,6}_* rw,
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/kglobalshortcutsrc* rwl,
owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk,
owner @{user_config_dirs}/kglobalshortcutsrc* rwl,
owner @{user_config_dirs}/khotkeysrc r,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
/dev/tty r,

2
apparmor.d/groups/kde/ksmserver
View File

@ -57,7 +57,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{user_config_dirs}/ksmserverrc.@{rand6} rwl,
owner @{user_config_dirs}/ksmserverrc.lock rwk,
owner @{user_config_dirs}/menus/ r,
# owner @{user_config_dirs}/session/*_[0-9]*_[0-9]*_[0-9]* rw,
owner @{user_config_dirs}/session/*_[0-9]*_[0-9]*_[0-9]* rw,
owner @{user_share_dirs}/kservices{5,6}/ r,
owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r,

13
apparmor.d/groups/kde/kwin_x11
View File

@ -14,6 +14,7 @@ profile kwin_x11 @{exec_path} {
include <abstractions/kde-strict>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
include <abstractions/thumbnails-cache-read>
network inet dgram,
network inet6 dgram,
@ -32,30 +33,34 @@ profile kwin_x11 @{exec_path} {
/usr/share/plasma/desktoptheme/{,**} r,
/etc/machine-id r,
/etc/xdg/kcminputrc r,
/etc/xdg/plasmarc r,
owner @{user_cache_dirs}/ r,
owner @{user_cache_dirs}/#@{int} rw,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_cache_dirs}/kcrash-metadata/*.ini rw,
owner @{user_cache_dirs}/ksvg-elements r,
owner @{user_cache_dirs}/kwin/{,**} rwl,
owner @{user_cache_dirs}/plasmarc r,
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
owner @{user_cache_dirs}/plasma-svgelements rw,
owner @{user_cache_dirs}/plasma-svgelements.@{rand6} rwl -> @{user_cache_dirs}/#@{int},
owner @{user_cache_dirs}/plasma-svgelements.lock rwk,
owner @{user_cache_dirs}/plasmarc r,
owner @{user_cache_dirs}/session/#@{int} rw,
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/kcminputrc r,
owner @{user_config_dirs}/kdedefaults/plasmarc r,
owner @{user_config_dirs}/kwinoutputconfig.json r,
owner @{user_config_dirs}/kwinrc.lock rwk,
owner @{user_config_dirs}/kwinrc{,.@{rand6}} rwl,
owner @{user_config_dirs}/kwinrulesrc r,
owner @{user_config_dirs}/kxkbrc r,
owner @{user_config_dirs}/session/kwin_* rwk,
owner @{user_config_dirs}/plasmarc r,
owner @{user_config_dirs}/session/#@{int} rw,
owner @{user_config_dirs}/session/kwin_* rwk,
owner @{user_share_dirs}/kwin/scripts/ r,
owner @{tmp}/#@{int} rw,
owner @{tmp}/kwin.@{rand6} rwl,

3
apparmor.d/groups/kde/plasmashell
View File

@ -56,6 +56,9 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
#aa:exec kioworker
/opt/**/share/icons/{,**} r,
/opt/*/**/*.desktop r,
/opt/*/**/*.png r,
/usr/share/akonadi/{,**} r,
/usr/share/desktop-base/{,**} r,
/usr/share/desktop-directories/kf5-*.directory r,

1
apparmor.d/groups/kde/sddm
View File

@ -88,6 +88,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/xmodmap rix,
@{bin}/dbus-run-session rPx -> dbus-session,
@{bin}/dbus-update-activation-environment rPx -> dbus-session,
@{bin}/flatpak rPx,
@{bin}/gnome-keyring-daemon rPx,
@{bin}/kwalletd{5,6} rPx,

40
apparmor.d/groups/kde/systemsettings
View File

@ -14,14 +14,27 @@ profile systemsettings @{exec_path} {
include <abstractions/kde-strict>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
include <abstractions/thumbnails-cache-write>
network netlink raw,
signal send set=term peer=kioworker,
@{exec_path} mr,
@{bin}/cat rix,
@{bin}/kcminit rPx,
@{bin}/lspci rPx,
@{bin}/openssl rix,
@{bin}/pactl rPx,
@{bin}/plasma-discover rPx,
@{bin}/plasmashell rPx,
@{bin}/xdpyinfo rPUx,
@{lib}/qt{5,6}/bin/qdbus rPx,
#aa:exec kioworker
/usr/share/kcm_networkmanagement/{,**} r,
/usr/share/kcm_recentFiles/{,**} r,
/usr/share/kcmkeys/{,*.kksrc} r,
/usr/share/kglobalaccel/* r,
/usr/share/kinfocenter/{,**} r,
@ -29,15 +42,18 @@ profile systemsettings @{exec_path} {
/usr/share/kpackage/{,**} r,
/usr/share/kservices{5,6}/{,**} r,
/usr/share/kservicetypes5/{,**} r,
/usr/share/kwin/{,**} r,
/usr/share/kxmlgui5/systemsettings/systemsettingsui.rc r,
/usr/share/plasma/{,**} r,
/usr/share/sddm/themes/{,**} r,
/usr/share/sddm/themes/{,**} r,
/usr/share/systemsettings/{,**} r,
/usr/share/wallpapers/{,**} r,
/etc/fstab r,
/etc/machine-id r,
/etc/xdg/menus/{,applications-merged/} r,
/etc/xdg/plasmanotifyrc r,
/etc/xdg/ui/ui_standards.rc r,
/var/lib/dbus/machine-id r,
@ -52,23 +68,35 @@ profile systemsettings @{exec_path} {
owner @{user_cache_dirs}/systemsettings/ rw,
owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**,
owner @{user_config_dirs}/{P,p}lasma* r,
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/khotkeysrc r,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/plasmarc r,
owner @{user_config_dirs}/kactivitymanagerdrc r,
owner @{user_config_dirs}/kde.org/{,**} rwlk,
owner @{user_config_dirs}/kdedefaults/kscreenlockerrc r,
owner @{user_config_dirs}/kdedefaults/plasmarc r,
owner @{user_config_dirs}/khotkeysrc r,
owner @{user_config_dirs}/kinfocenterrc* rwlk,
owner @{user_config_dirs}/kscreenlockerrc r,
owner @{user_config_dirs}/kxkbrc r,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_config_dirs}/plasmarc r,
owner @{user_config_dirs}/session/ rw,
owner @{user_config_dirs}/session/** rwlk,
owner @{user_config_dirs}/systemsettingsrc.lock rwk,
owner @{user_config_dirs}/systemsettingsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
owner @{user_share_dirs}/kservices5/{,ServiceMenus/} r,
owner @{user_share_dirs}/kactivitymanagerd/resources/database rk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database rwk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw,
owner @{user_share_dirs}/kinfocenter/ rw,
owner @{user_share_dirs}/kinfocenter/** rwlk,
owner @{user_share_dirs}/knotifications{5,6}/{,**} r,
owner @{user_share_dirs}/krdpserver/ rw,
owner @{user_share_dirs}/kservices{5,6}/{,ServiceMenus/} r,
owner @{user_share_dirs}/systemsettings/ rw,
owner @{user_share_dirs}/systemsettings/** rwlk,
owner @{user_share_dirs}/wallpapers/{,**} r,
@{sys}/bus/ r,
@{sys}/bus/cpu/devices/ r,

18
apparmor.d/profiles-m-r/qdbus Normal file
View File

@ -0,0 +1,18 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/qdbus @{lib}/qt{5,6}/bin/qdbus
profile qdbus @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/qdbus>
}
# vim:syntax=apparmor