mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-20 17:05:36 +01:00
Merge branch 'main' into feat/update
This commit is contained in:
Alex
GitHub
commit
f75e5047df
340 changed files with 1603 additions and 1539 deletions
|
|
@ -33,7 +33,8 @@
|
|||
* OpenSUSE Tumbleweed
|
||||
- Support major desktop environments:
|
||||
* Gnome
|
||||
* KDE *(work in progress)*
|
||||
* KDE
|
||||
* XFCE *(work in progress)*
|
||||
- Fully tested (Work in progress)
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@
|
|||
/tmp/.ICE-unix/* rw,
|
||||
/tmp/.X@{int}-lock rw,
|
||||
/tmp/.X11-unix/* rw,
|
||||
owner /tmp/xauth_@{rand6} rl -> /tmp/#@{int},
|
||||
owner @{tmp}/xauth_@{rand6} rl -> /tmp/#@{int},
|
||||
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw, # Xwayland
|
||||
owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,
|
||||
|
|
|
|||
|
|
@ -46,6 +46,7 @@
|
|||
ptrace (read) peer=gnome-browser-connector-host,
|
||||
ptrace (read) peer=keepassxc-proxy,
|
||||
ptrace (read) peer=lsb_release,
|
||||
ptrace (read) peer=plasma-browser-integration-host,
|
||||
ptrace (read) peer=xdg-settings,
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
|
|
@ -109,6 +110,7 @@
|
|||
/etc/@{name}/{,**} r,
|
||||
/etc/fstab r,
|
||||
/etc/opensc.conf r,
|
||||
/etc/opensc/opensc.conf r, # Debian ubication
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
|
@ -150,22 +152,22 @@
|
|||
|
||||
/tmp/ r,
|
||||
/var/tmp/ r,
|
||||
owner /tmp/.@{domain}.* rw,
|
||||
owner /tmp/.@{domain}*/{,**} rw,
|
||||
owner /tmp/@{name}-crashlog-@{int}-@{int}.txt rw,
|
||||
owner /tmp/scoped_dir*/{,**} rw,
|
||||
owner /tmp/tmp.* rw,
|
||||
owner /tmp/tmp.*/ rw,
|
||||
owner /tmp/tmp.*/** rwk,
|
||||
owner @{tmp}/.@{domain}.* rw,
|
||||
owner @{tmp}/.@{domain}*/{,**} rw,
|
||||
owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw,
|
||||
owner @{tmp}/scoped_dir*/{,**} rw,
|
||||
owner @{tmp}/tmp.* rw,
|
||||
owner @{tmp}/tmp.*/ rw,
|
||||
owner @{tmp}/tmp.*/** rwk,
|
||||
|
||||
owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw,
|
||||
owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw,
|
||||
|
||||
/dev/shm/ r,
|
||||
owner /dev/shm/.@{domain}* rw,
|
||||
|
||||
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
|
||||
|
||||
owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw,
|
||||
owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/**/devices/ r,
|
||||
@{sys}/class/**/ r,
|
||||
|
|
|
|||
|
|
@ -39,6 +39,7 @@
|
|||
@{etc_ro}/sudoers.d/{,*} r,
|
||||
|
||||
/ r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner /var/lib/sudo/ts/ rw,
|
||||
owner /var/lib/sudo/ts/@{uid} rwk,
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
|
||||
@{bin}/pam-tmpdir-helper rPx,
|
||||
|
||||
#aa:exclude ubuntu
|
||||
@{bin}/unix_chkpwd rPx,
|
||||
|
||||
#aa:only whonix
|
||||
@{bin}/pam-tmpdir-helper rPx,
|
||||
@{lib}/security-misc/pam_faillock_not_if_x rPx,
|
||||
@{lib}/security-misc/pam-abort-on-locked-password rPx,
|
||||
@{lib}/security-misc/pam-info rPx,
|
||||
|
|
|
|||
|
|
@ -19,8 +19,8 @@
|
|||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner /tmp/dbus-@{rand8} rw,
|
||||
owner /tmp/dbus-@{rand10} rw,
|
||||
owner @{tmp}/dbus-@{rand8} rw,
|
||||
owner @{tmp}/dbus-@{rand10} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/bus rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,17 +14,17 @@
|
|||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit1
|
||||
interface=org.freedesktop.RealtimeKit1
|
||||
member={MakeThreadRealtime,MakeThreadHighPriority}
|
||||
member=MakeThread*
|
||||
peer=(name=:*, label=rtkit-daemon),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit1
|
||||
interface=org.freedesktop.RealtimeKit1
|
||||
member={MakeThreadRealtime,MakeThreadHighPriority}
|
||||
member=MakeThread*
|
||||
peer=(name=org.freedesktop.RealtimeKit1),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit1
|
||||
interface=org.freedesktop.RealtimeKit1
|
||||
member=MakeThreadRealtimeWithPID
|
||||
member=MakeThread*
|
||||
peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
|
||||
|
||||
include if exists <abstractions/bus/org.freedesktop.RealtimeKit1.d>
|
||||
|
|
|
|||
|
|
@ -53,7 +53,7 @@
|
|||
owner @{user_share_dirs}/** rwkl,
|
||||
owner @{user_games_dirs}/{,**} rm,
|
||||
|
||||
owner /tmp/** rmwk,
|
||||
owner @{tmp}/** rmwk,
|
||||
owner /dev/shm/** rwlk -> /dev/shm/**,
|
||||
|
||||
@{run}/cups/cups.sock rw, # Allow access to cups printing socket.
|
||||
|
|
|
|||
|
|
@ -25,8 +25,7 @@
|
|||
/var/lib/dpkg/status r,
|
||||
/var/lib/ubuntu-advantage/apt-esm/{,**} r,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
owner /tmp/clearsigned.message.* rw,
|
||||
owner /tmp/user/@{uid}/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/clearsigned.message.* rw,
|
||||
|
||||
include if exists <abstractions/common/apt.d>
|
||||
|
|
@ -37,8 +37,8 @@
|
|||
owner / r,
|
||||
owner /newroot/{,**} w,
|
||||
|
||||
owner /tmp/newroot/ w,
|
||||
owner /tmp/oldroot/ w,
|
||||
owner @{tmp}/newroot/ w,
|
||||
owner @{tmp}/oldroot/ w,
|
||||
|
||||
@{PROC}/sys/kernel/overflowgid r,
|
||||
@{PROC}/sys/kernel/overflowuid r,
|
||||
|
|
|
|||
|
|
@ -24,12 +24,12 @@
|
|||
|
||||
/tmp/ r,
|
||||
/var/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/{,**} rw,
|
||||
owner /tmp/scoped_dir*/ rw,
|
||||
owner /tmp/scoped_dir*/SingletonCookie w,
|
||||
owner /tmp/scoped_dir*/SingletonSocket w,
|
||||
owner /tmp/scoped_dir*/SS w,
|
||||
owner @{tmp}/.org.chromium.Chromium.* rw,
|
||||
owner @{tmp}/.org.chromium.Chromium.*/{,**} rw,
|
||||
owner @{tmp}/scoped_dir*/ rw,
|
||||
owner @{tmp}/scoped_dir*/SingletonCookie w,
|
||||
owner @{tmp}/scoped_dir*/SingletonSocket w,
|
||||
owner @{tmp}/scoped_dir*/SS w,
|
||||
|
||||
/dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
|
|
|||
|
|
@ -50,14 +50,14 @@
|
|||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
owner /tmp/.org.chromium.Chromium.@{rand6} rw,
|
||||
owner /tmp/.org.chromium.Chromium.@{rand6}/ rw,
|
||||
owner /tmp/.org.chromium.Chromium.@{rand6}/SingletonCookie w,
|
||||
owner /tmp/.org.chromium.Chromium.@{rand6}/SingletonSocket w,
|
||||
owner /tmp/scoped_dir@{rand6}/ rw,
|
||||
owner /tmp/scoped_dir@{rand6}/SingletonCookie w,
|
||||
owner /tmp/scoped_dir@{rand6}/SingletonSocket w,
|
||||
owner /tmp/scoped_dir@{rand6}/SS w,
|
||||
owner @{tmp}/.org.chromium.Chromium.@{rand6} rw,
|
||||
owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw,
|
||||
owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonCookie w,
|
||||
owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonSocket w,
|
||||
owner @{tmp}/scoped_dir@{rand6}/ rw,
|
||||
owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w,
|
||||
owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w,
|
||||
owner @{tmp}/scoped_dir@{rand6}/SS w,
|
||||
|
||||
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
|
||||
|
||||
|
|
|
|||
14
apparmor.d/abstractions/fish
Normal file
14
apparmor.d/abstractions/fish
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# This abstraction is only required when an interactive shell is started.
