diff --git a/apparmor.d/groups/bus/dbus-daemon-launch-helper b/apparmor.d/groups/bus/dbus-daemon-launch-helper index f74b6a17..267629ed 100644 --- a/apparmor.d/groups/bus/dbus-daemon-launch-helper +++ b/apparmor.d/groups/bus/dbus-daemon-launch-helper @@ -22,6 +22,10 @@ profile dbus-daemon-launch-helper @{exec_path} { @{libexec}/language-selector/ls-dbus-backend rPx, /{usr/,}lib/@{multiarch}/cups-pk-helper-mechanism rPx, /{usr/,}lib/software-properties/software-properties-dbus rPx, + /{usr/,}lib/kauth/discretegpuhelper rPUx, # TODO: rPx, + /{usr/,}lib/kauth/chargethresholdhelper rPUx, # TODO: rPx, + /{usr/,}lib/kauth/backlighthelper rPUx, # TODO: rPx, + /{usr/,}lib/kauth/kded-smart-helper rPUx, # TODO: rPx, /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx, /usr/share/usb-creator/usb-creator-helper rPx, diff --git a/apparmor.d/groups/freedesktop/plymouthd b/apparmor.d/groups/freedesktop/plymouthd index 9445028f..350ff237 100644 --- a/apparmor.d/groups/freedesktop/plymouthd +++ b/apparmor.d/groups/freedesktop/plymouthd @@ -60,6 +60,7 @@ profile plymouthd @{exec_path} { /dev/ptmx rw, /dev/tty[0-9]* rw, + /dev/ttyS[0-9]* rw, include if exists } \ No newline at end of file diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-update index baecbf22..78194b45 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-update @@ -26,6 +26,17 @@ profile xdg-user-dirs-update @{exec_path} { /var/lib/gdm{3,}/@{XDG_TEMPLATES_DIR}/ rw, /var/lib/gdm{3,}/@{XDG_VIDEOS_DIR}/ rw, + /var/lib/sddm/.config/user-dirs.dirs{,*} rw, + /var/lib/sddm/.config/user-dirs.locale rw, + /var/lib/sddm/@{XDG_DESKTOP_DIR}/ rw, + /var/lib/sddm/@{XDG_DOCUMENTS_DIR}/ rw, + /var/lib/sddm/@{XDG_DOWNLOAD_DIR}/ rw, + /var/lib/sddm/@{XDG_MUSIC_DIR}/ rw, + /var/lib/sddm/@{XDG_PICTURES_DIR}/ rw, + /var/lib/sddm/@{XDG_PUBLICSHARE_DIR}/ rw, + /var/lib/sddm/@{XDG_TEMPLATES_DIR}/ rw, + /var/lib/sddm/@{XDG_VIDEOS_DIR}/ rw, + # new user; change to 'c' owner @{HOME}/@{XDG_DESKTOP_DIR}/ w, owner @{HOME}/@{XDG_DOCUMENTS_DIR}/ w, diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index bb26c8fd..9a170941 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -22,6 +22,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { include include + capability dac_read_search, capability ipc_owner, capability setgid, capability setuid, diff --git a/apparmor.d/groups/freedesktop/xrdb b/apparmor.d/groups/freedesktop/xrdb index 9001ed0a..119b7ed6 100644 --- a/apparmor.d/groups/freedesktop/xrdb +++ b/apparmor.d/groups/freedesktop/xrdb @@ -32,6 +32,7 @@ profile xrdb @{exec_path} { owner /tmp/kcminit.* r, owner /tmp/runtime-cb/xauth_?????? r, + owner /tmp/startplasma-x11.?????? r, owner /tmp/xauth-[0-9]*-_[0-9] r, # file_inherit diff --git a/apparmor.d/groups/freedesktop/xsetroot b/apparmor.d/groups/freedesktop/xsetroot index 712384d1..3521199d 100644 --- a/apparmor.d/groups/freedesktop/xsetroot +++ b/apparmor.d/groups/freedesktop/xsetroot @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2019-2021 Mikhail Morfikov +# Copyright (C) 2023 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -10,16 +11,19 @@ include profile xsetroot @{exec_path} { include + capability dac_read_search, + @{exec_path} mr, - owner @{HOME}/.Xauthority r, + /usr/share/icons/{,**} r, /etc/X11/cursors/*.theme r, - /usr/share/icons/*/cursors/default r, - /usr/share/icons/*/index.theme r, - # file_inherit + owner @{HOME}/.Xauthority r, owner @{HOME}/.xsession-errors w, + owner @{user_share_dirs}/sddm/xorg-session.log w, + + @{run}/sddm/\{@{uuid}\} r, include if exists } diff --git a/apparmor.d/profiles-s-z/sddm b/apparmor.d/profiles-s-z/sddm index 63a7af3a..57d8725f 