mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 16:03:51 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profiles): better kde integration

Browse Source 
Step 1: Ensure it can boot.
This commit is contained in:
Alexandre Pujol 2023-03-29 23:54:23 +01:00
parent 1aab4f1557
commit f3d4912be8
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
9 changed files with 111 additions and 172 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apparmor.d/groups/bus/dbus-daemon-launch-helper
View File

@ -22,6 +22,10 @@ profile dbus-daemon-launch-helper @{exec_path} {
@{libexec}/language-selector/ls-dbus-backend rPx,
/{usr/,}lib/@{multiarch}/cups-pk-helper-mechanism rPx,
/{usr/,}lib/software-properties/software-properties-dbus rPx,
/{usr/,}lib/kauth/discretegpuhelper rPUx, # TODO: rPx,
/{usr/,}lib/kauth/chargethresholdhelper rPUx, # TODO: rPx,
/{usr/,}lib/kauth/backlighthelper rPUx, # TODO: rPx,
/{usr/,}lib/kauth/kded-smart-helper rPUx, # TODO: rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx,
/usr/share/usb-creator/usb-creator-helper rPx,

1
apparmor.d/groups/freedesktop/plymouthd
View File

@ -60,6 +60,7 @@ profile plymouthd @{exec_path} {
/dev/ptmx rw,
/dev/tty[0-9]* rw,
/dev/ttyS[0-9]* rw,
include if exists <local/plymouthd>
}

11
apparmor.d/groups/freedesktop/xdg-user-dirs-update
View File

@ -26,6 +26,17 @@ profile xdg-user-dirs-update @{exec_path} {
/var/lib/gdm{3,}/@{XDG_TEMPLATES_DIR}/ rw,
/var/lib/gdm{3,}/@{XDG_VIDEOS_DIR}/ rw,
/var/lib/sddm/.config/user-dirs.dirs{,*} rw,
/var/lib/sddm/.config/user-dirs.locale rw,
/var/lib/sddm/@{XDG_DESKTOP_DIR}/ rw,
/var/lib/sddm/@{XDG_DOCUMENTS_DIR}/ rw,
/var/lib/sddm/@{XDG_DOWNLOAD_DIR}/ rw,
/var/lib/sddm/@{XDG_MUSIC_DIR}/ rw,
/var/lib/sddm/@{XDG_PICTURES_DIR}/ rw,
/var/lib/sddm/@{XDG_PUBLICSHARE_DIR}/ rw,
/var/lib/sddm/@{XDG_TEMPLATES_DIR}/ rw,
/var/lib/sddm/@{XDG_VIDEOS_DIR}/ rw,
# new user; change to 'c'
owner @{HOME}/@{XDG_DESKTOP_DIR}/ w,
owner @{HOME}/@{XDG_DOCUMENTS_DIR}/ w,

1
apparmor.d/groups/freedesktop/xorg
View File

@ -22,6 +22,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
include <abstractions/opencl>
include <abstractions/vulkan>
capability dac_read_search,
capability ipc_owner,
capability setgid,
capability setuid,

1
apparmor.d/groups/freedesktop/xrdb
View File

@ -32,6 +32,7 @@ profile xrdb @{exec_path} {
owner /tmp/kcminit.* r,
owner /tmp/runtime-cb/xauth_?????? r,
owner /tmp/startplasma-x11.?????? r,
owner /tmp/xauth-[0-9]*-_[0-9] r,
# file_inherit

12
apparmor.d/groups/freedesktop/xsetroot
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -10,16 +11,19 @@ include <tunables/global>
profile xsetroot @{exec_path} {
include <abstractions/base>
capability dac_read_search,
@{exec_path} mr,
owner @{HOME}/.Xauthority r,
/usr/share/icons/{,**} r,
/etc/X11/cursors/*.theme r,
/usr/share/icons/*/cursors/default r,
/usr/share/icons/*/index.theme r,
# file_inherit
owner @{HOME}/.Xauthority r,
owner @{HOME}/.xsession-errors w,
owner @{user_share_dirs}/sddm/xorg-session.log w,
@{run}/sddm/\{@{uuid}\} r,
include if exists <local/xsetroot>
}