|
||||
# Classic shell scripts do not need it.
|
||||
|
||||
/usr/share/fish/{,**} r,
|
||||
|
||||
/etc/fish/{,**} r,
|
||||
|
||||
owner @{user_config_dirs}/fish/{,**} r,
|
||||
|
||||
include if exists <abstractions/fish.d>
|
||||
|
|
@ -10,6 +10,9 @@
|
|||
@{system_share_dirs}/glib-2.0/schemas/ r,
|
||||
@{system_share_dirs}/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
@{system_share_dirs}/ r,
|
||||
@{system_share_dirs}/mime/ r,
|
||||
|
||||
/usr/share/mime/ r,
|
||||
|
||||
/etc/gnome/defaults.list r,
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@
|
|||
# Classic shell scripts do not need it.
|
||||
|
||||
include <abstractions/bash-strict>
|
||||
include <abstractions/fish>
|
||||
include <abstractions/zsh>
|
||||
|
||||
include if exists <abstractions/shells.d>
|
||||
|
|
|
|||
|
|
@ -3,3 +3,6 @@
|
|||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
@{sys}/devices/@{pci}/video4linux/video@{int}/uevent r,
|
||||
|
||||
# Access to video /dev devices
|
||||
/dev/video@{int} rw,
|
||||
|
|
|
|||
|
|
@ -15,6 +15,7 @@
|
|||
/etc/vulkan/implicit_layer.d/{,*.json} r,
|
||||
|
||||
owner @{user_share_dirs}/vulkan/implicit_layer.d/{,*.json} r,
|
||||
owner @{user_cache_dirs}/radv_builtin_shaders64 r, #Vulkan radv shaders cache
|
||||
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/drm/ r,
|
||||
|
|
@ -23,4 +24,5 @@
|
|||
@{sys}/devices/@{pci}/drm/card@{int}/metrics/ r,
|
||||
@{sys}/devices/@{pci}/drm/card@{int}/metrics/@{uuid}/id r,
|
||||
|
||||
include if exists <abstractions/vulkan-strict.d>
|
||||
include if exists <abstractions/vulkan-strict.d>
|
||||
|
||||
|
|
|
|||
|
|
@ -72,7 +72,7 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
owner @{run}/user/@{uid}/{,**} rw,
|
||||
owner @{user_config_dirs}/** rwkl,
|
||||
owner @{user_share_dirs}/** rwkl,
|
||||
owner /tmp/{,**} rwk,
|
||||
owner @{tmp}/{,**} rwk,
|
||||
|
||||
owner @{run}/user/@{uid}/{,**} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -49,8 +49,8 @@ profile akonadi_mailfilter_agent @{exec_path} {
|
|||
owner @{user_config_dirs}/kmail2rc r,
|
||||
owner @{user_config_dirs}/kwinrc r,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
owner /tmp/akonadi_mailfilter_agent.* rwl,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/akonadi_mailfilter_agent.* rwl,
|
||||
|
||||
owner @{user_config_dirs}/specialmailcollectionsrc r,
|
||||
|
||||
|
|
|
|||
|
|
@ -20,17 +20,12 @@ profile calibre @{exec_path} {
|
|||
include <abstractions/bus/org.a11y>
|
||||
include <abstractions/bus/org.gtk.vfs.MountTracker>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/nvidia>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/python>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
|
|
@ -66,7 +61,6 @@ profile calibre @{exec_path} {
|
|||
@{bin}/xdg-mime rPx,
|
||||
|
||||
/usr/share/calibre/{,**} r,
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/inputrc r,
|
||||
|
|
@ -95,12 +89,10 @@ profile calibre @{exec_path} {
|
|||
owner @{user_cache_dirs}/gstreamer-@{int}/ rw,
|
||||
owner @{user_cache_dirs}/gstreamer-@{int}/registry.*.bin{,.tmp@{rand6}} rw,
|
||||
|
||||
owner /tmp/calibre_*_tmp_*/{,**} rw,
|
||||
owner /tmp/calibre-*/{,**} rw,
|
||||
owner /tmp/@{int}-*/ rw,
|
||||
owner /tmp/@{int}-*/** rwl,
|
||||
# owner /tmp/@{int}-*/** rwl -> /tmp/@{int}-*/**, # newer AA version
|
||||
owner /tmp/* rw,
|
||||
owner @{tmp}/calibre_*_tmp_*/{,**} rw,
|
||||
owner @{tmp}/calibre-*/{,**} rw,
|
||||
owner @{tmp}/@{int}-*/ rw,
|
||||
owner @{tmp}/@{int}-*/** rwl,
|
||||
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -34,9 +34,9 @@ profile discord @{exec_path} {
|
|||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner /tmp/net-export/ rw,
|
||||
owner /tmp/discord.sock rw,
|
||||
owner "/tmp/Discord Crashes/" rw,
|
||||
owner @{tmp}/net-export/ rw,
|
||||
owner @{tmp}/discord.sock rw,
|
||||
owner "@{tmp}/Discord Crashes/" rw,
|
||||
|
||||
owner @{run}/user/@{uid}/discord-ipc-@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -60,11 +60,11 @@ profile dropbox @{exec_path} {
|
|||
@{bin}/{,@{multiarch}-}objdump rix,
|
||||
|
||||
# Needed for updating Dropbox
|
||||
owner /tmp/.dropbox-dist-new-*/{,**} rw,
|
||||
owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropboxd rix,
|
||||
owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropbox rwix,
|
||||
owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropboxd rwix,
|
||||
owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/*.so mrw,
|
||||
owner @{tmp}/.dropbox-dist-new-*/{,**} rw,
|
||||
owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropboxd rix,
|
||||
owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropbox rwix,
|
||||
owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropboxd rwix,
|
||||
owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/*.so mrw,
|
||||
owner @{HOME}/.dropbox-dist-old*/{,**} rw,
|
||||
owner @{HOME}/.dropbox-dist-tmp-*/{,**} rw,
|
||||
|
||||
|
|
@ -105,9 +105,9 @@ profile dropbox @{exec_path} {
|
|||
@{PROC}/vmstat r,
|
||||
|
||||
# Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead
|
||||
owner /tmp/dropbox-antifreeze-* rw,
|
||||
owner /tmp/[a-zA-z0-9]* rw,
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/dropbox-antifreeze-* rw,
|
||||
owner @{tmp}/[a-zA-z0-9]* rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
|
|
|||
|
|
@ -49,9 +49,9 @@ profile filezilla @{exec_path} {
|
|||
|
||||
# Creating new files on FTP
|
||||
/tmp/ r,
|
||||
owner /tmp/fz[0-9]temp-@{int}/ rw,
|
||||
owner /tmp/fz[0-9]temp-@{int}/fz*-lockfile rwk,
|
||||
owner /tmp/fz[0-9]temp-@{int}/empty_file_* rw,
|
||||
owner @{tmp}/fz[0-9]temp-@{int}/ rw,
|
||||
owner @{tmp}/fz[0-9]temp-@{int}/fz*-lockfile rwk,
|
||||
owner @{tmp}/fz[0-9]temp-@{int}/empty_file_* rw,
|
||||
|
||||
# External apps
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
|
|
|||
|
|
@ -10,20 +10,15 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/flameshot
|
||||
profile flameshot @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/X>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -36,58 +31,24 @@ profile flameshot @{exec_path} {
|
|||
|
||||
@{bin}/whoami rix,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
|
||||
# Flameshot home files
|
||||
owner @{user_config_dirs}/flameshot/ rw,
|
||||
owner @{user_config_dirs}/flameshot/flameshot.ini rw,
|
||||
owner @{user_config_dirs}/flameshot/#@{int} rw,
|
||||
owner @{user_config_dirs}/flameshot/flameshot.ini* rwl -> @{user_config_dirs}/flameshot/#@{int},
|
||||
owner @{user_config_dirs}/flameshot/flameshot.ini.lock rwk,
|
||||
@{open_path} rPx -> child-open-help,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner @{user_config_dirs}/flameshot/ rw,
|
||||
owner @{user_config_dirs}/flameshot/** rwlk -> @{user_config_dirs}/flameshot/**,
|
||||
|
||||
owner /tmp/.*/{,s} rw,
|
||||
owner /tmp/*= rw,
|
||||
owner /tmp/qipc_{systemsem,sharedmemory}_*@{hex} rw,
|
||||
owner @{tmp}/.*/{,s} rw,
|
||||
owner @{tmp}/*= rw,
|
||||
owner @{tmp}/qipc_{systemsem,sharedmemory}_*@{hex} rw,
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/flameshot>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,28 +7,19 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{TELEGRAM_WORK_DIR} = @{MOUNTS}/Kabi/telegram
|
||||
|
||||
@{exec_path} = @{bin}/telegram-desktop
|
||||
profile telegram-desktop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/common/electron>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -41,80 +32,26 @@ profile telegram-desktop @{exec_path} {