100644 --- a/apparmor.d/profiles-s-z/sddm +++ b/apparmor.d/profiles-s-z/sddm @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2018-2021 Mikhail Morfikov +# Copyright (C) 2023 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -7,68 +8,39 @@ abi , include @{exec_path} = /{usr/,}bin/sddm -profile sddm @{exec_path} { +profile sddm @{exec_path} flags=(attach_disconnected) { include - include - include - include include - include include + include + include + include include + include + include - # To remove the following errors: - # chown("/tmp/sddm-:0-YPUOCV", 123, 132) = -1 EPERM (Operation not permitted) capability chown, - - # To remove the following errors: - # sddm-helper[]: pam_keyinit(sddm-greeter:session): Unable to change GID to 132 temporarily - # sddm-helper[]: setgid( 132 ) failed for user: "sddm" capability setgid, - - # To remove the following errors: - # sddm-helper[]: pam_keyinit(sddm-greeter:session): Unable to change UID to 123 temporarily - # sddm-helper[]: pam_unix(sddm-greeter:session): session opened for user sddm by (uid=0) + capability fowner, capability setuid, - - # To remove the following errors: - # sddm-helper[]: pam_limits(sddm-greeter:session): Could not set limit for 'nofile' to soft=1024, - # hard=1048576: Operation not permitted; uid=0,euid=0 - # sddm-helper[*]: pam_limits(sddm-greeter:session): Could not set limit for 'memlock' to - # soft=1017930240, hard=1017930240: Operation not permitted; uid=0,euid=0 capability sys_resource, - - # To be able to display messages - # sddm-greeter[98834]: Connected to the daemon. - # sddm[98806]: Message received from greeter: Connect - # ... - # sddm-greeter[98834]: Message received from daemon: Capabilities - # sddm-greeter[98834]: Message received from daemon: HostName - # ... - # sddm[98806]: Message received from greeter: Login - # ... - # sddm-greeter[98834]: Message received from daemon: LoginSucceeded capability audit_write, - - # To read the /var/lib/sddm/state.conf file capability dac_read_search, - - # To prevent breaking the boot process capability net_admin, + capability dac_override, + + network netlink raw, - # Needed? - #capability sys_tty_config, - ptrace (trace) peer=@{profile_name}, signal (send) set=(kill, term) peer=xorg, @{exec_path} mr, - /{usr/,}lib/@{multiarch}/sddm/sddm-helper rix, /{usr/,}lib{,exec}/sddm/sddm-helper rix, + /{usr/,}lib/@{multiarch}/sddm/sddm-helper rix, - /{usr/,}bin/{,ba,da}sh mrix, + /{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/sddm-greeter rPx, /etc/sddm/Xsession rPx, @@ -89,92 +61,65 @@ profile sddm @{exec_path} { /usr/share/sddm/scripts/Xstop rPUx, /usr/share/sddm/scripts/wayland-session rPUx, /usr/share/sddm/scripts/Xsession rPUx, - #/usr/share/sddm/scripts/Xsetup rCx -> sddm-scripts, - #/usr/share/sddm/scripts/Xstop rCx -> sddm-scripts, - #/usr/share/sddm/scripts/wayland-session rCx -> sddm-scripts, - #/usr/share/sddm/scripts/Xsession rCx -> sddm-scripts, + #/usr/share/sddm/scripts/Xsetup rCx -> scripts, + #/usr/share/sddm/scripts/Xstop rCx -> scripts, + #/usr/share/sddm/scripts/wayland-session rCx -> scripts, + #/usr/share/sddm/scripts/Xsession rCx -> scripts, - # Create kwallet dirs and files - owner @{user_share_dirs}/kwalletd/ rw, - owner @{user_share_dirs}/kwalletd/kdewallet.salt rw, - @{user_share_dirs}/kwalletd/kdewallet.salt r, - owner @{run}/user/@{uid}/kwallet5.socket rw, - - # Themes - /usr/share/sddm/themes/** r, - /usr/share/plasma/desktoptheme/** r, /usr/share/desktop-base/softwaves-theme/login/*.svg r, - - # List of graphical sessions - /usr/share/xsessions/{,*.desktop} r, + /usr/share/plasma/desktoptheme/** r, + /usr/share/sddm/faces/.