mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): improve kde integration.

Browse source
This commit is contained in:
Alexandre Pujol 2023-08-27 14:32:08 +01:00
parent 41e0ac6ba8
commit ec3c5cd62e
Failed to generate hash of commit
36 changed files with 125 additions and 116 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/akonadi/akonadi_akonotes_resource
View file

@ -29,8 +29,8 @@ profile akonadi_akonotes_resource @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_akonotes_resource_[0-9]rc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_akonotes_resource_[0-9]{,_changes.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_share_dirs}/notes/**/ r,

13
apparmor.d/groups/akonadi/akonadi_archivemail_agent
View file

@ -15,6 +15,7 @@ profile akonadi_archivemail_agent @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
include <abstractions/X-strict>
@ -23,7 +24,6 @@ profile akonadi_archivemail_agent @{exec_path} {
/usr/share/akonadi/plugins/serializer/{,*.desktop} r,
/usr/share/hwdata/*.ids r,
/usr/share/mime/{,**} r,
/usr/share/qt{5,}/translations/*.qm r,
/etc/machine-id r,
/etc/xdg/kdeglobals r,
@ -33,18 +33,15 @@ profile akonadi_archivemail_agent @{exec_path} {
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/akonadi_archivemail_agentrc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_archivemail_agent r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_archivemail_agent_changes{,.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/emaildefaults r,
owner @{user_config_dirs}/emailidentities.lock rwk,
owner @{user_config_dirs}/emailidentities* rwl,
owner @{user_config_dirs}/kmail2rc r,
owner @{user_config_dirs}/QtProject/qtlogging.ini r,
owner @{user_config_dirs}/emailidentities{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/kmail2rc r,
owner @{user_config_dirs}/kwinrc r,
owner @{user_share_dirs}/akonadi/file_db_data/{,**} r,

7
apparmor.d/groups/akonadi/akonadi_birthdays_resource
View file

@ -20,17 +20,18 @@ profile akonadi_birthdays_resource @{exec_path} {
@{exec_path} mr,
/usr/share/akonadi/plugins/{,**} r,
/usr/share/hwdata/*.ids r,
/usr/share/qt{5,}/translations/*.qm r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/qt{5,}/translations/*.qm r,
/etc/xdg/kdeglobals r,
/etc/xdg/kwinrc r,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_birthdays_resource{,_changes.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,

4
apparmor.d/groups/akonadi/akonadi_contacts_resource
View file

@ -31,8 +31,8 @@ profile akonadi_contacts_resource @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_contacts_resource_[0-9]rc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_contacts_resource_[0-9]{,_changes.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,

3
apparmor.d/groups/akonadi/akonadi_control
View file

@ -36,8 +36,7 @@ profile akonadi_control @{exec_path} {
owner @{user_cache_dirs}/akonadi/{,**} rwl,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/agentsrc.lock k,
owner @{user_config_dirs}/akonadi/** rwl -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk,

5
apparmor.d/groups/akonadi/akonadi_followupreminder_agent
View file

@ -34,9 +34,8 @@ profile akonadi_followupreminder_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_followupreminder_agentrc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_followupreminder_agent{,_changes.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,

4
apparmor.d/groups/akonadi/akonadi_ical_resource
View file

@ -26,8 +26,8 @@ profile akonadi_ical_resource @{exec_path} {
owner @{user_cache_dirs}/akonadi_ical_resource_[0-9]/{,*} rwl,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_ical_resource_[0-9]rc rwl,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_ical_resource_[0-9]{,_changes.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,

11
apparmor.d/groups/akonadi/akonadi_indexing_agent
View file

@ -33,17 +33,18 @@ profile akonadi_indexing_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}//#@{int} rw,
owner @{user_config_dirs}/akonadi_indexing_agentrc r,
owner @{user_config_dirs}/akonadi/#@{int} rw,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_indexing_agent{,.*} rwlk,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/kwinrc r,
owner @{user_share_dirs}/akonadi/** rwk,
owner @{user_share_dirs}/akonadi/ rw,
owner @{user_share_dirs}/akonadi/** rwlk -> @{user_share_dirs}/akonadi/**,
@{PROC}/sys/kernel/core_pattern r,
@{PROC}/sys/kernel/random/boot_id r,

4
apparmor.d/groups/akonadi/akonadi_maildir_resource
View file

@ -32,8 +32,8 @@ profile akonadi_maildir_resource @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_maildir_resource_[0-9]rc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_maildir_resource_[0-9]{,_changes.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,