|
|||
|
||||
@{sh_path} rix,
|
||||
|
||||
# Launch external apps
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
# What's this for?
|
||||
deny @{bin}/fc-list rx,
|
||||
|
||||
# Telegram files
|
||||
/usr/share/TelegramDesktop/{,**} r,
|
||||
|
||||
# Download dir
|
||||
owner @{TELEGRAM_WORK_DIR}/ rw,
|
||||
owner @{TELEGRAM_WORK_DIR}/** rwkl -> @{TELEGRAM_WORK_DIR}/#@{int},
|
||||
|
||||
# Telegram's profile (via telegram -many -workdir ~/some/dir/)
|
||||
#owner @{TELEGRAM_WORK_DIR}/{,**} rw,
|
||||
|
||||
# Autostart
|
||||
owner @{user_config_dirs}/autostart/telegramdesktop.desktop rw,
|
||||
|
||||
owner /tmp/@{hex}-* rwk,
|
||||
owner @{run}/user/@{uid}/@{hex}-* rwk,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner @{user_config_dirs}/autostart/telegramdesktop.desktop rw,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/smplayer rPx,
|
||||
@{bin}/viewnior rPUx,
|
||||
@{bin}/qpdfview rPx,
|
||||
@{bin}/geany rPx,
|
||||
owner @{tmp}/@{hex}-* rwk,
|
||||
owner @{run}/user/@{uid}/@{hex}-* rwk,
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{TELEGRAM_WORK_DIR}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/smplayer rPx,
|
||||
@{bin}/qpdfview rPx,
|
||||
@{bin}/viewnior rPUx,
|
||||
@{bin}/geany rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/telegram-desktop>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ profile zathura @{exec_path} {
|
|||
owner @{user_config_dirs}/zathura/** r,
|
||||
owner @{user_share_dirs}/zathura/** rwk,
|
||||
|
||||
owner /tmp/gtkprint* rw,
|
||||
owner @{tmp}/gtkprint* rw,
|
||||
|
||||
include if exists <local/zathura>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -136,11 +136,11 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
/tmp/ r,
|
||||
/tmp/apt-changelog-*/ w,
|
||||
/tmp/apt-changelog-*/*.changelog w,
|
||||
owner /tmp/apt-changelog-*/.apt-acquire-privs-test.* rw,
|
||||
owner /tmp/apt-dpkg-install-*/ rw,
|
||||
owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
|
||||
owner /tmp/apt.conf.* rw,
|
||||
owner /tmp/apt.data.* rw,
|
||||
owner @{tmp}/apt-changelog-*/.apt-acquire-privs-test.* rw,
|
||||
owner @{tmp}/apt-dpkg-install-*/ rw,
|
||||
owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
|
||||
owner @{tmp}/apt.conf.* rw,
|
||||
owner @{tmp}/apt.data.* rw,
|
||||
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
|
|
@ -187,8 +187,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{HOME}/.less* rw,
|
||||
|
||||
owner /tmp/apt-changelog-*/ r,
|
||||
owner /tmp/apt-changelog-*/*.changelog r,
|
||||
owner @{tmp}/apt-changelog-*/ r,
|
||||
owner @{tmp}/apt-changelog-*/*.changelog r,
|
||||
|
||||
include if exists <local/apt_pager>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ profile apt-config @{exec_path} {
|
|||
|
||||
@{bin}/dpkg rPx -> child-dpkg,
|
||||
|
||||
owner /tmp/tmp*/apt.conf r,
|
||||
owner @{tmp}/tmp*/apt.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ profile apt-extracttemplates @{exec_path} {
|
|||
|
||||
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
|
||||
|
||||
owner /tmp/*.{config,template}.@{rand6} rw,
|
||||
owner @{tmp}/*.{config,template}.@{rand6} rw,
|
||||
owner /var/cache/debconf/tmp.ci/*.{config,template}.@{rand6} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
|
|
|||
|
|
@ -56,7 +56,7 @@ profile apt-key @{exec_path} {
|
|||
/etc/apt/trusted.gpg.d/{,*.gpg,*.asc} r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/apt-key-gpghome.*/{,**} rw,
|
||||
owner @{tmp}/apt-key-gpghome.*/{,**} rw,
|
||||
|
||||
|
||||
profile gpg {
|
||||
|
|
@ -93,9 +93,9 @@ profile apt-key @{exec_path} {
|
|||
/etc/apt/trusted.gpg.d/*.gpg r,
|
||||
/etc/apt/trusted.gpg.d/*.gpg.lock rwl -> /etc/apt/trusted.gpg.d/.#lk0x[a-f0-9]*.@{pid},
|
||||
|
||||
owner /tmp/apt-key-gpghome.*/ rw,
|
||||
owner /tmp/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
|
||||
owner /tmp/apt-key-gpghome.*/gpgoutput.{log,err} w,
|
||||
owner @{tmp}/apt-key-gpghome.*/ rw,
|
||||
owner @{tmp}/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
|
||||
owner @{tmp}/apt-key-gpghome.*/gpgoutput.{log,err} w,
|
||||
|
||||
owner @{run}/user/@{uid}/gnupg/d.*/ rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -25,9 +25,9 @@ profile apt-listbugs-migratepins @{exec_path} {
|
|||
|
||||
/etc/apt/preferences r,
|
||||
|
||||
owner /tmp/pin_migration_*-@{pid}-*/ w,
|
||||
owner /tmp/pin_migration_*-@{pid}-*/preferences w,
|
||||
owner /tmp/pin_migration_*-@{pid}-*/apt-listbugs w,
|
||||
owner @{tmp}/pin_migration_*-@{pid}-*/ w,
|
||||
owner @{tmp}/pin_migration_*-@{pid}-*/preferences w,
|
||||
owner @{tmp}/pin_migration_*-@{pid}-*/apt-listbugs w,
|
||||
|
||||
include if exists <local/apt-listbugs-migratepins>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -53,16 +53,16 @@ profile apt-listchanges @{exec_path} {
|
|||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/* rw,
|
||||
owner /tmp/apt-listchanges*/ rw,
|
||||
owner /tmp/apt-listchanges*/**/ rw,
|
||||
owner /tmp/apt-listchanges*/*/*/*/*/changelog.gz rw,
|
||||
owner /tmp/apt-listchanges*/*/*/*/*/changelog.Debian*.gz rw,
|
||||
owner /tmp/apt-listchanges*/*/*/*/*/NEWS.Debian.gz rw,
|
||||
owner /tmp/apt-listchanges*/*/*/*/*/*/changelog.gz rw,
|
||||
owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw,
|
||||
owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw,
|
||||
owner /tmp/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw,
|
||||
owner @{tmp}/* rw,
|
||||
owner @{tmp}/apt-listchanges*/ rw,
|
||||
owner @{tmp}/apt-listchanges*/**/ rw,
|
||||
owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.gz rw,
|
||||
owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.Debian*.gz rw,
|
||||
owner @{tmp}/apt-listchanges*/*/*/*/*/NEWS.Debian.gz rw,
|
||||
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog.gz rw,
|
||||
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw,
|
||||
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw,
|
||||
owner @{tmp}/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw,
|
||||
|
||||
# The following is needed when apt-listchanges uses debcconf GUI frontends.
|
||||
include <abstractions/gtk>
|
||||
|
|
@ -96,7 +96,7 @@ profile apt-listchanges @{exec_path} {
|
|||
/root/ r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/apt-listchanges-tmp*.txt r,
|
||||
owner @{tmp}/apt-listchanges-tmp*.txt r,
|
||||
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -81,9 +81,9 @@ profile apt-methods-gpgv @{exec_path} {
|
|||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/apt-key-gpghome.*/ rw,
|
||||
owner /tmp/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
|
||||
owner /tmp/apt.{conf,sig,data}.* rw,
|
||||
owner @{tmp}/apt-key-gpghome.*/ rw,
|
||||
owner @{tmp}/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
|
||||
owner @{tmp}/apt.{conf,sig,data}.* rw,
|
||||
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
|
||||
|
|
|
|||
|
|
@ -66,8 +66,8 @@ profile apt-methods-http @{exec_path} {
|
|||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/aptitude-root.*/aptitude-download-* rw,
|
||||
owner /tmp/apt-changelog-*/*.changelog rw,
|
||||
owner @{tmp}/aptitude-root.*/aptitude-download-* rw,
|
||||
owner @{tmp}/apt-changelog-*/*.changelog rw,
|
||||
|
||||
@{run}/ubuntu-advantage/aptnews.json rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -53,7 +53,7 @@ profile apt-methods-store @{exec_path} {
|
|||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/apt-changelog-*/*.changelog{,.*} rw,
|
||||
owner @{tmp}/apt-changelog-*/*.changelog{,.*} rw,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
|
|
|
|||
|
|
@ -98,9 +98,9 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
@{bin}/apt rPx,
|
||||
|
||||
# For changelogs
|
||||
owner /tmp/aptitude-*.@{pid}:*/cache{ContentCompressed,Extracted}* rw,
|
||||
owner /tmp/aptitude-*.@{pid}:*/aptitude-download-* rw,
|
||||
owner /tmp/aptitude-*.@{pid}:*/parsedchangelog* w,
|
||||
owner @{tmp}/aptitude-*.@{pid}:*/cache{ContentCompressed,Extracted}* rw,
|
||||
owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
|
||||
owner @{tmp}/aptitude-*.@{pid}:*/parsedchangelog* w,
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/aptitude/ rw,
|
||||
