mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-06-29 23:05:45 +01:00
parent 7c5ba70b40
commit f9a93ab67e
Failed to generate hash of commit
18 changed files with 51 additions and 75 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/bus/dbus-session
View file

@ -20,6 +20,8 @@ profile dbus-session flags=(attach_disconnected) {
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
network unix stream,
unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none), unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none),
signal (receive) set=(term hup) peer=gdm-session-worker, signal (receive) set=(term hup) peer=gdm-session-worker,

4
apparmor.d/groups/children/child-modprobe-nvidia
View file

@ -55,6 +55,8 @@ profile child-modprobe-nvidia flags=(attach_disconnected) {
/dev/tty@{int} rw, /dev/tty@{int} rw,
deny @{HOME}/.steam/** r,
profile kmod { profile kmod {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/kmod> include <abstractions/app/kmod>
@ -69,6 +71,8 @@ profile child-modprobe-nvidia flags=(attach_disconnected) {
# @{sys}/module/{drm,nvidia}/initstate r, # @{sys}/module/{drm,nvidia}/initstate r,
@{sys}/module/compression r, @{sys}/module/compression r,
deny @{HOME}/.steam/** r,
include if exists <local/child-modprobe-nvidia_kmod> include if exists <local/child-modprobe-nvidia_kmod>
} }

2
apparmor.d/groups/freedesktop/xdg-dbus-proxy
View file

@ -18,6 +18,8 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/consoles> include <abstractions/consoles>
network unix stream,
dbus send bus=session path=/org/freedesktop/portal/desktop dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Realtime interface=org.freedesktop.portal.Realtime
member=MakeThreadRealtimeWithPID member=MakeThreadRealtimeWithPID

50
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -111,49 +111,21 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
profile open flags=(attach_disconnected) { profile open flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app-launcher-user> include <abstractions/desktop>
@{lib}/gio-launch-desktop mr, @{bin}/env rix,
@{sh_path} r,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
@{sh_path} rix, @{lib}/gio-launch-desktop mr,
@{bin}/aa-notify rPx, @{lib}/** PUx,
@{bin}/blueman-applet rPx, @{bin}/** PUx,
@{bin}/firewall-applet rPx, /opt/*/** PUx,
@{bin}/gnome-keyring-daemon rPx, /usr/share/*/** PUx,
@{bin}/gnome-shell rPx, /usr/local/bin/** PUx,
@{bin}/gnome-software rPx, /usr/games/** PUx,
@{bin}/im-launch rPx,
@{bin}/keepassxc rPx,
@{bin}/opensuse-welcome rPx,
@{bin}/parcellite rPUx,
@{bin}/pkcs11-register rPx,
@{bin}/snap rPUx,
@{bin}/snapshot-detect rPUx,
@{bin}/spice-vdagent rPx,
@{bin}/start-pulseaudio-x11 rPx,
@{bin}/ubuntu-report rPx,
@{bin}/update-notifier rPx,
@{bin}/xbrlapi rPx,
@{bin}/xdg-user-dirs-gtk-update rPx,
@{bin}/xdg-user-dirs-update rPx,
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
@{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh rPx,
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
@{lib}/caribou/caribou rPUx,
@{lib}/deja-dup/deja-dup-monitor rPx,
@{lib}/gsd-* rPx,
@{lib}/update-notifier/ubuntu-advantage-notification rPx,
@{lib}/xapps/sn-watcher/* rPUx,
@{thunderbird_path} rPx,
/usr/share/libpam-kwallet-common/pam_kwallet_init rPUx,
#aa:exec baloo /dev/tty rw,
#aa:exec evolution-alarm-notify
@{lib}/kdeconnectd rPUx,
@{lib}/@{multiarch}/{,libexec/}kdeconnectd rPUx,
/dev/tty@{int} rw,
include if exists <usr/gnome-session-binary_open.d> include if exists <usr/gnome-session-binary_open.d>
include if exists <local/gnome-session-binary_open> include if exists <local/gnome-session-binary_open>