151
apparmor.d/profiles-s-z/sddm
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -7,57 +8,28 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/sddm
profile sddm @{exec_path} {
profile sddm @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/freedesktop.org>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/authentication>
include <abstractions/wutmp>
include <abstractions/dri-common>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/wutmp>
# To remove the following errors:
# chown("/tmp/sddm-:0-YPUOCV", 123, 132) = -1 EPERM (Operation not permitted)
capability chown,
# To remove the following errors:
# sddm-helper[]: pam_keyinit(sddm-greeter:session): Unable to change GID to 132 temporarily
# sddm-helper[]: setgid( 132 ) failed for user: "sddm"
capability setgid,
# To remove the following errors:
# sddm-helper[]: pam_keyinit(sddm-greeter:session): Unable to change UID to 123 temporarily
# sddm-helper[]: pam_unix(sddm-greeter:session): session opened for user sddm by (uid=0)
capability fowner,
capability setuid,
# To remove the following errors:
# sddm-helper[]: pam_limits(sddm-greeter:session): Could not set limit for 'nofile' to soft=1024,
# hard=1048576: Operation not permitted; uid=0,euid=0
# sddm-helper[*]: pam_limits(sddm-greeter:session): Could not set limit for 'memlock' to
# soft=1017930240, hard=1017930240: Operation not permitted; uid=0,euid=0
capability sys_resource,
# To be able to display messages
# sddm-greeter[98834]: Connected to the daemon.
# sddm[98806]: Message received from greeter: Connect
# ...
# sddm-greeter[98834]: Message received from daemon: Capabilities
# sddm-greeter[98834]: Message received from daemon: HostName
# ...
# sddm[98806]: Message received from greeter: Login
# ...
# sddm-greeter[98834]: Message received from daemon: LoginSucceeded
capability audit_write,
# To read the /var/lib/sddm/state.conf file
capability dac_read_search,
# To prevent breaking the boot process
capability net_admin,
capability dac_override,
# Needed?
#capability sys_tty_config,
network netlink raw,
ptrace (trace) peer=@{profile_name},
@ -65,10 +37,10 @@ profile sddm @{exec_path} {
@{exec_path} mr,
/{usr/,}lib/@{multiarch}/sddm/sddm-helper rix,
/{usr/,}lib{,exec}/sddm/sddm-helper rix,
/{usr/,}lib/@{multiarch}/sddm/sddm-helper rix,
/{usr/,}bin/{,ba,da}sh mrix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/sddm-greeter rPx,
/etc/sddm/Xsession rPx,
@ -89,92 +61,65 @@ profile sddm @{exec_path} {
/usr/share/sddm/scripts/Xstop rPUx,
/usr/share/sddm/scripts/wayland-session rPUx,
/usr/share/sddm/scripts/Xsession rPUx,
#/usr/share/sddm/scripts/Xsetup rCx -> sddm-scripts,
#/usr/share/sddm/scripts/Xstop rCx -> sddm-scripts,
#/usr/share/sddm/scripts/wayland-session rCx -> sddm-scripts,
#/usr/share/sddm/scripts/Xsession rCx -> sddm-scripts,
#/usr/share/sddm/scripts/Xsetup rCx -> scripts,
#/usr/share/sddm/scripts/Xstop rCx -> scripts,
#/usr/share/sddm/scripts/wayland-session rCx -> scripts,
#/usr/share/sddm/scripts/Xsession rCx -> scripts,
# Create kwallet dirs and files
owner @{user_share_dirs}/kwalletd/ rw,
owner @{user_share_dirs}/kwalletd/kdewallet.salt rw,
@{user_share_dirs}/kwalletd/kdewallet.salt r,
owner @{run}/user/@{uid}/kwallet5.socket rw,
# Themes
/usr/share/sddm/themes/** r,
/usr/share/plasma/desktoptheme/** r,
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
# List of graphical sessions
/usr/share/xsessions/{,*.desktop} r,
/usr/share/plasma/desktoptheme/** r,
/usr/share/sddm/faces/.*.icon r,
/usr/share/sddm/themes/** r,
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xsessions/{,*.desktop} r,
/var/lib/AccountsService/icons/*.icon r,
@{etc_ro}/environment r,
@{etc_ro}/security/limits.d/ r,
/etc/default/locale r,
/etc/locale.conf r,
/etc/machine-id r,
/etc/sddm.conf r,
/etc/sddm.conf.d/{,*} r,
/ r,
owner /var/lib/sddm/** rw,
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.jsc mrw,
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.qmlc mrw,
/var/lib/sddm/state.conf rw,
/etc/sddm.conf.d/{,*} r,
/etc/sddm.conf r,
# User avatars
/usr/share/sddm/faces/.*.icon r,
/var/lib/AccountsService/icons/*.icon r,
# QT
/{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/*.so mr,
/{usr/,}lib/@{multiarch}/qt5/plugins/plasma/dataengine/*.so mr,
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/**.qmlc mr,
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/Private/*.jsc mr,
# TMP files
owner /tmp/sddm-auth* rw,
/tmp/sddm-* rw,
owner /tmp/*/{,s} rw,
owner @{run}/sddm/ rw,
@{run}/sddm/* w,
# Session error logs
# Creating the dir structure is needed when a new user is logging in for the very first time
# using SDDM.
owner @{HOME}/.local/ w,
owner @{HOME}/.Xauthority rw,
owner @{user_share_dirs}/ w,
owner @{user_share_dirs}/kwalletd/ rw,
owner @{user_share_dirs}/kwalletd/kdewallet.salt r,
owner @{user_share_dirs}/kwalletd/kdewallet.salt rw,
owner @{user_share_dirs}/sddm/ w,
/{usr/,}lib/@{multiarch}/ld-*.so mr,
/tmp/sddm-* rw,
owner /tmp/*/{,s} rw,
owner /tmp/sddm-auth* rw,
@{etc_ro}/security/limits.d/ r,
owner @{HOME}/.Xauthority rw,
/etc/default/locale r,
/etc/locale.conf r,
@{etc_ro}/environment r,
@{run}/faillock/[a-zA-z0-9]* rwk,
@{run}/sddm/* w,
@{run}/systemd/sessions/*.ref rw,
owner @{run}/sddm/ rw,
owner @{run}/user/@{uid}/kwallet5.socket rw,
@{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/loginuid rw,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/uid_map r,
owner @{PROC}/1/limits r,
@{PROC}/sys/kernel/core_pattern r,
/ r,
# Run SDDM on a specific TTY
/dev/tty[0-9]* rw,
@{run}/systemd/sessions/*.ref rw,
profile sddm-scripts {
profile scripts {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/bash>
/usr/share/sddm/scripts/Xsetup r,
/usr/share/sddm/scripts/Xstop r,
/usr/share/sddm/scripts/wayland-session r,
/usr/share/sddm/scripts/Xsession r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{,ba,da}sh rix,
@ -187,6 +132,12 @@ profile sddm @{exec_path} {
/{usr/,}bin/dbus-run-session rix,
/{usr/,}bin/dbus-daemon rPUx,
/usr/share/sddm/scripts/Xsetup r,
/usr/share/sddm/scripts/Xstop r,
/usr/share/sddm/scripts/wayland-session r,
/usr/share/sddm/scripts/Xsession r,
include if exists <local/sddm_scripts>
}
profile xauth {