owner @{user_cache_dirs}/aptitude/metadata-download{,-journal} rw,
|
||||
|
|
@ -108,8 +108,8 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
@{bin}/sensible-pager rCx -> pager,
|
||||
|
||||
# For aptitude-run-state-bundle
|
||||
owner /tmp/aptitudebug.*/ r,
|
||||
owner /tmp/aptitudebug.*/** rwk,
|
||||
owner @{tmp}/aptitudebug.*/ r,
|
||||
owner @{tmp}/aptitudebug.*/** rwk,
|
||||
|
||||
/var/lib/apt-xapian-index/index r,
|
||||
/var/cache/apt-xapian-index/index.[0-9]/*.glass r,
|
||||
|
|
@ -121,11 +121,11 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/aptitude-*.@{pid}:*/ rw,
|
||||
owner /tmp/aptitude-*.@{pid}:*/{pkgstates,control}* rw,
|
||||
/tmp/aptitude-*.@{pid}:*/pkgstates* r,
|
||||
owner /tmp/apt-dpkg-install-*/ rw,
|
||||
owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
|
||||
owner @{tmp}/aptitude-*.@{pid}:*/ rw,
|
||||
owner @{tmp}/aptitude-*.@{pid}:*/{pkgstates,control}* rw,
|
||||
owner @{tmp}/apt-dpkg-install-*/ rw,
|
||||
owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
|
||||
|
||||
/var/cache/apt/ r,
|
||||
/var/cache/apt/** rwk,
|
||||
|
|
@ -180,7 +180,7 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
|
||||
owner @{HOME}/.less* rw,
|
||||
|
||||
owner /tmp/aptitude-*.@{pid}:*/aptitude-download-* rw,
|
||||
owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
|
||||
|
||||
# For shell pwd
|
||||
/root/ r,
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ profile aptitude-run-state-bundle @{exec_path} {
|
|||
|
||||
@{bin}/aptitude-curses rPx,
|
||||
|
||||
owner /tmp/aptitudebug.*/{,**} rw,
|
||||
owner @{tmp}/aptitudebug.*/{,**} rw,
|
||||
|
||||
include if exists <local/aptitude-run-state-bundle>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -41,8 +41,8 @@ profile debsign @{exec_path} {
|
|||
|
||||
owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
owner /tmp/debsign.*/ rw,
|
||||
owner /tmp/debsign.*/*.{dsc,changes,buildinfo}{,.asc} rw,
|
||||
owner @{tmp}/debsign.*/ rw,
|
||||
owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo}{,.asc} rw,
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
|
@ -52,8 +52,8 @@ profile debsign @{exec_path} {
|
|||
owner @{HOME}/@{XDG_GPG_DIR}/ r,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
owner /tmp/debsign.*/*.{dsc,changes,buildinfo} r,
|
||||
owner /tmp/debsign.*/*.{dsc,changes,buildinfo}.asc rw,
|
||||
owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo} r,
|
||||
owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo}.asc rw,
|
||||
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -67,7 +67,7 @@ profile dpkg @{exec_path} {
|
|||
/usr/** rwlk -> /usr/**,
|
||||
/var/** rwlk -> /var/**,
|
||||
|
||||
owner /tmp/apt-dpkg-install-*/ r,
|
||||
owner @{tmp}/apt-dpkg-install-*/ r,
|
||||
|
||||
@{run}/systemd/userdb/ r,
|
||||
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ profile dpkg-architecture @{exec_path} {
|
|||
/etc/debian_version r,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/* rw,
|
||||
owner @{tmp}/* rw,
|
||||
|
||||
|
||||
profile ccache {
|
||||
|
|
|
|||
|
|
@ -25,13 +25,13 @@ profile dpkg-deb @{exec_path} {
|
|||
owner /var/lib/dpkg/tmp.ci/* w,
|
||||
|
||||
# For creating deb packages
|
||||
owner /tmp/dpkg-deb.* rw,
|
||||
owner @{tmp}/dpkg-deb.* rw,
|
||||
|
||||
owner /tmp/dpkg-deb.*/ rw,
|
||||
owner /tmp/dpkg-deb.*/* rw,
|
||||
owner @{tmp}/dpkg-deb.*/ rw,
|
||||
owner @{tmp}/dpkg-deb.*/* rw,
|
||||
|
||||
# For extracting deb packages to /tmp/
|
||||
owner /tmp/** rw,
|
||||
owner @{tmp}/** rw,
|
||||
|
||||
/var/cache/apt/archives/*.deb r,
|
||||
|
||||
|
|
|
|||
|
|
@ -39,8 +39,8 @@ profile dpkg-preconfigure @{exec_path} {
|
|||
/etc/inputrc r,
|
||||
/etc/shadow r,
|
||||
|
||||
owner /tmp/*.template.* rw,
|
||||
owner /tmp/*.config.* rwPUx,
|
||||
owner @{tmp}/*.template.* rw,
|
||||
owner @{tmp}/*.config.* rwPUx,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
owner /var/cache/debconf/ rw,
|
||||
|
|
|
|||
|
|
@ -77,8 +77,8 @@ profile reportbug @{exec_path} {
|
|||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
owner /tmp/* rw,
|
||||
owner /tmp/reportbug-*-@{int}-@{pid}-* rw,
|
||||
owner @{tmp}/* rw,
|
||||
owner @{tmp}/reportbug-*-@{int}-@{pid}-* rw,
|
||||
owner /var/tmp/*.bug{,~} rw,
|
||||
|
||||
@{sys}/module/apparmor/parameters/enabled r,
|
||||
|
|
@ -101,7 +101,7 @@ profile reportbug @{exec_path} {
|
|||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
owner /tmp/reportbug-*-{signed,unsigned}-* rw,
|
||||
owner @{tmp}/reportbug-*-{signed,unsigned}-* rw,
|
||||
owner @{HOME}/draftbugreports/reportbug-*-{signed,unsigned}-* rw,
|
||||
|
||||
include if exists <local/reportbug_gpg>
|
||||
|
|
|
|||
|
|
@ -132,8 +132,8 @@ profile synaptic @{exec_path} {
|
|||
/etc/machine-id r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/apt-dpkg-install-*/ rw,
|
||||
owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
|
||||
owner @{tmp}/apt-dpkg-install-*/ rw,
|
||||
owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
|
||||
|
||||
/var/cache/apt/ r,
|
||||
/var/cache/apt/** rwk,
|
||||
|
|
|
|||
|
|
@ -103,7 +103,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{run}/unattended-upgrades.pid rw,
|
||||
owner @{run}/unattended-upgrades.progress rw,
|
||||
|
||||
owner /tmp/apt-dpkg-install-*/{,*} rw,
|
||||
owner @{tmp}/apt-dpkg-install-*/{,*} rw,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
owner @{PROC}/@{pids}/fd/ r,
|
||||
|
|
|
|||
|
|
@ -37,10 +37,10 @@ profile brave @{exec_path} {
|
|||
owner @{config_dirs}/WidevineCdm/libwidevinecdm.so mrw,
|
||||
owner @{cache_dirs}/BraveSoftware/ rw,
|
||||
|
||||
owner /tmp/net-export/ rw, # For brave://net-export/
|
||||
owner @{tmp}/net-export/ rw, # For brave://net-export/
|
||||
|
||||
owner /tmp/.org.chromium.Chromium.* rwk,
|
||||
owner /tmp/.org.chromium.Chromium*/{,**} rw,
|
||||
owner @{tmp}/.org.chromium.Chromium.* rwk,
|
||||
owner @{tmp}/.org.chromium.Chromium*/{,**} rw,
|
||||
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -38,9 +38,9 @@ profile chromium-wrapper @{exec_path} {
|
|||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner /tmp/chromiumargs.@{rand6} rw,
|
||||
owner /tmp/tmp.*/ rw,
|
||||
owner /tmp/tmp.*/** rwk,
|
||||
owner @{tmp}/chromiumargs.@{rand6} rw,
|
||||
owner @{tmp}/tmp.*/ rw,
|
||||
owner @{tmp}/tmp.*/** rwk,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
/dev/dri/card[0-9] rw,
|
||||
|
|
|
|||
22
apparmor.d/groups/browsers/ephy-profile-migrator
Normal file
22
apparmor.d/groups/browsers/ephy-profile-migrator
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/epiphany/ephy-profile-migrator
|
||||
profile ephy-profile-migrator @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/gnome-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{user_cache_dirs}/epiphany/** rw,
|
||||
owner @{user_config_dirs}/epiphany/{,**} rw,
|
||||
owner @{user_share_dirs}/epiphany/.migrated{,.@{rand6}} rw,
|
||||
|
||||
include if exists <local/ephy-profile-migrator>
|
||||
}
|
||||
74
apparmor.d/groups/browsers/epiphany
Normal file
74
apparmor.d/groups/browsers/epiphany
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/epiphany
|
||||
profile epiphany @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-server>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.GeoClue2>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/common/gnome>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
capability dac_override,
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
mount options=(rw rbind) /bindfile@{rand6} -> /newroot/.flatpak-info,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/bwrap rix,
|
||||
@{bin}/xdg-dbus-proxy rix,
|
||||
@{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix,
|
||||
|
||||
owner /bindfile@{rand6} rw,
|
||||
owner /.flatpak-info r,
|
||||
|
||||
owner @{user_config_dirs}/glib-2.0/ w,
|
||||
owner @{user_config_dirs}/glib-2.0/settings/ w,
|
||||
|
||||
owner @{tmp}/epiphany-*-@{rand6}/{,**} rw,
|
||||
owner @{tmp}/Serialized@{rand9} rw,
|
||||
owner @{tmp}/WebKit-Media-@{rand6} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw,
|
||||
owner @{run}/user/@{uid}/.flatpak/ w,
|
||||