*.icon r, + /usr/share/sddm/themes/** r, /usr/share/wayland-sessions/{,*.desktop} r, + /usr/share/xsessions/{,*.desktop} r, + /var/lib/AccountsService/icons/*.icon r, + + @{etc_ro}/environment r, + @{etc_ro}/security/limits.d/ r, + /etc/default/locale r, + /etc/locale.conf r, + /etc/machine-id r, + /etc/sddm.conf r, + /etc/sddm.conf.d/{,*} r, + + / r, owner /var/lib/sddm/** rw, owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.jsc mrw, owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.qmlc mrw, /var/lib/sddm/state.conf rw, - /etc/sddm.conf.d/{,*} r, - /etc/sddm.conf r, - - # User avatars - /usr/share/sddm/faces/.*.icon r, - /var/lib/AccountsService/icons/*.icon r, - - # QT - /{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/*.so mr, - /{usr/,}lib/@{multiarch}/qt5/plugins/plasma/dataengine/*.so mr, - /{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/**.qmlc mr, - /{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/Private/*.jsc mr, - - # TMP files - owner /tmp/sddm-auth* rw, + owner @{HOME}/.local/ w, + owner @{HOME}/.Xauthority rw, + owner @{user_share_dirs}/ w, + owner @{user_share_dirs}/kwalletd/ rw, + owner @{user_share_dirs}/kwalletd/kdewallet.salt r, + owner @{user_share_dirs}/kwalletd/kdewallet.salt rw, + owner @{user_share_dirs}/sddm/ w, + /tmp/sddm-* rw, owner /tmp/*/{,s} rw, + owner /tmp/sddm-auth* rw, - owner @{run}/sddm/ rw, + @{run}/faillock/[a-zA-z0-9]* rwk, @{run}/sddm/* w, + @{run}/systemd/sessions/*.ref rw, + owner @{run}/sddm/ rw, + owner @{run}/user/@{uid}/kwallet5.socket rw, - # Session error logs - # Creating the dir structure is needed when a new user is logging in for the very first time - # using SDDM. - owner @{HOME}/.local/ w, - owner @{user_share_dirs}/ w, - owner @{user_share_dirs}/sddm/ w, - - /{usr/,}lib/@{multiarch}/ld-*.so mr, - - @{etc_ro}/security/limits.d/ r, - - owner @{HOME}/.Xauthority rw, - - /etc/default/locale r, - /etc/locale.conf r, - @{etc_ro}/environment r, - + @{PROC}/sys/kernel/core_pattern r, owner @{PROC}/@{pid}/loginuid rw, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/uid_map r, owner @{PROC}/1/limits r, - @{PROC}/sys/kernel/core_pattern r, - / r, - - # Run SDDM on a specific TTY /dev/tty[0-9]* rw, - @{run}/systemd/sessions/*.ref rw, - - - profile sddm-scripts { + profile scripts { include include include - /usr/share/sddm/scripts/Xsetup r, - /usr/share/sddm/scripts/Xstop r, - /usr/share/sddm/scripts/wayland-session r, - /usr/share/sddm/scripts/Xsession r, /{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/{,ba,da}sh rix, @@ -187,6 +132,12 @@ profile sddm @{exec_path} { /{usr/,}bin/dbus-run-session rix, /{usr/,}bin/dbus-daemon rPUx, + /usr/share/sddm/scripts/Xsetup r, + /usr/share/sddm/scripts/Xstop r, + /usr/share/sddm/scripts/wayland-session r, + /usr/share/sddm/scripts/Xsession r, + + include if exists } profile xauth { diff --git a/apparmor.d/profiles-s-z/sddm-greeter b/apparmor.d/profiles-s-z/sddm-greeter index b05ba000..b19c8876 100644 --- a/apparmor.d/profiles-s-z/sddm-greeter +++ b/apparmor.d/profiles-s-z/sddm-greeter @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2018-2021 Mikhail Morfikov +# Copyright (C) 2023 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -9,95 +10,60 @@ include @{exec_path} = /{usr/,}bin/sddm-greeter profile sddm-greeter @{exec_path} { include - include - include - include include + include + include include - include include + include + include + include + include @{exec_path} mr, + /usr/share/sddm/{,**} r, + /usr/share/desktop-base/softwaves-theme/login/*.svg