mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-30 06:45:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'feat/update' of https://github.com/Jeroen0494/apparmor.d into Jeroen0494-feat/update

Browse source 
* 'feat/update' of https://github.com/Jeroen0494/apparmor.d:
  Cleanup
  Remove temp
  Various updates all over
  Various profile updates
This commit is contained in:
Alexandre Pujol 2024-05-06 20:08:13 +01:00
commit e2c69f18fa
Failed to generate hash of commit
22 changed files with 226 additions and 73 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1
View file

@ -4,12 +4,22 @@
dbus send bus=system path=/fi/w1/wpa_supplicant1
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged}
member={GetAll,PropertiesChanged},Set
peer=(name=:*, label=wpa-supplicant),
dbus send bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int}
interface=org.freedesktop.DBus.Properties
member={GetAll,Set}
peer=(name=:*, label=wpa-supplicant),
dbus send bus=system path=/fi/w1/wpa_supplicant1
interface=fi.w1.wpa_supplicant1.Interface
member=CreateInterface
peer=(name=:*, label=wpa-supplicant),
dbus send bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int}
interface=fi.w1.wpa_supplicant1.Interface
member={Disconnect,RemoveNetwork,Scan}
member={AddNetwork,Disconnect,RemoveNetwork,Scan,SelectNetwork}
peer=(name=:*, label=wpa-supplicant),
dbus send bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int}
@ -17,25 +27,24 @@
member=Cancel
peer=(name=:*, label=wpa-supplicant),
# Unconfined for now, don't know the label yet.
# dbus send bus=system path=/org/freedesktop
# interface=org.freedesktop.DBus.ObjectManager
# member=InterfacesRemoved
# peer=(name=:*, label=unconfined),
dbus receive bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=InterfacesRemoved
peer=(name=:*, label=wpa-supplicant),
dbus receive bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int}
interface=fi.w1.wpa_supplicant1.Interface
member={BSSAdded,BSSRemoved,NetworkRemoved,ScanDone,PropertiesChanged}
member={BSSAdded,BSSRemoved,NetworkAdded,NetworkRemoved,NetworkSelected,ScanDone,PropertiesChanged}
peer=(name=:*, label=wpa-supplicant),
dbus receive bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
member={GetAll,PropertiesChanged}
peer=(name=:*, label=wpa-supplicant),
dbus receive bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int}/BSSs/@{int}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
member={GetAll,PropertiesChanged}
peer=(name=:*, label=wpa-supplicant),
include if exists <abstractions/bus/fi.w1.wpa_supplicant1.d>

13
apparmor.d/abstractions/bus/org.bluez
View file

@ -5,21 +5,21 @@
dbus receive bus=system path=/
interface=org.freedesktop.DBus.ObjectManager
member=InterfacesRemoved
peer=(name=:*, label=bluetoothd),
peer=(name="{:*,org.bluez}", label=bluetoothd),
dbus receive bus=system path=/org/bluez/hci@{int}{,/**}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=bluetoothd),
peer=(name="{:*,org.bluez}", label=bluetoothd),
dbus send bus=system path=/
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=bluetoothd),
peer=(name="{:*,org.bluez}", label=bluetoothd),
dbus send bus=system path=/org/bluez
interface=org.bluez.AgentManager@{int}
member=UnregisterAgent
member={RegisterAgent,RequestDefaultAgent,UnregisterAgent}
peer=(name=org.bluez, label=bluetoothd),
dbus send bus=system path=/org/bluez
@ -27,6 +27,11 @@
member=RegisterProfile
peer=(name=org.bluez, label=bluetoothd),
dbus send bus=system path=/org/bluez/hci@{int}
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name="{:*,org.bluez}", label=bluetoothd),
dbus send bus=system path=/org/bluez/hci@{int}
interface=org.bluez.BatteryProviderManager@{int}
member=RegisterProfile

5
apparmor.d/abstractions/bus/org.freedesktop.ModemManager1
View file

@ -2,6 +2,11 @@
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
dbus send bus=system path=/org/freedesktop/ModemManager1
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=org.freedesktop.ModemManager1, label=ModemManager),
dbus send bus=system path=/org/freedesktop/ModemManager1
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects

31
apparmor.d/abstractions/bus/org.freedesktop.NetworkManager
View file

@ -5,66 +5,71 @@
dbus send bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member={GetDevices,GetPermissions}
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager/Settings
interface=org.freedesktop.NetworkManager.Settings
member=ListConnections
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager/Settings/@{int}
interface=org.freedesktop.NetworkManager.Settings.Connection
member=GetSettings
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/@{int}
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager/Devices/@{int}
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus receive bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=InterfacesAdded
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus receive bus=system path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=CheckPermissions
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=CheckPermissions
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged}
peer=(name=:*, label=NetworkManager),
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
dbus receive bus=system path=/org/freedesktop/NetworkManager/Settings/@{int}
interface=org.freedesktop.NetworkManager.Settings.Connection
member=Updated
peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager),
include if exists <abstractions/bus/org.freedesktop.NetworkManager.d>

20
apparmor.d/abstractions/bus/org.freedesktop.UDisks2
View file

@ -5,51 +5,51 @@
dbus send bus=system path=/org/freedesktop/UDisks2
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus send bus=system path=/org/freedesktop/UDisks2/**
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus send bus=system path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus send bus=system path=/
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus send bus=system path=/org/freedesktop/UDisks2/drives{,/*}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus send bus=system path=/org/freedesktop/UDisks2/drives{,/*}
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus send bus=system path=/org/freedesktop/UDisks2/block_devices/*
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus receive bus=system path=/org/freedesktop/UDisks2
interface=org.freedesktop.DBus.ObjectManager
member=InterfacesAdded
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus receive bus=system path=/org/freedesktop/UDisks2/jobs/@{int}
interface=org.freedesktop.UDisks2.Job
member=Completed
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
dbus receive bus=system path=/org/freedesktop/UDisks2/block_devices/*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=udisksd),
peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd),
include if exists <abstractions/bus/org.freedesktop.UDisks2.d>

16
apparmor.d/abstractions/bus/org.freedesktop.UPower
View file

@ -10,7 +10,7 @@
dbus send bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(name=:*, label=upowerd),
peer=(name="{:*,org.freedesktop.UPower}", label=upowerd),
dbus send bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
@ -21,14 +21,24 @@
member=GetDisplayDevice
peer=(name=org.freedesktop.UPower, label=upowerd),
dbus send bus=system path=/org/freedesktop/UPower/devices/*
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(name="{:*,org.freedesktop.UPower}", label=upowerd),
dbus send bus=system path=/org/freedesktop/UPower/devices/*
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=upowerd),
peer=(name="{:*,org.freedesktop.UPower}", label=upowerd),
dbus receive bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.UPower
member=DeviceAdded
peer=(name="{:*,org.freedesktop.UPower}", label=upowerd),
dbus receive bus=system path=/org/freedesktop/UPower/devices/*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=upowerd),
peer=(name="{:*,org.freedesktop.UPower}", label=upowerd),
include if exists <abstractions/bus/org.freedesktop.UPower.d>

6
apparmor.d/abstractions/bus/org.freedesktop.login1
View file

@ -10,7 +10,7 @@
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=systemd-logind),
peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind),
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
@ -20,12 +20,12 @@
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={SessionNew,SessionRemoved,UserNew,UserRemoved,PrepareFor*}
peer=(name=:*, label=systemd-logind),
peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind),
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=systemd-logind),
peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind),
dbus send bus=system path=/org/freedesktop/login1/session/*
interface=org.freedesktop.login1.Session

1
apparmor.d/groups/_full/bwrap
View file

@ -14,6 +14,7 @@ profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/common/bwrap>
include <abstractions/common/app>
include <abstractions/dbus>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/fontconfig-cache-write>
capability dac_override,

6
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -62,9 +62,9 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
@{bin}/nautilus rPx,
@{bin}/snap rPUx,
@{bin}/kreadconfig5 rPx,
@{lib}/xdg-desktop-portal-validate-icon rPUx,
@{open_path} rPx -> child-open,
@{bin}/kreadconfig5 rPx,
@{lib}/xdg-desktop-portal-validate-icon rPUx,
@{open_path} rPx -> child-open,
/ r,
/.flatpak-info r,

1
apparmor.d/groups/freedesktop/xdg-mime
View file

@ -21,6 +21,7 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
@{bin}/cut rix,
@{bin}/file rix,
@{bin}/head rix,
@{bin}/kbuildsycoca5 rPx,
@{bin}/mv rix,
@{bin}/readlink rix,
@{bin}/realpath rix,