96
apparmor.d/profiles-s-z/sddm-greeter
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -9,95 +10,60 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/sddm-greeter
profile sddm-greeter @{exec_path} {
include <abstractions/base>
include <abstractions/opencl-intel>
include <abstractions/freedesktop.org>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/qt5-shader-cache>
include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>
include <abstractions/qt5-compose-cache-write>
@{exec_path} mr,
/usr/share/sddm/{,**} r,
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
/usr/share/plasma/desktoptheme/** r,
/usr/share/qt5ct/** r,
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xsessions/{,*.desktop} r,
/usr/share/hwdata/pnp.ids r,
/etc/sddm.conf.d/{,*} r,
/etc/sddm.conf r,
/etc/fstab r,
/etc/machine-id r,
/var/lib/AccountsService/icons/*.icon r,
/var/lib/dbus/machine-id r,
owner /var/lib/sddm/** rw,
owner /var/lib/sddm/#[0-9]*[0-9] mrw,
owner /var/lib/sddm/.cache/** mrwkl -> /var/lib/sddm/.cache/**,
/var/lib/sddm/state.conf r,
/usr/share/sddm/{,**} r,
/etc/sddm.conf.d/{,*} r,
/etc/sddm.conf r,
# QT
/{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/*.so mr,
/{usr/,}lib/@{multiarch}/qt5/plugins/plasma/dataengine/*.so mr,
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/**.qmlc mr,
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/Private/*.jsc mr,
/{usr/,}lib/@{multiarch}/qt5/qml/QtGraphicalEffects/private/DropShadowBase.qmlc mr,
# List of graphical sessions
/usr/share/xsessions/{,*.desktop} r,
/usr/share/wayland-sessions/{,*.desktop} r,
# Themes
/usr/share/plasma/desktoptheme/** r,
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
# User avatars
/var/lib/AccountsService/icons/*.icon r,
# All the following is for the test mode
#------------------------------------------------------------------
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/sddm-greeter/ rw,
owner @{user_cache_dirs}/sddm-greeter/qmlcache/ rw,
owner @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/sddm-greeter/qmlcache/[a-f0-9]*.jsc* rwl -> @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9],
owner @{user_cache_dirs}/sddm-greeter/qmlcache/[a-f0-9]*.qmlc* rwl -> @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9],
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9],
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9],
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
owner @{user_cache_dirs}/plasma-svgelements-* rw,
owner @{user_cache_dirs}/qtshadercache/{,**} rwl,
owner @{user_cache_dirs}/sddm-greeter/{,**} rwl,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/plasmarc r,
owner @{user_config_dirs}/qt5ct/{,**} r,
/usr/share/qt5ct/** r,
# If one is blocked, the others are probed.
deny owner @{HOME}/#[0-9]*[0-9] mrw,
owner @{HOME}/.glvnd* mrw,
# owner /tmp/#[0-9]*[0-9] mrw,
# owner /tmp/.glvnd* mrw,
owner @{user_config_dirs}/kdeglobals r,
owner @{user_config_dirs}/plasmarc r,
owner @{user_cache_dirs}/icon-cache.kcache rw,
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
owner @{user_cache_dirs}/plasma-svgelements-* rw,
include <abstractions/qt5-compose-cache-write>
owner @{PROC}/@{pid}/cmdline r,
#------------------------------------------------------------------
/etc/fstab r,
/usr/share/hwdata/pnp.ids r,
owner /tmp/runtime-sddm/ rw,
owner @{run}/sddm/{,*} rw,
/{usr/,}lib/@{multiarch}/ld-*.so mr,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mounts r,
@{PROC}/sys/kernel/core_pattern r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
# file_inherit
#/dev/tty[0-9]* rw,
include if exists <local/sddm-greeter>
}

2
apparmor.d/profiles-s-z/startx
View File

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/startx
profile startx @{exec_path} {
profile startx @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>