r, + /usr/share/plasma/desktoptheme/** r, + /usr/share/qt5ct/** r, + /usr/share/wayland-sessions/{,*.desktop} r, + /usr/share/xsessions/{,*.desktop} r, + /usr/share/hwdata/pnp.ids r, + + /etc/sddm.conf.d/{,*} r, + /etc/sddm.conf r, + /etc/fstab r, + /etc/machine-id r, + /var/lib/AccountsService/icons/*.icon r, + /var/lib/dbus/machine-id r, + owner /var/lib/sddm/** rw, owner /var/lib/sddm/#[0-9]*[0-9] mrw, owner /var/lib/sddm/.cache/** mrwkl -> /var/lib/sddm/.cache/**, /var/lib/sddm/state.conf r, - /usr/share/sddm/{,**} r, - - /etc/sddm.conf.d/{,*} r, - /etc/sddm.conf r, - - # QT - /{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/*.so mr, - /{usr/,}lib/@{multiarch}/qt5/plugins/plasma/dataengine/*.so mr, - /{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/**.qmlc mr, - /{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/Private/*.jsc mr, - /{usr/,}lib/@{multiarch}/qt5/qml/QtGraphicalEffects/private/DropShadowBase.qmlc mr, - - # List of graphical sessions - /usr/share/xsessions/{,*.desktop} r, - /usr/share/wayland-sessions/{,*.desktop} r, - - # Themes - /usr/share/plasma/desktoptheme/** r, - /usr/share/desktop-base/softwaves-theme/login/*.svg r, - - # User avatars - /var/lib/AccountsService/icons/*.icon r, - - # All the following is for the test mode - #------------------------------------------------------------------ owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/sddm-greeter/ rw, - owner @{user_cache_dirs}/sddm-greeter/qmlcache/ rw, - owner @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9] rw, - owner @{user_cache_dirs}/sddm-greeter/qmlcache/[a-f0-9]*.jsc* rwl -> @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9], - owner @{user_cache_dirs}/sddm-greeter/qmlcache/[a-f0-9]*.qmlc* rwl -> @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9], - - owner @{user_cache_dirs}/qtshadercache/ rw, - owner @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9] rw, - owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9], - owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw, - owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9], + owner @{user_cache_dirs}/icon-cache.kcache rw, + owner @{user_cache_dirs}/plasma_theme_*.kcache rw, + owner @{user_cache_dirs}/plasma-svgelements-* rw, + owner @{user_cache_dirs}/qtshadercache/{,**} rwl, + owner @{user_cache_dirs}/sddm-greeter/{,**} rwl, + owner @{user_config_dirs}/kdeglobals r, + owner @{user_config_dirs}/plasmarc r, owner @{user_config_dirs}/qt5ct/{,**} r, - /usr/share/qt5ct/** r, # If one is blocked, the others are probed. deny owner @{HOME}/#[0-9]*[0-9] mrw, owner @{HOME}/.glvnd* mrw, - # owner /tmp/#[0-9]*[0-9] mrw, - # owner /tmp/.glvnd* mrw, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/plasmarc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/plasma_theme_*.kcache rw, - owner @{user_cache_dirs}/plasma-svgelements-* rw, - - include - - owner @{PROC}/@{pid}/cmdline r, - #------------------------------------------------------------------ - - /etc/fstab r, - - /usr/share/hwdata/pnp.ids r, + owner /tmp/runtime-sddm/ rw, owner @{run}/sddm/{,*} rw, - /{usr/,}lib/@{multiarch}/ld-*.so mr, - + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mounts r, @{PROC}/sys/kernel/core_pattern r, - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - # file_inherit - #/dev/tty[0-9]* rw, - include if exists } diff --git a/apparmor.d/profiles-s-z/startx b/apparmor.d/profiles-s-z/startx index 8dadc4bf..0e769738 100644 --- a/apparmor.d/profiles-s-z/startx +++ b/apparmor.d/profiles-s-z/startx @@ -8,7 +8,7 @@ abi , include @{exec_path} = /{usr/,}bin/startx -profile startx @{exec_path} { +profile startx @{exec_path} flags=(attach_disconnected) { include include include