owner @{run}/user/@{uid}/.flatpak/webkit-*/{,bwrapinfo.json} rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/ w,
|
||||
owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-@{rand6} rw,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
||||
@{sys}/firmware/acpi/pm_profile r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-org.gnome.Epiphany-@{int}.scope/memory.* r,
|
||||
|
||||
@{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
|
||||
@{PROC}/zoneinfo r,
|
||||
owner @{PROC}/@{pid}/smaps r,
|
||||
owner @{PROC}/@{pid}/statm r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
/dev/video@{int} rw,
|
||||
|
||||
include if exists <local/epiphany>
|
||||
}
|
||||
|
|
@ -119,6 +119,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
|
|||
/etc/mailcap r,
|
||||
/etc/mime.types r,
|
||||
/etc/opensc.conf r,
|
||||
/etc/opensc/opensc.conf r,
|
||||
/etc/sysconfig/proxy r,
|
||||
/etc/xdg/* r,
|
||||
/etc/xul-ext/kwallet5.js r,
|
||||
|
|
@ -155,32 +156,27 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/tmp/ r,
|
||||
/var/tmp/ r,
|
||||
owner /tmp/.xfsm-ICE-@{rand6} rw,
|
||||
owner /tmp/@{name}/ rw,
|
||||
owner /tmp/@{name}/* rwk,
|
||||
owner /tmp/@{rand6}.tmp r,
|
||||
owner /tmp/@{rand8}.txt w,
|
||||
owner /tmp/* w, # file downloads (to anywhere)
|
||||
owner /tmp/firefox_*/ rw,
|
||||
owner /tmp/firefox_*/* rwk,
|
||||
owner /tmp/mozilla_*/ rw,
|
||||
owner /tmp/mozilla_*/* rw,
|
||||
owner /tmp/mozilla-temp-@{int} rw,
|
||||
owner /tmp/Mozilla@{uuid}-cachePurge-??????????????? rwk,
|
||||
owner /tmp/Mozilla\{@{uuid}\}-cachePurge-??????????????? rwk,
|
||||
owner /tmp/MozillaBackgroundTask-???????????????-removeDirectory/.parentlock k,
|
||||
owner /tmp/MozillaBackgroundTask-???????????????-removeDirectory/{**,} rw,
|
||||
owner /tmp/Mozillato-be-removed-cachePurge-??????????????? rwk,
|
||||
owner /tmp/Temp-@{uuid}/{**,} rw,
|
||||
owner /tmp/tmp-???.xpi rw,
|
||||
owner /tmp/tmpaddon r,
|
||||
owner /tmp/tmpaddon-@{int} r,
|
||||
owner /tmp/user/@{uid}/ rw,
|
||||
owner /tmp/user/@{uid}/@{name}/ rw,
|
||||
owner /tmp/user/@{uid}/@{name}/* rwk,
|
||||
owner /tmp/user/@{uid}/* rwk,
|
||||
owner /tmp/user/@{uid}/Temp-@{uuid}/ rw,
|
||||
owner /tmp/user/@{uid}/Temp-@{uuid}/* rwk,
|
||||
owner @{tmp}/.xfsm-ICE-@{rand6} rw,
|
||||
owner @{tmp}/@{name}/ rw,
|
||||
owner @{tmp}/@{name}/* rwk,
|
||||
owner @{tmp}/@{rand6}.tmp r,
|
||||
owner @{tmp}/@{rand8}.txt w,
|
||||
owner @{tmp}/* w, # file downloads (to anywhere)
|
||||
owner @{tmp}/firefox_*/ rw,
|
||||
owner @{tmp}/firefox_*/* rwk,
|
||||
owner @{tmp}/mozilla_*/ rw,
|
||||
owner @{tmp}/mozilla_*/* rw,
|
||||
owner @{tmp}/mozilla-temp-@{int} rw,
|
||||
owner @{tmp}/Mozilla@{uuid}-cachePurge-??????????????? rwk,
|
||||
owner @{tmp}/Mozilla\{@{uuid}\}-cachePurge-??????????????? rwk,
|
||||
owner @{tmp}/MozillaBackgroundTask-???????????????-removeDirectory/.parentlock k,
|
||||
owner @{tmp}/MozillaBackgroundTask-???????????????-removeDirectory/{**,} rw,
|
||||
owner @{tmp}/Mozillato-be-removed-cachePurge-??????????????? rwk,
|
||||
owner @{tmp}/Temp-@{uuid}/ rw,
|
||||
owner @{tmp}/Temp-@{uuid}/** rwk,
|
||||
owner @{tmp}/tmp-???.xpi rw,
|
||||
owner @{tmp}/tmpaddon r,
|
||||
owner @{tmp}/tmpaddon-@{int} r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
|
|
|
|||
|
|
@ -46,8 +46,8 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/tmp/ r,
|
||||
/var/tmp/ r,
|
||||
owner /tmp/@{hex}.{dmp,extra} rw,
|
||||
owner /tmp/firefox/.parentlock w,
|
||||
owner @{tmp}/@{hex}.{dmp,extra} rw,
|
||||
owner @{tmp}/firefox/.parentlock w,
|
||||
|
||||
owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{config_dirs}/firefox/*/.parentlock rw,
|
||||
|
||||
owner /tmp/@{name}/.parentlock rw,
|
||||
owner @{tmp}/@{name}/.parentlock rw,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
|
|
|
|||
|
|
@ -34,8 +34,8 @@ profile firefox-minidump-analyzer @{exec_path} {
|
|||
|
||||
owner @{cache_dirs}/firefox/*.*/startupCache/*Cache* r,
|
||||
|
||||
owner /tmp/@{hex}.{dmp,extra} rw,
|
||||
owner /tmp/firefox/.parentlock w,
|
||||
owner @{tmp}/@{hex}.{dmp,extra} rw,
|
||||
owner @{tmp}/firefox/.parentlock w,
|
||||
|
||||
owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ profile firefox-vaapitest @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /tmp/@{name}/.parentlock rw,
|
||||
owner @{tmp}/@{name}/.parentlock rw,
|
||||
|
||||
deny @{config_dirs}/firefox/*/.parentlock rw,
|
||||
deny @{config_dirs}/firefox/*/startupCache/** r,
|
||||
|
|
|
|||
41
apparmor.d/groups/browsers/msedge
Normal file
41
apparmor.d/groups/browsers/msedge
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022-2024 Jose Maldonado <josemald89@gmail.com>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{name} = msedge{,-beta,-dev}
|
||||
@{domain} = com.microsoft.Edge
|
||||
@{lib_dirs} = /opt/microsoft/@{name}
|
||||
@{config_dirs} = @{user_config_dirs}/microsoft-edge{,-beta,-dev}
|
||||
@{cache_dirs} = @{user_cache_dirs}/microsoft-edge{,-beta,-dev}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile msedge @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{bin}/man rPUx, # For "chrome --help"
|
||||
|
||||
@{lib_dirs}/xdg-mime rix, #-> xdg-mime,
|
||||
@{lib_dirs}/xdg-settings rix, #-> xdg-settings,
|
||||
|
||||
@{lib_dirs}/microsoft-edge{,beta,-dev} rPx,
|
||||
@{lib_dirs}/msedge_crashpad_handler rPx,
|
||||
|
||||
@{lib_dirs}/*.so* mr,
|
||||
@{lib_dirs}/WidevineCdm/_platform_specific/linux_*/libwidevinecdm.so mr,
|
||||
|
||||
owner @{user_cache_dirs}/Microsoft/ rw,
|
||||
owner @{user_cache_dirs}/Microsoft/** rwk,
|
||||
|
||||
owner @{tmp}/.ses rw,
|
||||
owner @{tmp}/cv_debug.log rw,
|
||||
|
||||
include if exists <local/msedge>
|
||||
}
|
||||
36
apparmor.d/groups/browsers/msedge-crashpad-handlers
Normal file
36
apparmor.d/groups/browsers/msedge-crashpad-handlers
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022-2024 Jose Maldonado <josemald89@gmail.com>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = /opt/microsoft/msedge{,-beta,-dev}
|
||||
@{config_dirs} = @{user_config_dirs}/microsoft-edge{,-beta,-dev}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/msedge_crashpad_handler
|
||||
profile msedge-crashpad-handler @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace peer=msedge,
|
||||
signal (send) peer=msedge,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
owner "@{config_dirs}/Crash Reports/**" rwk,
|
||||
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pids}/mem r,
|
||||
owner @{PROC}/@{pids}/stat r,
|
||||
owner @{PROC}/@{pids}/task/ r,
|
||||
|
||||
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
|
||||
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_max_freq r,
|
||||
|
||||
include if exists <local/msedge-crashpad-handler>
|
||||
}
|
||||
32
apparmor.d/groups/browsers/msedge-sandbox
Normal file
32
apparmor.d/groups/browsers/msedge-sandbox
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022-2024 Jose Maldonado <josemald89@gmail.com>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = /opt/microsoft/msedge{,-beta,-dev}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/msedge-sandbox
|
||||
profile msedge-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability sys_resource,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib_dirs}/msedge{,-beta,-dev} rPx,
|
||||
|
||||
@{PROC} r,
|
||||
@{PROC}/@{pids}/ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
|
||||
include if exists <local/msedge-sandbox>
|
||||
}
|
||||
40
apparmor.d/groups/browsers/msedge-wrapper
Normal file
40
apparmor.d/groups/browsers/msedge-wrapper
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022-2024 Jose Maldonado <josemald89@gmail.com>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = /opt/microsoft/msedge{,-beta,-dev}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/microsoft-edge{,-beta,-dev}
|
||||
profile msedge-wrapper @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/cat rix,
|
||||
@{bin}/dirname rix,
|
||||
@{bin}/mkdir rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/touch rix,
|
||||
@{bin}/which{,.debianutils} rix,
|
||||
|
||||
@{lib_dirs}/msedge rPx,
|
||||
|
||||
owner @{user_config_dirs}/msedge-flags.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/* rw,