11
apparmor.d/groups/kde/kauth-kded-smart-helper
View file

@ -9,8 +9,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}kded-smart-helper
profile kauth-kded-smart-helper @{exec_path} {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.PolicyKit1>
include <abstractions/nameservice-strict>
# dbus: own bus=system name=org.kde.kded.smart
dbus send bus=system path=/
interface=org.kde.kf5auth
member=remoteSignal
peer=(name=org.freedesktop.DBus, label=kded5),
@{exec_path} mr,
@{bin}/smartctl rPx,
@ -18,4 +27,4 @@ profile kauth-kded-smart-helper @{exec_path} {
/usr/share/icu/@{int}.@{int}/*.dat r,
include if exists <local/kauth-kded-smart-helper>
}
}

30
apparmor.d/groups/kde/kbuildsycoca5 Normal file
View file

@ -0,0 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/kbuildsycoca5
profile kbuildsycoca5 @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
/usr/share/applications/kde-mimeapps.list r,
/usr/share/mime/mime.cache r,
/usr/share/mime/types r,
/var/lib/flatpak/exports/share/mime/types r,
owner @{user_cache_dirs}/ksycoca5_* l -> @{user_cache_dirs}/#@{int},
owner @{user_cache_dirs}/ksycoca5_* rw,
owner @{user_config_dirs}/mimeapps.list r,
owner @{user_share_dirs}/applications/mimeapps.list r,
owner @{user_share_dirs}/mime/types r,
/dev/tty r,
include if exists <local/kbuildsycoca5>
}

33
apparmor.d/groups/kde/kded
View file

@ -34,14 +34,11 @@ profile kded @{exec_path} {
signal (send) set=hup peer=xsettingsd,
dbus receive bus=system path=/org/freedesktop/NetworkManager/SecretAgent
interface=org.freedesktop.NetworkManager.SecretAgent
member=CancelGetSecrets
peer=(label=NetworkManager),
# dbus: own bus=system name=com.redhat.NewPrinterNotification
dbus receive bus=system path=/org/freedesktop/NetworkManager/SecretAgent
interface=org.freedesktop.NetworkManager.SecretAgent
member=CancelGetSecrets
member={GetSecrets,CancelGetSecrets}
peer=(label=NetworkManager),
dbus receive bus=system path=/org/freedesktop/NetworkManager/AccessPoint/@{int}
@ -58,6 +55,30 @@ profile kded @{exec_path} {
interface=org.freedesktop.NetworkManager.AgentManager
peer=(label=NetworkManager),
dbus send bus=system path=/org/freedesktop/NetworkManager/AgentManager
interface=org.freedesktop.NetworkManager.AgentManager
peer=(label=NetworkManager),
dbus send bus=system path=/org/freedesktop/bolt
interface=org.freedesktop.bolt1.Manager
member=ListDevices
peer=(name="{:*,org.freedesktop.bolt}", label=boltd),
dbus send bus=system path=/org/freedesktop/bolt{,/**}
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name="{:*,org.freedesktop.bolt}", label=boltd),
dbus receive bus=system path=/
interface=org.kde.kf5auth
member=remoteSignal
peer=(name=:*, label=kauth-kded-smart-helper),
dbus send bus=system path=/
interface=org.kde.kf5auth
member=performAction
peer=(name="{:*,org.kde.kded.smart}", label=kauth-kded-smart-helper),
@{exec_path} mrix,
@{bin}/kcminit rPx,
@ -141,7 +162,7 @@ profile kded @{exec_path} {
owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl,
owner @{user_config_dirs}/xsettingsd/{,**} rw,
@{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int},
owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int},
owner @{user_share_dirs}/icc/{,edid-*} r,
owner @{user_share_dirs}/kcookiejar/#@{int} rw,
owner @{user_share_dirs}/kcookiejar/cookies.lock rwk,

6
apparmor.d/groups/kde/ksmserver
View file

@ -18,6 +18,8 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
signal (send) set=(usr1,term) peer=kscreenlocker-greet,
ptrace (read) peer=kbuildsycoca5,
unix (send, receive) type=stream peer=(label="kscreenlocker-greet",addr=none),
@{exec_path} mr,
@ -36,10 +38,10 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/usr/share/kservices{5,6}/{,**} r,
/usr/share/kservicetypes{5,6}/{,**} r,
/etc/xdg/menus/applications-merged/ r,
/etc/xdg/menus/applications-merged/{,*} r,
/etc/machine-id r,
/etc/xdg/kscreenlockerrc r,
/etc/xdg/menus/ r,
/etc/xdg/menus/{,*} r,
owner @{HOME}/@{rand6} rw,
owner @{HOME}/.Xauthority rw,