17
apparmor.d/groups/akonadi/akonadi_maildispatcher_agent
View file

@ -15,7 +15,9 @@ profile akonadi_maildispatcher_agent @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/qt5>
include <abstractions/ssl_certs>
include <abstractions/vulkan>
include <abstractions/X-strict>
@ -24,12 +26,15 @@ profile akonadi_maildispatcher_agent @{exec_path} {
network inet stream,
network inet6 stream,
network netlink dgram,
network netlink raw,
@{exec_path} mr,
/usr/share/akonadi/plugins/{,**} r,
/usr/share/hwdata/*.ids r,
/usr/share/mime/{,**} r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/knotifications5/akonadi_maildispatcher_agent.notifyrc r,
/usr/share/mime/{,**} r,
/etc/xdg/kdeglobals r,
/etc/xdg/kwinrc r,
@ -37,15 +42,17 @@ profile akonadi_maildispatcher_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi/#@{int} rw,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_maildispatcher_agent* rwkl,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi_maildispatcher_agent.notifyrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/ksslcertificatemanager r,
owner @{user_config_dirs}/kwinrc r,
owner @{user_config_dirs}/mailtransports r,
owner @{user_config_dirs}/specialmailcollectionsrc r,
owner @{user_share_dirs}/akonadi/file_db_data/{,**} r,
@{PROC}/sys/kernel/core_pattern r,

5
apparmor.d/groups/akonadi/akonadi_mailfilter_agent
View file

@ -40,9 +40,8 @@ profile akonadi_mailfilter_agent @{exec_path} {
owner @{user_config_dirs}/agent_config_akonadi_mailfilter_agent r,
owner @{user_config_dirs}/akonadi_*_resource_*rc r,
owner @{user_config_dirs}/akonadi_mailfilter_agentrc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_mailfilter_agent r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_mailfilter_agent_changes{,.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/emaildefaults r,
owner @{user_config_dirs}/emailidentities.lock rwk,

4
apparmor.d/groups/akonadi/akonadi_mailmerge_agent
View file

@ -35,8 +35,8 @@ profile akonadi_mailmerge_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_mailmerge_agent_changes.dat rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,

4
apparmor.d/groups/akonadi/akonadi_migration_agent
View file

@ -30,8 +30,8 @@ profile akonadi_migration_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi-migrationrc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_migration_agent_changes{,.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,

4
apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent
View file

@ -35,8 +35,8 @@ profile akonadi_newmailnotifier_agent @{exec_path} {
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/akonadi_newmailnotifier_agentrc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_newmailnotifier_agent_changes{,_changes.dat,.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/emaildefaults r,
owner @{user_config_dirs}/emailidentities.lock rwk,
owner @{user_config_dirs}/emailidentities* rwl,

4
apparmor.d/groups/akonadi/akonadi_notes_agent
View file

@ -36,8 +36,8 @@ profile akonadi_notes_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_*_agentrc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_notes_agent_changes{,.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,

4
apparmor.d/groups/akonadi/akonadi_sendlater_agent
View file

@ -36,8 +36,8 @@ profile akonadi_sendlater_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_sendlater_agentrc r,
owner @{user_config_dirs}/akonadi/agent_config_akonadi_sendlater_agent_changes{,.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,

5
apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent
View file

@ -31,9 +31,8 @@ profile akonadi_unifiedmailbox_agent @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_config_dirs}/akonadi_unifiedmailbox_agentrc r,
owner @{user_config_dirs}/{*,akonadi/}agent_config_akonadi_unifiedmailbox_agent{,_changes.dat,.conf_changes.dat} rw,
owner @{user_config_dirs}/{*,akonadi/}akonadi_unifiedmailbox_agent{,_changes.dat,.conf_changes.dat} rw,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/akonadi/ rw,
owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,

6
apparmor.d/groups/apps/calibre
View file

@ -128,12 +128,6 @@ profile calibre @{exec_path} {
owner @{user_cache_dirs}/calibre/ rw,
owner @{user_cache_dirs}/calibre/** rwkl -> @{user_cache_dirs}/calibre/**,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int},
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int} rw,
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int},
owner @{user_cache_dirs}/qtshadercache/#@{int} rw,
owner @{user_cache_dirs}/gstreamer-@{int}/ rw,
owner @{user_cache_dirs}/gstreamer-@{int}/registry.*.bin{,.tmp@{rand6}} rw,