|
||||
|
||||
# File Inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# Silencer
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
include if exists <local/msedge-wrapper>
|
||||
}
|
||||
|
|
@ -17,7 +17,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (receive) set=(term hup kill) peer=dbus-session,
|
||||
signal (receive) set=(term hup kill) peer=gdm,
|
||||
signal (receive) set=(term hup kill) peer=gdm{,-session-worker},
|
||||
|
||||
dbus bus=accessibility,
|
||||
|
||||
|
|
|
|||
|
|
@ -55,7 +55,7 @@ profile cron @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
|
|
@ -71,7 +71,7 @@ profile cron @{exec_path} flags=(attach_disconnected) {
|
|||
/etc/cron.*/ r,
|
||||
/etc/cron.*/* rPUx,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
include if exists <local/cron_run_parts>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -75,16 +75,16 @@ profile cron-apt @{exec_path} {
|
|||
|
||||
# TMP
|
||||
/tmp/ r,
|
||||
owner /tmp/cron-apt.*/ rw,
|
||||
owner /tmp/cron-apt.*/difftemp rw,
|
||||
owner /tmp/cron-apt.*/lockfile rw,
|
||||
owner /tmp/cron-apt.*/initlog rw,
|
||||
owner /tmp/cron-apt.*/status rw,
|
||||
owner /tmp/cron-apt.*/run{log,error,mail,syslog} rw,
|
||||
owner /tmp/cron-apt.*/action{log,error,mail,syslog} rw,
|
||||
owner @{tmp}/cron-apt.*/ rw,
|
||||
owner @{tmp}/cron-apt.*/difftemp rw,
|
||||
owner @{tmp}/cron-apt.*/lockfile rw,
|
||||
owner @{tmp}/cron-apt.*/initlog rw,
|
||||
owner @{tmp}/cron-apt.*/status rw,
|
||||
owner @{tmp}/cron-apt.*/run{log,error,mail,syslog} rw,
|
||||
owner @{tmp}/cron-apt.*/action{log,error,mail,syslog} rw,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
include if exists <local/cron-apt>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -54,11 +54,11 @@ profile cron-popularity-contest @{exec_path} {
|
|||
/var/lib/popularity-contest/ rw,
|
||||
/var/lib/popularity-contest/lastsub rw,
|
||||
|
||||
owner /tmp/tmp.*/ rw,
|
||||
owner /tmp/tmp.*/random_seed w,
|
||||
owner @{tmp}/tmp.*/ rw,
|
||||
owner @{tmp}/tmp.*/random_seed w,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
|
||||
profile savelog {
|
||||
|
|
@ -83,7 +83,7 @@ profile cron-popularity-contest @{exec_path} {
|
|||
/var/log/popularity-contest rw,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -107,7 +107,7 @@ profile cron-popularity-contest @{exec_path} {
|
|||
/var/log/popularity-contest.new w,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -124,10 +124,10 @@ profile cron-popularity-contest @{exec_path} {
|
|||
/var/log/popularity-contest.@{int} r,
|
||||
/var/log/popularity-contest.@{int}.gpg rw,
|
||||
|
||||
owner /tmp/tmp.*/** rwkl -> /tmp/tmp.*/**,
|
||||
owner @{tmp}/tmp.*/** rwkl -> /tmp/tmp.*/**,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -152,7 +152,7 @@ profile cron-popularity-contest @{exec_path} {
|
|||
/var/log/popularity-contest.@{int}.gpg r,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ profile crontab @{exec_path} {
|
|||
/var/spool/cron/crontabs/ rw,
|
||||
owner /var/spool/cron/crontabs/* rw,
|
||||
|
||||
owner /tmp/crontab.*/{,crontab} rw,
|
||||
owner @{tmp}/crontab.*/{,crontab} rw,
|
||||
|
||||
|
||||
profile editor {
|
||||
|
|
@ -51,7 +51,7 @@ profile crontab @{exec_path} {
|
|||
owner @{HOME}/.viminfo{,.tmp} rw,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/crontab.*/crontab rw,
|
||||
owner @{tmp}/crontab.*/crontab rw,
|
||||
|
||||
# file_inherit
|
||||
/etc/cron.{allow,deny} r,
|
||||
|
|
|
|||
|
|
@ -65,9 +65,8 @@ profile x11-xsession @{exec_path} {
|
|||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner /tmp/file* rw,
|
||||
owner /tmp/tmp.@{rand10} rw,
|
||||
owner /tmp/user/@{uid}/tmp.@{rand10} rw,
|
||||
owner @{tmp}/file* rw,
|
||||
owner @{tmp}/tmp.@{rand10} rw,
|
||||
|
||||
profile ssh-agent {
|
||||
include <abstractions/base>
|
||||
|
|
@ -88,8 +87,8 @@ profile x11-xsession @{exec_path} {
|
|||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner /tmp/ssh-*/ rw,
|
||||
owner /tmp/ssh-*/agent.* rw,
|
||||
owner @{tmp}/ssh-*/ rw,
|
||||
owner @{tmp}/ssh-*/agent.* rw,
|
||||
|
||||
include if exists <local/x11-xsession_ssh-agent>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -75,8 +75,8 @@ profile xdm-xsession @{exec_path} {
|
|||
|
||||
@{run}/user/@{uid}/xauth_@{rand6} rl,
|
||||
|
||||
owner /tmp/ssh-*/ rw,
|
||||
owner /tmp/ssh-*/agent.* rw,
|
||||
owner @{tmp}/ssh-*/ rw,
|
||||
owner @{tmp}/ssh-*/agent.* rw,
|
||||
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/@{pids}/statm r,
|
||||
|
|
|
|||
|
|
@ -75,7 +75,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
# wtmp.d ?
|
||||
/var/log/wtmp r,
|
||||
|
||||
owner /tmp/gnome-control-center-user-icon-@{rand6} rw,
|
||||
owner @{tmp}/gnome-control-center-user-icon-@{rand6} rw,
|
||||
|
||||
include if exists <local/accounts-daemon>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ profile dconf-service @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/dconf-write>
|
||||
|
||||
signal (receive) set=(term kill hup) peer=dbus-session,
|
||||
signal (receive) set=(term hup) peer=gdm,
|
||||
signal (receive) set=(term hup) peer=gdm{,-session-worker},
|
||||
|
||||
#aa:dbus own bus=session name=ca.desrt.dconf
|
||||
|
||||
|
|
|
|||
|
|
@ -49,7 +49,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_config_dirs}/pipewire/{,**} r,
|
||||
|
||||
owner /tmp/librnnoise-@{int}.so rm,
|
||||
owner @{tmp}/librnnoise-@{int}.so rm,
|
||||
|
||||
owner @{run}/user/@{uid}/pipewire-@{int} rw,
|
||||
owner @{run}/user/@{uid}/pipewire-@{int}-manager.lock rwk,
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@ profile pipewire-pulse @{exec_path} flags=(attach_disconnected) {
|
|||
/.flatpak-info r,
|
||||
|
||||
owner @{run}/user/@{uid}/pulse/pid w,
|
||||
owner /tmp/librnnoise-@{int}.so rm,
|
||||
owner @{tmp}/librnnoise-@{int}.so rm,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,8 @@ include <tunables/global>
|
|||
profile plymouthd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri>
|
||||
include <abstractions/fonts>
|
||||
|
||||
capability checkpoint_restore,
|
||||
capability dac_override,
|
||||
|
|
@ -52,7 +53,6 @@ profile plymouthd @{exec_path} {
|
|||
@{sys}/class/ r,
|
||||
@{sys}/class/drm/ r,
|
||||
@{sys}/class/graphics/ r,
|
||||
@{sys}/devices/@{pci}/{,uevent,vendor,device} r,
|
||||
@{sys}/devices/virtual/graphics/fbcon/uevent r,
|
||||
@{sys}/devices/virtual/tty/console/active r,
|
||||
@{sys}/firmware/acpi/bgrt/{,*} r,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,6 @@ include <tunables/global>
|
|||
@{exec_path} += @{lib}/polkit-gnome/polkit-gnome-authentication-agent-1
|
||||
profile polkit-gnome-authentication-agent @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/gnome-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -37,8 +37,8 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected)
|
|||
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
|
||||
owner /tmp/#@{int} rw,
|
||||
owner /tmp/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int},
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int},
|
||||
# owner /tmp/xauth_@{rand6} r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
|
|
|||
|
|
@ -78,12 +78,9 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/var/lib/gdm{,3}/greeter-dconf-defaults r,
|
||||
|
||||
/var/lib/flatpak/exports/share/mime/mime.cache r,
|
||||
/var/lib/flatpak/exports/share/applications/{**,} r,
|
||||
|
||||
@{user_config_dirs}/kioslaverc r,
|
||||
|
||||
owner /tmp/icon* rw,
|
||||
owner @{tmp}/icon* rw,
|
||||
|
||||
owner @{run}/user/@{uid}/.flatpak/{,*/*} r,
|
||||
owner @{run}/user/@{uid}/pipewire-@{int} rw,
|
||||
|
|
|
|||
|
|
@ -72,8 +72,8 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{HOME}/*/{,**} rw,
|
||||
|
||||
owner /tmp/.goutputstream-@{rand6} rw,
|
||||
owner /tmp/@{rand6} rw,
|
||||
owner @{tmp}/.goutputstream-@{rand6} rw,
|
||||
owner @{tmp}/@{rand6} rw,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
|
|
|
|||
|
|
@ -62,12 +62,9 @@ profile xdg-desktop-portal-gtk @{exec_path} {
|
|||
owner @{HOME}/.icons/{,**} r,
|
||||
owner @{HOME}/@{XDG_DATA_DIR}/ r,
|
||||
|
||||
owner /tmp/runtime-*/xauth_@{rand6} r,
|
||||
owner @{tmp}/runtime-*/xauth_@{rand6} r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
@{run}/user/@{uid}/xauth_@{rand6} rl,
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw,
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
||||
@{run}/mount/utab r,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ profile xdg-icon-resource @{exec_path} flags=(attach_disconnected) {
|
|||
/usr/share/icons/*/.xdg-icon-resource-dummy rw,
|
||||
/usr/share/terminfo/** r,
|
||||
|
||||
owner /tmp/.com.google.Chrome.*/chrome-*.png r,
|
||||
owner @{tmp}/.com.google.Chrome.*/chrome-*.png r,
|
||||
|
||||
owner @{user_share_dirs}/icons/**/apps/chrome-*.png rw,
|
||||
owner @{user_share_dirs}/icons/**/.xdg-icon-resource-dummy rw,
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ profile xdg-screensaver @{exec_path} {
|
|||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.Xauthority r,
|
||||
owner /tmp/xauth-@{int}-_[0-9] r,
|
||||
owner @{tmp}/xauth-@{int}-_[0-9] r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
|
|
|
|||
|
|
@ -31,7 +31,7 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{run}/user/@{uid}/server-@{int}.xkm rwk,
|
||||
|
||||
owner /tmp/server-@{int}.xkm rwk,
|
||||
owner @{tmp}/server-@{int}.xkm rwk,
|
||||
|
||||
/dev/dri/card@{int} rw,
|
||||
/dev/fb@{int} rw,
|
||||
|
|
|
|||
|
|
@ -83,10 +83,10 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/tmp/ r,
|
||||
/tmp/server-@{int}.xkm rw,
|
||||
owner /tmp/.tX@{int}-lock rwk,
|
||||
owner /tmp/.X@{int}-lock rwkl -> /tmp/.tX@{int}-lock,
|
||||
owner /tmp/server-* rwk,
|
||||
owner /tmp/serverauth.* r,
|
||||
owner @{tmp}/.tX@{int}-lock rwk,
|
||||
owner @{tmp}/.X@{int}-lock rwkl -> /tmp/.tX@{int}-lock,
|
||||
owner @{tmp}/server-* rwk,
|
||||
owner @{tmp}/serverauth.* r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/pci/devices/ r,
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/xprop
|
||||
profile xprop @{exec_path} {
|
||||
profile xprop @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/X-strict>
|
||||
|
|
|
|||
|
|
@ -37,12 +37,12 @@ profile xrdb @{exec_path} {
|
|||
|
||||
owner @{user_share_dirs}/sddm/wayland-session.log w,
|
||||
|
||||
owner /tmp/kcminit.* r,
|
||||
owner /tmp/kded{5,6}.@{rand6} r,
|
||||
owner /tmp/plasma-apply-lookandfeel.* r,
|
||||
owner /tmp/runtime-*/xauth_@{rand6} r,
|
||||
owner /tmp/startplasma-x11.@{rand6} r,
|
||||
owner /tmp/xauth-@{int}-_[0-9] r,
|
||||
owner @{tmp}/kcminit.* r,
|
||||
owner @{tmp}/kded{5,6}.@{rand6} r,
|
||||
owner @{tmp}/plasma-apply-lookandfeel.* r,
|
||||
owner @{tmp}/runtime-*/xauth_@{rand6} r,
|
||||
owner @{tmp}/startplasma-x11.@{rand6} r,
|
||||
owner @{tmp}/xauth-@{int}-_[0-9] r,
|
||||
|
||||
@{run}/sddm/\{@{uuid}\} r,
|
||||
@{run}/sddm/xauth_@{rand6} r,
|
||||
|
|
|
|||
|
|
@ -14,6 +14,8 @@ profile xsetroot @{exec_path} {
|
|||
|
||||
capability dac_read_search,
|
||||
|
||||
signal (receive) set=(kill) peer=sddm,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/icons/{,**} r,
|
||||
|
|
@ -27,7 +29,7 @@ profile xsetroot @{exec_path} {
|
|||
owner @{user_share_dirs}/sddm/xorg-session.log w,
|
||||
owner @{user_share_dirs}/sddm/wayland-session.log w,
|
||||
|
||||
owner /tmp/xauth_@{rand6} r,
|
||||
owner @{tmp}/xauth_@{rand6} r,
|
||||
|
||||
@{run}/sddm/\{@{uuid}\} r,
|
||||
@{run}/user/@{uid}/xauth_@{rand6} rl,
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
|
|||
/usr/share/fonts/{,**} r,
|
||||
/usr/share/ghostscript/fonts/{,**} r,
|
||||
|
||||
owner /tmp/server-@{int}.xkm rwk,
|
||||
owner @{tmp}/server-@{int}.xkm rwk,
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw,
|
||||
owner @{run}/user/@{uid}/server-@{int}.xkm rw,
|
||||
owner @{run}/user/@{uid}/xwayland-shared-@{rand6} rw,
|
||||
|
|
|
|||
|
|
@ -31,13 +31,13 @@ profile epiphany-search-provider @{exec_path} {
|
|||
owner @{user_cache_dirs}/epiphany/{,**} rwk,
|
||||
owner @{user_share_dirs}/epiphany/{,**} rwk,
|
||||
|
||||
owner /tmp/ContentRuleList@{rand6} rw,
|
||||
owner /tmp/Serialized* rw,
|
||||
owner @{tmp}/ContentRuleList@{rand6} rw,
|
||||
owner @{tmp}/Serialized* rw,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
||||
@{sys}/firmware/acpi/pm_profile r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.Epiphany.SearchProvider.slice/*/memory.* r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
|
||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
||||
@{sys}/firmware/acpi/pm_profile r,
|
||||
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.Epiphany.SearchProvider.slice/*/memory.* r,
|
||||
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
|
||||
|
||||
@{PROC}/driver/nvidia/params r,
|
||||
@{PROC}/modules r,
|
||||
|
|
|
|||
|
|
@ -33,11 +33,14 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
|
|||
signal (receive) set=term peer=gdm,
|
||||
signal (send) set=(hup term) peer=gdm-session,
|
||||
signal (send) set=hup peer=at-spi*,
|
||||
signal (send) set=hup peer=dbus-accessibility,
|
||||
signal (send) set=hup peer=dbus-session,
|
||||
signal (send) set=hup peer=dconf-service,
|
||||
signal (send) set=hup peer=gjs-console,
|
||||
signal (send) set=hup peer=gnome-*,
|
||||
signal (send) set=hup peer=gsd-*,
|
||||
signal (send) set=hup peer=ibus-*,
|
||||
signal (send) set=hup peer=mutter-x11-frames,
|
||||
signal (send) set=hup peer=tracker-miner,
|
||||
signal (send) set=hup peer=xdg-*,
|
||||
signal (send) set=hup peer=xorg,
|
||||
|
|
@ -45,7 +48,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
unix (bind) type=stream addr=@@{hex}/bus/gdm-session-wor/system,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.Accounts.User label=accounts-daemon
|
||||
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/login1
|
||||
interface=org.freedesktop.login1.Manager
|
||||
|
|
|
|||
|
|
@ -59,7 +59,7 @@ profile gdm-xsession @{exec_path} {
|
|||
/etc/default/im-config r,
|
||||
/etc/X11/{,**} r,
|
||||
|
||||
owner /tmp/gdm{3,}-config-err-@{rand6} rw,
|
||||
owner @{tmp}/gdm{3,}-config-err-@{rand6} rw,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{HOME}/{,**} rw,
|
||||
|
||||
owner /tmp/wl-copy-buffer-@{rand6}/stdin r,
|
||||
owner @{tmp}/wl-copy-buffer-@{rand6}/stdin r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
|
|
|
|||
|
|
@ -39,11 +39,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
|
|||
interface=org.freedesktop.DBus.Properties
|
||||
peer=(name=:*, label=gnome-shell),
|
||||
|
||||
dbus send bus=session path=/org/gnome/ScreenSaver
|
||||
interface=org.gnome.ScreenSaver
|
||||
member=GetActive
|
||||
peer=(name=org.gnome.Shell.ScreenShield, label=gnome-shell),
|
||||
|
||||
dbus send bus=session path=/org/gnome/Shell
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ profile gnome-calendar @{exec_path} {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
#aa:dbus own bus=session name=org.gnome.Calendar interface={org.freedesktop.Application,org.gtk.Actions}
|
||||
#aa:dbus own bus=session name=org.gnome.Calendar
|
||||
|
||||
#aa:dbus talk bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} label=evolution-addressbook-factory
|
||||
#aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Calendar@{int} label=evolution-calendar-factory
|
||||
|
|
|
|||
|
|
@ -127,7 +127,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_share_dirs}/gnome-remote-desktop/rdp-tls.{crt,key}{,.@{rand6}} rw,
|
||||
owner @{user_share_dirs}/icc/{,edid-*} r,
|
||||
|
||||
owner /tmp/gdkpixbuf-xpm-tmp.@{rand6} rw,
|
||||
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
|
||||
|
||||
@{run}/cups/cups.sock rw,
|
||||
@{run}/samba/ rw,
|
||||
|
|
|
|||
|
|
@ -46,8 +46,6 @@ profile gnome-control-center-goa-helper @{exec_path} {
|
|||
/usr/share/cracklib/* r,
|
||||
/usr/share/publicsuffix/public_suffix_list.dafsa r,
|
||||
|
||||
/var/lib/flatpak/exports/share/icons/{,**} r,
|
||||
|
||||
owner @{user_config_dirs}/goa-1.0/accounts.conf r,
|
||||
|
||||
owner @{user_cache_dirs}/gnome-control-center-goa-helper/{,**} rwl,
|
||||
|
|
|
|||
|
|
@ -22,10 +22,10 @@ profile gnome-desktop-thumbnailers flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_cache_dirs}/gnome-desktop-thumbnailer/{,**} rw,
|
||||
|
||||
owner /tmp/flatpak-seccomp-@{rand6} rw,
|
||||
owner /tmp/gnome-desktop-file-to-thumbnail.* r,