7
apparmor.d/groups/kde/plasmashell
View file

@ -44,9 +44,10 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
@{exec_path} mr,
@{lib}/libheif/{,**} mr,
@{bin}/dolphin rPUx,
@{lib}/libheif/ r,
@{lib}/libheif/{,**} mr,
@{lib}/kf5/kdesu{,d} rix,
@{bin}/dolphin rPUx, # TODO: rPx,
@{bin}/ksysguardd rix,
@{bin}/plasma-discover rPUx,
@{bin}/xrdb rPx,

22
apparmor.d/groups/kde/sddm-xsession
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /etc/sddm/Xsession
profile sddm-xsession @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/shells>
@ -25,14 +26,17 @@ profile sddm-xsession @{exec_path} {
@{bin}/csh rix,
@{bin}/date rix,
@{bin}/fish rix,
@{bin}/id rix,
@{bin}/gettext.sh r,
@{bin}/gpgconf rCx -> gpg,
@{bin}/id rix,
@{bin}/locale rix,
@{bin}/locale-check rix,
@{bin}/mktemp rix,
@{bin}/mv rix,
@{bin}/rm rix,
@{bin}/sed rix,
@{bin}/stat rix,
@{bin}/tail rix,
@{bin}/mv rix,
@{bin}/locale-check rPx,
@{bin}/mktemp rix,
@{bin}/rm rix,
@{bin}/tcsh rix,
@{bin}/tempfile rix,
@{bin}/touch rix,
@ -57,12 +61,18 @@ profile sddm-xsession @{exec_path} {
/etc/default/{,*} r,
/etc/X11/{,**} r,
owner @{HOME}/.xsession-errors w,
owner @{HOME}/.xinputrc r,
owner @{HOME}/.xsession-errors rw,
@{HOME}/tmp.* rw,
@{system_share_dirs}/im-config/data/{,*} r,
@{system_share_dirs}/im-config/xinputrc.common r,
owner @{user_share_dirs}/sddm/xorg-session.log w,
owner @{tmp}/xsess-env-* rw,
owner @{tmp}/file* rw,
owner @{tmp}/tmp.* rw,
owner @{PROC}/@{pid}/loginuid r,

18
apparmor.d/groups/kde/startplasma
View file

@ -11,6 +11,7 @@ profile startplasma @{exec_path} {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/kde-strict>
include <abstractions/bus-session>
signal (receive) set=(hup) peer=@{p_systemd},
signal (receive) set=(term) peer=sddm,
@ -20,12 +21,17 @@ profile startplasma @{exec_path} {
@{sh_path} rix,
@{bin}/env rix,
@{bin}/{,ba,da}sh rix,
@{bin}/env rix,
@{bin}/grep rix,
@{bin}/kapplymousetheme rPUx,
@{bin}/ksplashqml rPUx,
@{bin}/plasma_session rPx,
@{bin}/xrdb rPx,
@{bin}/xsetroot rPx,
@{lib}/@{multiarch}/libexec/plasma-sourceenv.sh r,
/usr/share/color-schemes/{,**} r,
/usr/share/desktop-directories/{,**} r,
/usr/share/knotifications{5,6}/{,**} r,
@ -33,10 +39,16 @@ profile startplasma @{exec_path} {
/usr/share/kservicetypes5/{,**} r,
/usr/share/plasma/{,**} r,
/etc/locale.alias r,
/etc/machine-id r,
/etc/xdg/kcminputrc r,
/etc/xdg/menus/{,**} r,
/etc/xdg/plasma-workspace/env/{,**} r,
/etc/xdg/plasma-workspace/env/{,*} r,
/var/lib/flatpak/exports/share/mime/ r,
@{HOME}/ r,
@{HOME}/.xsession-errors w,
@{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int},
owner @{user_cache_dirs}/#@{int} rwk,
@ -71,7 +83,9 @@ profile startplasma @{exec_path} {
owner @{run}/user/@{uid}/ r,
@{PROC}/sys/kernel/core_pattern r,
@{PROC}/sys/kernel/core_pattern r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/maps r,
/dev/tty r,
/dev/tty@{int} rw,

13
apparmor.d/groups/kde/systemsettings
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/systemsettings
profile systemsettings @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/graphics>
include <abstractions/kde-strict>
include <abstractions/nameservice-strict>
@ -20,6 +21,8 @@ profile systemsettings @{exec_path} {
@{bin}/kcminit rPx,
/usr/share/kglobalaccel/org.kde.krunner.desktop r,
/usr/share/kcmkeys/{,*.kksrc} r,
/usr/share/kcm_networkmanagement/{,**} r,
/usr/share/kinfocenter/{,**} r,
/usr/share/kpackage/{,**} r,
@ -29,10 +32,14 @@ profile systemsettings @{exec_path} {
/usr/share/plasma/{,**} r,
/usr/share/sddm/themes/{,**} r,
/usr/share/systemsettings/{,**} r,
/usr/share/kinfocenter/{,**} r,
/usr/share/sddm/themes/{,**} r,
/var/lib/flatpak/exports/share/mime/ r,
/etc/fstab r,
/etc/machine-id r,
/etc/xdg/menus/ r,
/etc/xdg/menus/{,applications-merged/} r,
/etc/xdg/ui/ui_standards.rc r,
/var/lib/dbus/machine-id r,
@ -48,12 +55,16 @@ profile systemsettings @{exec_path} {
owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**,
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/khotkeysrc r,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/plasmarc r,
owner @{user_config_dirs}/kde.org/{,**} rwlk,
owner @{user_config_dirs}/kdedefaults/plasmarc r,
owner @{user_config_dirs}/kinfocenterrc* rwlk,
owner @{user_config_dirs}/systemsettingsrc.lock rwk,
owner @{user_config_dirs}/systemsettingsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
owner @{user_share_dirs}/kservices5/{,ServiceMenus/} r,
owner @{user_share_dirs}/kactivitymanagerd/resources/database rk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw,

23
apparmor.d/groups/network/nm-dispatcher
View file

@ -22,12 +22,18 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=system name=org.freedesktop.nm_dispatcher
dbus send bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=NetworkManager),
@{exec_path} mr,
@{sh_path} rix,
@{bin}/basename rix,
@{bin}/cat rix,
@{bin}/chronyc rPUx,
@{bin}/chown rix,
@{bin}/date rix,
@{bin}/gawk rix,
@{bin}/grep rix,
@ -52,15 +58,21 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
/etc/NetworkManager/dispatcher.d/** rix,
/etc/dhcp/dhclient-exit-hooks.d/ntp r,
# chown
/ r,
/usr/share/tlp/{,**} rw,
/etc/sysconfig/network/config r,
/etc/fstab r,
@{run}/systemd/notify rw,
@{run}/tlp/{,*} rw,
@{run}/chrony-dhcp/ rw,
@{run}/ntp.conf.dhcp rw,
@{run}/chrony-dhcp/ rw,
@{run}/ntp.conf.dhcp rw,
@{run}/systemd/netif/leases/ r,
@{run}/systemd/notify rw,
@{run}/tlp/{,*} rw,
owner @{run}/ntp.conf.dhcp.@{rand6} rw,
owner /etc/ntp.conf r,
@{sys}/class/net/ r,
@ -85,8 +97,11 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
profile invoke-rc {
include <abstractions/base>
@{bin}/invoke-rc.d rm,
@{sh_path} rix,
@{bin}/basename rix,
@{bin}/ls rix,
# This doesn't seem to work, profile transition not found.
@{bin}/systemctl rCx -> systemctl,
/ r,

3
apparmor.d/profiles-a-f/flatpak-app
View file

@ -55,8 +55,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
@{bin}/update-mime-database rPx -> flatpak-app//&update-mime-database,
@{bin}/xdg-dbus-proxy rPx -> flatpak-app//&xdg-dbus-proxy,
@{lib}/kf5/kioslave5 rPx,
@{lib}/kf6/kioworker rPx,
#aa:exec kioworker
/var/lib/flatpak/app/{,**} r,

1
apparmor.d/profiles-g-l/logrotate
View file

@ -67,6 +67,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
/etc/ r,
@{etc_ro}/logrotate.conf rk,
@{etc_ro}/logrotate.d/ r,
@{etc_ro}/rc*.d/ r,
@{etc_ro}/logrotate.d/* rk,
/ r,

4
apparmor.d/profiles-s-z/usbguard
View file

@ -20,6 +20,10 @@ profile usbguard @{exec_path} {
# Needed to create policy (usbguard generate-policy)
network netlink dgram,
unix (send, receive, connect) type=stream peer=(label="usbguard-daemon",addr=@@{int}),
# dbus: own bus=system name=org.usbguard1
@{exec_path} mr,
/etc/usbguard/*.conf rw,