mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 17:08:09 +01:00
Minor fixes.
This commit is contained in:
parent
7be8aca10d
commit
ea746ad8d7
10 changed files with 19 additions and 5 deletions
|
@ -8,7 +8,7 @@ include <tunables/global>
|
||||||
|
|
||||||
@{exec_path} = /{usr/,}lib/at-spi2-core/at-spi2-registryd
|
@{exec_path} = /{usr/,}lib/at-spi2-core/at-spi2-registryd
|
||||||
@{exec_path} += /usr/{lib,libexec}/at-spi2-registryd
|
@{exec_path} += /usr/{lib,libexec}/at-spi2-registryd
|
||||||
profile at-spi2-registryd @{exec_path} {
|
profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
|
||||||
include <abstractions/base>
|
include <abstractions/base>
|
||||||
include <abstractions/nameservice-strict>
|
include <abstractions/nameservice-strict>
|
||||||
include <abstractions/deny-root-dir-access>
|
include <abstractions/deny-root-dir-access>
|
||||||
|
|
|
@ -28,7 +28,9 @@ profile dbus-run-session @{exec_path} {
|
||||||
/usr/share/dconf/profile/gdm r,
|
/usr/share/dconf/profile/gdm r,
|
||||||
/var/lib/gdm/.config/dconf/user r,
|
/var/lib/gdm/.config/dconf/user r,
|
||||||
|
|
||||||
/dev/tty rw,
|
# file_inherit
|
||||||
|
owner /dev/tty rw,
|
||||||
|
owner /dev/tty[0-9]* rw,
|
||||||
|
|
||||||
include if exists <local/dbus-run-session>
|
include if exists <local/dbus-run-session>
|
||||||
}
|
}
|
||||||
|
|
|
@ -43,5 +43,8 @@ profile gdm-wayland-session @{exec_path} {
|
||||||
owner @{run}/user/[0-9]*/dconf/ rw,
|
owner @{run}/user/[0-9]*/dconf/ rw,
|
||||||
owner @{run}/user/[0-9]*/dconf/user rw,
|
owner @{run}/user/[0-9]*/dconf/user rw,
|
||||||
|
|
||||||
|
# file_inherit
|
||||||
|
/dev/tty[0-9]* rw,
|
||||||
|
|
||||||
include if exists <local/gdm-wayland-session>
|
include if exists <local/gdm-wayland-session>
|
||||||
}
|
}
|
||||||
|
|
|
@ -80,6 +80,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
||||||
|
|
||||||
/dev/null r,
|
/dev/null r,
|
||||||
/dev/tty rw,
|
/dev/tty rw,
|
||||||
|
/dev/tty[0-9]* rw,
|
||||||
|
|
||||||
include if exists <local/gnome-session-binary>
|
include if exists <local/gnome-session-binary>
|
||||||
}
|
}
|
||||||
|
|
|
@ -12,6 +12,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
||||||
include <abstractions/app-launcher-user>
|
include <abstractions/app-launcher-user>
|
||||||
include <abstractions/audio>
|
include <abstractions/audio>
|
||||||
include <abstractions/dri-common>
|
include <abstractions/dri-common>
|
||||||
|
include <abstractions/dri-enumerate>
|
||||||
include <abstractions/gnome>
|
include <abstractions/gnome>
|
||||||
include <abstractions/mesa>
|
include <abstractions/mesa>
|
||||||
include <abstractions/nameservice-strict>
|
include <abstractions/nameservice-strict>
|
||||||
|
@ -117,8 +118,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
||||||
@{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
|
@{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
|
||||||
@{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
|
@{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
|
||||||
@{sys}/devices/pci[0-9]*/**/boot_vga r,
|
@{sys}/devices/pci[0-9]*/**/boot_vga r,
|
||||||
@{sys}/devices/pci[0-9]*/**/{device,vendor} r,
|
|
||||||
@{sys}/devices/pci[0-9]*/**/{subsystem_device,subsystem_vendor} r,
|
|
||||||