|
||||
owner /tmp/gnome-desktop-thumbnailer.png w,
|
||||
owner /tmp/gsf-thumbnailer-@{rand6} rw,
|
||||
owner @{tmp}/flatpak-seccomp-@{rand6} rw,
|
||||
owner @{tmp}/gnome-desktop-file-to-thumbnail.* r,
|
||||
owner @{tmp}/gnome-desktop-thumbnailer.png w,
|
||||
owner @{tmp}/gsf-thumbnailer-@{rand6} rw,
|
||||
|
||||
include if exists <local/gnome-desktop-thumbnailers>
|
||||
}
|
||||
|
|
@ -18,7 +18,7 @@ profile gnome-disk-image-mounter @{exec_path} {
|
|||
# Allow to mount user files
|
||||
owner @{HOME}/{,**} r,
|
||||
owner @{MOUNTS}/{,**} r,
|
||||
owner /tmp/*/{,**} r,
|
||||
owner @{tmp}/*/{,**} r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
|
|
|
|||
29
apparmor.d/groups/gnome/gnome-firmware
Normal file
29
apparmor.d/groups/gnome/gnome-firmware
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/gnome-firmware
|
||||
profile gnome-firmware @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/common/gnome>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.fwupd label=fwupd path=/
|
||||
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/gnome-firmware>
|
||||
}
|
||||
|
|
@ -21,9 +21,9 @@ profile gnome-logs @{exec_path} {
|
|||
/{run,var}/log/journal/ r,
|
||||
/{run,var}/log/journal/@{hex32}/ r,
|
||||
/{run,var}/log/journal/@{hex32}/system.journal r,
|
||||
/{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex}-@{hex}.journal r,
|
||||
/{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal r,
|
||||
/{run,var}/log/journal/@{hex32}/user-@{uid}.journal r,
|
||||
/{run,var}/log/journal/@{hex32}/user-1000@@{hex32}-@{hex}-@{hex}.journal r,
|
||||
/{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal r,
|
||||
/{run,var}/log/journal/remote/ r,
|
||||
|
||||
include if exists <local/gnome-logs>
|
||||
|
|
|
|||
50
apparmor.d/groups/gnome/gnome-maps
Normal file
50
apparmor.d/groups/gnome/gnome-maps
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/gnome-maps /usr/share/gnome-maps/org.gnome.Maps
|
||||
profile gnome-maps @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/gnome>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
audit @{bin}/gjs-console rix,
|
||||
|
||||
owner @{user_pictures_dirs}/** rw,
|
||||
|
||||
owner @{user_cache_dirs}/shumate/{,**} rw,
|
||||
|
||||
owner @{user_cache_dirs}/shumate/ rw,
|
||||
owner @{user_cache_dirs}/shumate/** rwlk,
|
||||
|
||||
owner @{user_config_dirs}/shumate/ rw,
|
||||
owner @{user_config_dirs}/shumate/** rwlk,
|
||||
|
||||
owner @{user_share_dirs}/shumate/ rw,
|
||||
owner @{user_share_dirs}/shumate/** rwlk,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
|
||||
include if exists <local/gnome-maps>
|
||||
}
|
||||
|
|
@ -47,7 +47,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
||||
|
||||
owner /tmp/grilo-plugin-cache-[0-9A-Z]*/ rw,
|
||||
owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw,
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ profile gnome-remote-desktop-daemon @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.PolicyKit1>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/gnome-strict>
|
||||
include <abstractions/graphics>
|
||||
|
|
@ -19,6 +20,7 @@ profile gnome-remote-desktop-daemon @{exec_path} {
|
|||
network inet6 stream,
|
||||
|
||||
#aa:dbus own bus=session name=org.gnome.RemoteDesktop.User
|
||||
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,6 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/gnome-shell
|
||||
profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app-launcher-user>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/bus-accessibility>
|
||||
include <abstractions/bus-session>
|
||||
|
|
@ -20,13 +19,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
include <abstractions/bus/org.a11y>
|
||||
include <abstractions/bus/org.freedesktop.Accounts>
|
||||
include <abstractions/bus/org.freedesktop.background.Monitor>
|
||||
include <abstractions/bus/org.freedesktop.ColorManager>
|
||||
include <abstractions/bus/org.freedesktop.FileManager1>
|
||||
include <abstractions/bus/org.freedesktop.GeoClue2>
|
||||
include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore>
|
||||
include <abstractions/bus/org.freedesktop.locale1>
|
||||
include <abstractions/bus/org.freedesktop.login1.Session>
|
||||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
include <abstractions/bus/org.freedesktop.Notifications>
|
||||
include <abstractions/bus/org.freedesktop.PackageKit>
|
||||
|
|
@ -89,10 +86,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
# Talk with gnome-shell
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord
|
||||
#aa:dbus talk bus=system name=org.freedesktop.login1.Manager label=systemd-logind
|
||||
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
|
||||
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
|
||||
|
||||
#aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding
|
||||
#aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console
|
||||
#aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary
|
||||
#aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-*
|
||||
|
||||
|
|
@ -198,7 +196,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
/usr/share/gdm/BuiltInSessions/{,*.desktop} r,
|
||||
/usr/share/gdm/greeter-dconf-defaults r,
|
||||
/usr/share/gdm/greeter/applications/{,**} r,
|
||||
/usr/share/gnome-shell/{,**} r,
|
||||
/usr/share/libgweather/Locations.xml r,
|
||||
/usr/share/libinput*/ r,
|
||||
/usr/share/libinput*/{,**/}[0-9][0-9]-*.quirks r,
|
||||
|
|
@ -207,7 +204,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
/usr/share/wallpapers/** r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
/usr/share/xml/iso-codes/{,**} r,
|
||||
@{system_share_dirs}/gnome-shell/{,**} r,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
/etc/fstab r,
|
||||
/etc/timezone r,
|
||||
|
|
@ -218,7 +217,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
|
||||
/var/lib/flatpak/app/**/gnome-shell/{,**} r,
|
||||
/var/lib/flatpak/appstream/**/icons/** r,
|
||||
/var/lib/flatpak/exports/share/gnome-shell/{,**} r,
|
||||
|
||||
owner @{GDM_HOME}/greeter-dconf-defaults r,
|
||||
owner @{gdm_cache_dirs}/ w,
|
||||
|
|
@ -285,8 +283,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|||
|
||||
/tmp/.X@{int}-lock rw,
|
||||
/tmp/dbus-@{rand8} rw,
|
||||
owner /tmp/@{rand6}.shell-extension.zip rw,
|
||||
owner /tmp/gdkpixbuf-xpm-tmp.@{rand6} rw,
|
||||
owner @{tmp}/@{rand6}.shell-extension.zip rw,
|
||||
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
@{run}/systemd/seats/seat@{int} r,
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ profile gnome-software @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
@{bin}/baobab rPUx,
|
||||
@{bin}/bwrap rPUx,
|
||||
@{bin}/bwrap rPx -> flatpak-app,
|
||||
@{bin}/fusermount{,3} rCx -> fusermount,
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
@{bin}/gpgconf rCx -> gpg,
|
||||
|
|
@ -61,7 +61,7 @@ profile gnome-software @{exec_path} {
|
|||
/var/lib/flatpak/appstream/{,**} r,
|
||||
/var/lib/flatpak/repo/{,**} r,
|
||||
/var/lib/flatpak/runtime/{,**} r,
|
||||
|
||||
|
||||
/var/lib/PackageKit/offline-update-competed r,
|
||||
/var/lib/PackageKit/prepared-update r,
|
||||
/var/lib/swcatalog/icons/**.png r,
|
||||
|
|
@ -86,9 +86,9 @@ profile gnome-software @{exec_path} {
|
|||
owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**,
|
||||
owner @{user_share_dirs}/gnome-software/{,**} rw,
|
||||
|
||||
owner /tmp/ostree-gpg-*/ rw,
|
||||
owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
|
||||
owner /tmp/#@{int} rw,
|
||||
owner @{tmp}/ostree-gpg-*/ rw,
|
||||
owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/.dbus-proxy/ rw,
|
||||
owner @{run}/user/@{uid}/.dbus-proxy/a11y-bus-proxy-@{rand6} rw,
|
||||
|
|
@ -121,8 +121,9 @@ profile gnome-software @{exec_path} {
|
|||
|
||||
@{HOME}/@{XDG_GPG_DIR}/*.conf r,
|
||||
|
||||
owner /tmp/ostree-gpg-*/ r,
|
||||
owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
|
||||
@{tmp}/ r,
|
||||
owner @{tmp}/ostree-gpg-*/ r,
|
||||
owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
|
||||
|
||||
owner @{run}/user/@{uid}/gnupg/ w,
|
||||
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Reference in a new issue