15
apparmor.d/groups/browsers/firefox-kmozillahelper
View file

@ -15,7 +15,9 @@ profile firefox-kmozillahelper @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/qt5-settings-write>
include <abstractions/qt5>
include <abstractions/recent-documents-write>
include <abstractions/thumbnails-cache-read>
ptrace (read) peer=firefox,
@ -32,6 +34,8 @@ profile firefox-kmozillahelper @{exec_path} {
/usr/share/mime/ r,
/usr/share/sounds/{,**} r,
/etc/pulse/client.conf r,
/etc/pulse/client.conf.d/{,*} r,
/etc/xdg/kdeglobals r,
/etc/xdg/kwinrc r,
/etc/xdg/menus/ r,
@ -46,17 +50,20 @@ profile firefox-kmozillahelper @{exec_path} {
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/kdeglobals.@{rand6} rwl,
owner @{user_config_dirs}/kmozillahelperrc r,
owner @{user_config_dirs}/kmozillahelperrc.@{rand6} rwl,
owner @{user_config_dirs}/kwinrc r,
owner @{user_share_dirs}/RecentDocuments/ r,
owner @{user_share_dirs}/RecentDocuments/*.desktop w,
owner @{user_share_dirs}/recently-used.xbel.@{rand6} l,
owner @{user_config_dirs}/pulse/cookie rk,
owner @{run}/user/@{uid}/kmozillahelper@{rand6}.@{int}.kioworker.socket wl,
owner @{run}/user/@{uid}/pulse/ r,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{run}/udev/data/+usb:* r, # For /dev/bus/usb/**
@{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/**
@{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/mountinfo r,

3
apparmor.d/groups/kde/kactivitymanagerd
View file

@ -12,6 +12,7 @@ profile kactivitymanagerd @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/recent-documents-write>
include <abstractions/X-strict>
@{exec_path} mr,
@ -38,8 +39,6 @@ profile kactivitymanagerd @{exec_path} {
owner @{user_share_dirs}/kactivitymanagerd/{,**} rwlk,
owner @{user_share_dirs}/kservices5/{,**} r,
owner @{user_share_dirs}/RecentDocuments/ r,
owner @{user_share_dirs}/RecentDocuments/*.desktop w,
@{PROC}/sys/kernel/core_pattern r,
@{PROC}/sys/kernel/random/boot_id r,

10
apparmor.d/groups/kde/kalendarac
View file

@ -26,8 +26,12 @@ profile kalendarac @{exec_path} {
/usr/share/akonadi/plugins/serializer/{,*.desktop} r,
/usr/share/hwdata/*.ids r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/knotifications5/{,**} r,
/usr/share/sounds/{,**} r,
/etc/machine-id r,
/etc/pulse/client.conf r,
/etc/pulse/client.conf.d/{,**} r,
/etc/xdg/kdeglobals r,
owner @{user_cache_dirs}/icon-cache.kcache rw,
@ -43,8 +47,12 @@ profile kalendarac @{exec_path} {
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/kmail2rc r,
owner @{user_config_dirs}/pulse/cookie rk,
@{run}/user/@{uid}/xauth_@{rand6} rl,
owner /tmp/xauth_@{rand6} r,
owner @{run}/user/@{uid}/pulse/ r,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{PROC}/sys/kernel/core_pattern r,

3
apparmor.d/groups/kde/kcminit
View file

@ -42,8 +42,9 @@ profile kcminit @{exec_path} {
owner @{user_config_dirs}/Trolltech.conf.lock rwk,
owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl,
owner /tmp/kcminit.@{rand6} rwl,
owner /tmp/#@{int} rw,
owner /tmp/kcminit.@{rand6} rwl,
owner /tmp/xauth_@{rand6} r,
owner /tmp/.touchpaddefaults wl,
owner /tmp/.touchpaddefaults.lock rwk,

1
apparmor.d/groups/kde/kconf_update
View file

@ -16,6 +16,7 @@ profile kconf_update @{exec_path} {
include <abstractions/mesa>
include <abstractions/perl>
include <abstractions/python>
include <abstractions/qt5>
@{exec_path} mr,

2
apparmor.d/groups/kde/kde-powerdevil
View file

@ -18,10 +18,12 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted)
@{exec_path} mrix,
@{bin}/kcminit rPx,
@{lib}/drkonqi rPx,
/usr/share/hwdata/*.ids r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/knotifications5/*.notifyrc r,
/etc/fstab r,
/etc/xdg/kdeglobals r,

15
apparmor.d/groups/kde/kded5
View file

@ -68,8 +68,9 @@ profile kded5 @{exec_path} {
owner @{HOME}/.gtkrc-2.0 rw,
owner @{user_cache_dirs}/#@{int} rw,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_cache_dirs}/ksycoca5_* r,
owner @{user_cache_dirs}/ksycoca5_* rwlk -> @{user_cache_dirs}/#@{int},
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/bluedevilglobalrc.lock rwk,
@ -79,12 +80,14 @@ profile kded5 @{exec_path} {
owner @{user_config_dirs}/kcminputrc r,
owner @{user_config_dirs}/kconf_updaterc rw,
owner @{user_config_dirs}/kconf_updaterc.lock rwk,
owner @{user_config_dirs}/kcookiejarrc r,
owner @{user_config_dirs}/kcookiejarrc.lock rwk,
owner @{user_config_dirs}/kcookiejarrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/kdebugrc r,
owner @{user_config_dirs}/kded5rc.lock rwk,
owner @{user_config_dirs}/kded5rc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/kdedefaults/{,**} r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/kwalletrc r,
owner @{user_config_dirs}/khotkeysrc{,.@{rand6}} rw,
owner @{user_config_dirs}/khotkeysrc.@{rand6} l -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/khotkeysrc.lock rwk,
@ -95,8 +98,7 @@ profile kded5 @{exec_path} {
owner @{user_config_dirs}/kxkbrc r,
owner @{user_config_dirs}/libaccounts-glib/ rw,
owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_config_dirs}/menus/{,**} r,
owner @{user_config_dirs}/plasma-nm r,
owner @{user_config_dirs}/touchpadrc r,
owner @{user_config_dirs}/xsettingsd/{,**} rw,
@ -104,7 +106,7 @@ profile kded5 @{exec_path} {
owner @{user_share_dirs}/icc/{,edid-*} r,
owner @{user_share_dirs}/kcookiejar/#@{int} rw,
owner @{user_share_dirs}/kcookiejar/cookies.lock rwk,
owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwl -> @{user_share_dirs}/kcookiejar/#@{int},
owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int},
owner @{user_share_dirs}/kded5/{,**} rw,
owner @{user_share_dirs}/kscreen/{,**} rwl,
owner @{user_share_dirs}/kservices5/{,**} r,
@ -119,6 +121,9 @@ profile kded5 @{exec_path} {
owner /tmp/plasma-csd-generator.@{rand6}/{,**} rw,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/@{pids}/cmdline/ r,
@{PROC}/@{pids}/fd/ r,
@{PROC}/@{pids}/fd/info/@{int} r,

2
apparmor.d/groups/kde/kio_http_cache_cleaner
View file

@ -15,7 +15,7 @@ profile kio_http_cache_cleaner @{exec_path} {
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/qt{5,}/translations/*.qm r,
owner @{user_cache_dirs}/kio_http/* rw,
owner @{user_cache_dirs}/kio_http/{,*} rw,
owner @{user_config_dirs}/kio_httprc r,
owner @{run}/user/@{uid}/kio_http_cache_cleaner rw,

13
apparmor.d/groups/kde/kioslave5
View file

@ -21,6 +21,7 @@ profile kioslave5 @{exec_path} {
include <abstractions/ssl_certs>
include <abstractions/trash>
include <abstractions/vulkan>
include <abstractions/thumbnails-cache-read>
network inet dgram,
network inet6 dgram,
@ -70,26 +71,36 @@ profile kioslave5 @{exec_path} {
deny /tmp/.* rw,
deny /tmp/.*/{,**} rw,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_cache_dirs}/kio_http/* rwl,
owner @{user_cache_dirs}/ksycoca5_* r,
owner @{user_cache_dirs}/thumbnails/*/ r,
owner @{user_cache_dirs}/kio_http/* rwl,
owner @{user_config_dirs}/kdedefaults/kdeglobals r,
owner @{user_config_dirs}/kdedefaults/kwinrc r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/kio_httprc r,
owner @{user_config_dirs}/kwinrc r,
owner @{user_config_dirs}/menus/{,**} r,
owner @{user_share_dirs}/baloo/index rw,
owner @{user_share_dirs}/baloo/index-lock rwk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database rk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk,
owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw,
owner @{user_share_dirs}/kservices5/{,**} r,
owner /tmp/#@{int} rw,
owner /tmp/xauth_@{int} r,
@{run}/mount/utab r,
owner @{run}/user/@{uid}/#@{int} rw,
owner @{run}/user/@{uid}/kio_desktop*kioworker.socket rwl,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,