@{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
|
@{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
|
||||||
@{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
|
@{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
|
||||||
|
|
||||||
|
|
|
@ -31,6 +31,7 @@ profile ssh @{exec_path} {
|
||||||
owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r,
|
owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r,
|
||||||
owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r,
|
owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r,
|
||||||
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r,
|
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r,
|
||||||
|
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/config r,
|
||||||
|
|
||||||
/etc/ssh/ssh_config r,
|
/etc/ssh/ssh_config r,
|
||||||
/etc/ssh/ssh_config.d/ r,
|
/etc/ssh/ssh_config.d/ r,
|
||||||
|
|
|
@ -12,6 +12,8 @@ profile ssh-agent @{exec_path} {
|
||||||
include <abstractions/base>
|
include <abstractions/base>
|
||||||
include <abstractions/openssl>
|
include <abstractions/openssl>
|
||||||
|
|
||||||
|
signal (receive) set=term peer=gnome-keyring-daemon,
|
||||||
|
|
||||||
@{exec_path} mr,
|
@{exec_path} mr,
|
||||||
|
|
||||||
owner /tmp/ssh-*/ rw,
|
owner /tmp/ssh-*/ rw,
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
# apparmor.d - Full set of apparmor profiles
|
# apparmor.d - Full set of apparmor profiles
|
||||||
# Copyright (C) 2021 Mikhail Morfikov
|
# Copyright (C) 2021 Mikhail Morfikov
|
||||||
|
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
# SPDX-License-Identifier: GPL-2.0-only
|
||||||
|
|
||||||
abi <abi/3.0>,
|
abi <abi/3.0>,
|
||||||
|
@ -9,7 +10,9 @@ include <tunables/global>
|
||||||
@{exec_path} = /{usr/,}lib/systemd/systemd-coredump
|
@{exec_path} = /{usr/,}lib/systemd/systemd-coredump
|
||||||
profile systemd-coredump @{exec_path} flags=(complain) {
|
profile systemd-coredump @{exec_path} flags=(complain) {
|
||||||
include <abstractions/base>
|
include <abstractions/base>
|
||||||
|
include <abstractions/openssl>
|
||||||
include <abstractions/systemd-common>
|
include <abstractions/systemd-common>
|
||||||
|
include <abstractions/nameservice-strict>
|
||||||
|
|
||||||
capability setpcap,
|
capability setpcap,
|
||||||
capability setuid,
|
capability setuid,
|
||||||
|
|
|
@ -50,7 +50,7 @@ profile systemd-logind @{exec_path} flags=(complain) {
|
||||||
|
|
||||||
@{run}/systemd/seats/ r,
|
@{run}/systemd/seats/ r,
|
||||||
@{run}/systemd/seats/.#seat* rw,
|
@{run}/systemd/seats/.#seat* rw,
|
||||||
@{run}/systemd/seats/seat0 rw,
|
@{run}/systemd/seats/seat[0-9]* rw,
|
||||||
@{run}/systemd/inhibit/ r,
|
@{run}/systemd/inhibit/ r,
|
||||||
@{run}/systemd/inhibit/[0-9]*{,.ref} rw,
|
@{run}/systemd/inhibit/[0-9]*{,.ref} rw,
|
||||||
@{run}/systemd/inhibit/.#* rw,
|
@{run}/systemd/inhibit/.#* rw,
|
||||||
|
|
|
@ -43,5 +43,8 @@ profile polkitd @{exec_path} {
|
||||||
@{run}/systemd/sessions/* r,
|
@{run}/systemd/sessions/* r,
|
||||||
@{run}/systemd/users/[0-9]* r,
|
@{run}/systemd/users/[0-9]* r,
|
||||||
|
|
||||||
|
# Silencer
|
||||||
|
deny /.cache/ rw,
|
||||||
|
|
||||||
include if exists <local/polkitd>
|
include if exists <local/polkitd>
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue