From ed7585c3d0c6830770b7e2a99a3225075e7b96b5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 20 Oct 2023 23:15:39 +0100 Subject: [PATCH] refractor(profile): clean some dbus rules. --- apparmor.d/groups/bus/ibus-extension-gtk3 | 4 ++-- apparmor.d/groups/gnome/nautilus | 8 +++----- apparmor.d/groups/network/ModemManager | 21 ++++++++++----------- apparmor.d/groups/network/NetworkManager | 21 ++++++++++----------- 4 files changed, 25 insertions(+), 29 deletions(-) diff --git a/apparmor.d/groups/bus/ibus-extension-gtk3 b/apparmor.d/groups/bus/ibus-extension-gtk3 index d0a7c65d..95b038d1 100644 --- a/apparmor.d/groups/bus/ibus-extension-gtk3 +++ b/apparmor.d/groups/bus/ibus-extension-gtk3 @@ -32,7 +32,7 @@ profile ibus-extension-gtk3 @{exec_path} flags=(attach_disconnected) { member={RequestName,ReleaseName} peer=(name=org.freedesktop.DBus, label=dbus-daemon), - dbus send bus=session path=/org/gtk/Settings + dbus send bus=session path=/org/gtk/Settings interface=org.freedesktop.DBus.Properties member=GetAll peer=(name=:*, label=gsd-xsettings), @@ -42,7 +42,7 @@ profile ibus-extension-gtk3 @{exec_path} flags=(attach_disconnected) { member=GetAddress peer=(name=org.a11y.Bus, label=at-spi-bus-launcher), - dbus send bus=accessibility path=/org/a11y/atspi/registry + dbus send bus=accessibility path=/org/a11y/atspi/registry interface=org.a11y.atspi.Registry member=GetRegisteredEvents peer=(name=org.a11y.atspi.Registry), # all peer's labels diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 0c9d59a3..fcab66c4 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -22,7 +22,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { include include - dbus send bus=system path=/org/freedesktop/hostname[0-9] + dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member=GetAll, @@ -34,11 +34,9 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { member={IsSupported,List} peer=(name=:*), - dbus bind bus=session - name=org.gnome.Nautilus, + dbus bind bus=session name=org.gnome.Nautilus, - dbus bind bus=session - name=org.freedesktop.FileManager1, + dbus bind bus=session name=org.freedesktop.FileManager1, @{exec_path} mr, diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index 026ead9e..2d50946e 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -22,33 +22,32 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { member={RequestName,ReleaseName} peer=(name=org.freedesktop.DBus, label=dbus-daemon), - dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority + dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.DBus.Properties member=GetAll, - dbus send bus=system path=/org/freedesktop/login[0-9] - interface=org.freedesktop.login[0-9].Manager + dbus send bus=system path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager member=Inhibit, - dbus receive bus=system path=/org/freedesktop/login[0-9] - interface=org.freedesktop.login[0-9].Manager + dbus receive bus=system path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager member={UserNew,SessionNew,PrepareForShutdown,SeatNew,UserRemoved,SessionRemoved,PrepareForSleep} peer=(name=:*, label=systemd-logind), - dbus receive bus=system path=/org/freedesktop/ModemManager[0-9] + dbus receive bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects, - dbus receive bus=system path=/org/freedesktop/ModemManager[0-9] + dbus receive bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.Properties member=GetAll, - dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority - interface=org.freedesktop.PolicyKit[0-9].Authority + dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority + interface=org.freedesktop.PolicyKit1.Authority member=Changed, - dbus bind bus=system - name=org.freedesktop.ModemManager[0-9], + dbus bind bus=system name=org.freedesktop.ModemManager1, @{exec_path} mr, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index f2564213..604f451a 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -40,12 +40,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager{,/**} interface=org.freedesktop.{DBus.Properties,DBus.Introspectable,NetworkManager*}, - dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority - interface=org.freedesktop.PolicyKit[0-9].Authority + dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit1/Authority + interface=org.freedesktop.PolicyKit1.Authority member={Changed,CheckAuthorization,CancelCheckAuthorization}, - dbus (send,receive) bus=system path=/org/freedesktop/login[0-9] - interface=org.freedesktop.login[0-9].Manager + dbus (send,receive) bus=system path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager member={SessionRemoved,UserNew,SessionNew,Inhibit,PrepareForShutdown,UserRemoved,PrepareForSleep} peer=(name=:*, label=systemd-logind), @@ -63,20 +63,20 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { member=Action peer=(name=org.freedesktop.nm_dispatcher), - dbus send bus=system path=/org/freedesktop/ModemManager[0-9] + dbus send bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects, - dbus send bus=system path=/org/freedesktop/resolve[0-9] - interface=org.freedesktop.resolve[0-9].Manager + dbus send bus=system path=/org/freedesktop/resolve1 + interface=org.freedesktop.resolve1.Manager member={SetLink*,ResolveHostname}, # org.freedesktop.resolve1 - dbus send bus=system path=/org/freedesktop/hostname[0-9] + dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member=GetAll, - dbus send bus=system path=/org/freedesktop/ModemManager[0-9] + dbus send bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects, @@ -93,8 +93,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { interface=org.freedesktop.DBus.Properties peer=(name=:*), - dbus bind bus=system - name=org.freedesktop.NetworkManager, + dbus bind bus=system name=org.freedesktop.NetworkManager, @{exec_path} mr,