2
apparmor.d/groups/kde/kreadconfig
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile kreadconfig @{exec_path} {
include <abstractions/base>
capability dac_read_search,
network netlink raw,
@{exec_path} mr,

6
apparmor.d/groups/kde/kscreenlocker-greet
View file

@ -72,11 +72,6 @@ profile kscreenlocker-greet @{exec_path} {
owner @{user_cache_dirs}/plasma-svgelements-default_v* r,
owner @{user_cache_dirs}/plasma-svgelements.lock rwk,
owner @{user_cache_dirs}/plasma-svgelements{,.@{rand6}} rwl,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int},
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int} rw,
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int},
owner @{user_cache_dirs}/qtshadercache/#@{int} rw,
owner @{user_config_dirs}/kdedefaults/* r,
owner @{user_config_dirs}/kdeglobals r,
@ -89,6 +84,7 @@ profile kscreenlocker-greet @{exec_path} {
owner @{HOME}/.glvnd* mrw,
owner /tmp/*-cover-*.{jpg,png} r,
owner /tmp/xauth_@{rand6} r,
@{run}/faillock/[a-zA-z0-9]* rwk,

3
apparmor.d/groups/kde/kwin_x11
View file

@ -16,6 +16,7 @@ profile kwin_x11 @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>
include <abstractions/vulkan>
@ -54,7 +55,6 @@ profile kwin_x11 @{exec_path} {
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
owner @{user_cache_dirs}/plasma-svgelements.lock rwk,
owner @{user_cache_dirs}/plasma-svgelements{,.@{rand6}} rwl,
owner @{user_cache_dirs}/qtshadercache-*/@{hex} r,
owner @{user_cache_dirs}/session/#@{int} rw,
owner @{user_config_dirs}/#@{int} rw,
@ -70,6 +70,7 @@ profile kwin_x11 @{exec_path} {
owner /tmp/#@{int} rw,
owner /tmp/kwin.@{rand6} rwl,
owner /tmp/xauth_@{rand6} r,
owner @{run}/user/@{uid}/kcrash_[0-9]* rw,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,

34
apparmor.d/groups/kde/plasmashell
View file

@ -36,8 +36,11 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
network inet6 stream,
network netlink raw,
ptrace (read) peer=pinentry-qt,
ptrace (read) peer=akonadi*,
ptrace (read) peer=kalendarac,
ptrace (read) peer=kded5,
ptrace (read) peer=libreoffice*,
ptrace (read) peer=pinentry-qt,
signal (send),
@ -78,19 +81,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
/etc/pipewire/client.conf.d/ r,
/etc/pulse/client.conf r,
/etc/pulse/client.conf.d/ r,
/etc/xdg/baloofilerc r,
/etc/xdg/dolphinrc r,
/etc/xdg/kdeglobals r,
/etc/xdg/kioslaverc r,
/etc/xdg/krunnerrc r,
/etc/xdg/kshorturifilterrc r,
/etc/xdg/kwinrc r,
/etc/xdg/menus/ r,
/etc/xdg/menus/applications-merged/ r,
/etc/xdg/menus/applications.menu r,
/etc/xdg/plasmanotifyrc r,
/etc/xdg/plasmarc r,
/etc/xdg/taskmanagerrulesrc r,
/etc/xdg/** r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r,
@ -100,7 +91,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
owner @{user_cache_dirs}/#@{int} rwk,
owner @{user_cache_dirs}/event-sound-cache.tdb.@{md5}.x86_64-pc-linux-gnu rwk,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_cache_dirs}/ksycoca5_* rl,
owner @{user_cache_dirs}/ksycoca5_* rwlk -> @{user_cache_dirs}/#@{int},
owner @{user_cache_dirs}/org.kde.dirmodel-qml.kcache rw,
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
owner @{user_cache_dirs}/plasma-svgelements{,.@{rand6}} rwlk -> @{user_cache_dirs}/#@{int},
@ -109,16 +100,16 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
owner @{user_cache_dirs}/bookmarksrunner/ rw,
owner @{user_cache_dirs}/bookmarksrunner/** rwkl -> @{user_cache_dirs}/bookmarksrunner/#@{int},
owner @{user_config_dirs}/#@{int} rwk,
owner @{user_config_dirs}/{KDE,kde.org}/ rw,
owner @{user_config_dirs}/{KDE,kde.org}/** rwkl -> @{user_config_dirs}/{KDE,kde.org}/#@{int},
owner @{user_config_dirs}/*kde*.desktop* r,
owner @{user_config_dirs}/akonadi-firstrunrc r,
owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
owner @{user_config_dirs}/#@{int} rwk,
owner @{user_config_dirs}/akonadi* r,
owner @{user_config_dirs}/akonadi/akonadi*rc r,
owner @{user_config_dirs}/baloofilerc r,
owner @{user_config_dirs}/dolphinrc r,
owner @{user_config_dirs}/eventviewsrc r,
owner @{user_config_dirs}/kactivitymanagerd-statsrc r,
owner @{user_config_dirs}/{KDE,kde.org}/ rw,
owner @{user_config_dirs}/{KDE,kde.org}/** rwkl -> @{user_config_dirs}/{KDE,kde.org}/#@{int},
owner @{user_config_dirs}/kdedefaults/* r,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/kioslaverc r,
@ -127,6 +118,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
owner @{user_config_dirs}/korganizerrc r,
owner @{user_config_dirs}/krunnerrc r,
owner @{user_config_dirs}/ksmserverrc r,
owner @{user_config_dirs}/kwalletrc r,
owner @{user_config_dirs}/kwinrc r,
owner @{user_config_dirs}/menus/{,**} r,
owner @{user_config_dirs}/plasma* rwlk,
@ -145,6 +137,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
owner @{user_share_dirs}/krunnerstaterc rwl,
owner @{user_share_dirs}/krunnerstaterc.@{rand6} rwl,
owner @{user_share_dirs}/krunnerstaterc.lock rwk,
owner @{user_share_dirs}/kservices5/{,**} r,
owner @{user_share_dirs}/ktp/cache.db rwk,
owner @{user_share_dirs}/plasma_icons/*.desktop r,
owner @{user_share_dirs}/plasma/plasmoids/{,**} r,
@ -167,6 +160,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/core_pattern r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/{cgroup,cmdline,stat,statm} r,

3
apparmor.d/groups/kde/sddm-greeter
View file

@ -16,9 +16,9 @@ profile sddm-greeter @{exec_path} {
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>
include <abstractions/qt5-compose-cache-write>
network netlink raw,
@ -56,7 +56,6 @@ profile sddm-greeter @{exec_path} {
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
owner @{user_cache_dirs}/plasma-svgelements-* rw,
owner @{user_cache_dirs}/qtshadercache/{,**} rwl,
owner @{user_cache_dirs}/sddm-greeter/{,**} rwl,
owner @{user_config_dirs}/kdeglobals r,

3
apparmor.d/groups/kde/xdm-xsession
View file

@ -54,8 +54,9 @@ profile xdm-xsession @{exec_path} {
@{HOME}/.xinitrc rPix,
@{lib}/xinit/xinitrc rix,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/bash-completion/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/mc/mc.sh r,
@{etc_ro}/profile.d/{,*} r,
@{etc_ro}/X11/xdm/scripts/{,*} r,

6
apparmor.d/profiles-a-f/anki
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -53,11 +54,6 @@ profile anki @{exec_path} {
owner @{HOME}/ r,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/#@{int} rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int},
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int} rw,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int},
/usr/share/anki/{,**} r,

7
apparmor.d/profiles-m-r/minitube
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2020 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -58,12 +59,6 @@ profile minitube @{exec_path} {
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/" rw,
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/**" rwl -> "@{user_cache_dirs}/Flavio Tordini/Minitube/**",
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/#@{int} rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int},
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int} rw,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int},
# To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
owner @{user_config_dirs}/qt5ct/{,**} r,
/usr/share/qt5ct/** r,

5
apparmor.d/profiles-m-r/rpi-imager
View file

@ -54,11 +54,6 @@ profile rpi-imager @{exec_path} {
owner "@{user_cache_dirs}/Raspberry Pi/**" rwl -> "@{user_cache_dirs}/Raspberry Pi/**",
owner "@{user_config_dirs}/Raspberry Pi/{,**}" rw,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int},
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int} rw,
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int},
owner @{user_cache_dirs}/qtshadercache/#@{int} rw,
owner @{user_config_dirs}/qt5ct/{,**} r,
owner @{user_config_dirs}/QtProject.conf r,