2
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -16,6 +16,8 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
capability sys_admin, # To set a hostname capability sys_admin, # To set a hostname
network unix stream,
unix (bind) type=stream addr=@@{hex16}/bus/systemd-hostnam/system, unix (bind) type=stream addr=@@{hex16}/bus/systemd-hostnam/system,
#aa:dbus own bus=system name=org.freedesktop.hostname1 #aa:dbus own bus=system name=org.freedesktop.hostname1

7
apparmor.d/groups/systemd/systemd-networkd
View file

@ -53,12 +53,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/network/ r, @{run}/systemd/network/ r,
@{run}/systemd/network/*.network r, @{run}/systemd/network/*.network r,
@{run}/systemd/notify rw, @{run}/systemd/notify rw,
owner @{run}/systemd/netif/.#state rw, owner @{run}/systemd/netif/** rw,
owner @{run}/systemd/netif/.#state* rw,
owner @{run}/systemd/netif/leases/{,*} rw,
owner @{run}/systemd/netif/links/{,*} rw,
owner @{run}/systemd/netif/lldp/{,*} rw,
owner @{run}/systemd/netif/state rw,
@{run}/udev/data/n@{int} r, @{run}/udev/data/n@{int} r,

2
apparmor.d/groups/virt/cockpit-bridge
View file

@ -40,6 +40,7 @@ profile cockpit-bridge @{exec_path} {
@{lib}/cockpit/cockpit-ssh rPx, @{lib}/cockpit/cockpit-ssh rPx,
/usr/share/cockpit/{,**} r, /usr/share/cockpit/{,**} r,
/usr/{,local/}share/ r,
/etc/cockpit/{,**} r, /etc/cockpit/{,**} r,
/etc/httpd/conf/mime.types r, /etc/httpd/conf/mime.types r,
@ -51,6 +52,7 @@ profile cockpit-bridge @{exec_path} {
/etc/shells r, /etc/shells r,
owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw, owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw,
owner @{user_share_dirs}/ r,
@{run}/user/@{uid}/ssh-agent.[0-9A-Z]* rw, @{run}/user/@{uid}/ssh-agent.[0-9A-Z]* rw,
@{run}/utmp r, @{run}/utmp r,

4
apparmor.d/profiles-a-f/adb
View file

@ -9,14 +9,16 @@ include <tunables/global>
@{exec_path} = @{bin}/adb @{exec_path} = @{bin}/adb
@{exec_path} += @{lib}/android-sdk/platform-tools/adb @{exec_path} += @{lib}/android-sdk/platform-tools/adb
profile adb @{exec_path} { profile adb @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/devices-usb> include <abstractions/devices-usb>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/user-download-strict> include <abstractions/user-download-strict>
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
network netlink raw,
signal (receive) set=(kill) peer=scrcpy, signal (receive) set=(kill) peer=scrcpy,

1
apparmor.d/profiles-m-r/mount
View file

@ -49,7 +49,6 @@ profile mount @{exec_path} flags=(attach_disconnected) {
@{MOUNTS}/ rw, @{MOUNTS}/ rw,
@{MOUNTS}/*/ rw, @{MOUNTS}/*/ rw,
@{MOUNTS}/*/*/ rw, @{MOUNTS}/*/*/ rw,
/media/cdrom[0-9]/ r,
# Mount iso/img files # Mount iso/img files
owner @{user_img_dirs}/{,**} rwk, owner @{user_img_dirs}/{,**} rwk,

3
apparmor.d/profiles-m-r/ntfs-3g
View file

@ -9,8 +9,9 @@ include <tunables/global>
@{exec_path} = @{bin}/{low,}ntfs{,-3g} @{exec_path} = @{bin}/{low,}ntfs{,-3g}
@{exec_path} += @{bin}/mount.{low,}ntfs{,-3g} @{exec_path} += @{bin}/mount.{low,}ntfs{,-3g}
profile ntfs-3g @{exec_path} { profile ntfs-3g @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/disks-write> include <abstractions/disks-write>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/profiles-m-r/ollama
View file

@ -48,3 +48,5 @@ profile ollama @{exec_path} flags=(attach_disconnected) {
include if exists <local/ollama> include if exists <local/ollama>
} }
# vim:syntax=apparmor

2
apparmor.d/profiles-m-r/pam-tmpdir-helper
View file

@ -15,7 +15,7 @@ profile pam-tmpdir-helper @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
owner @{tmp}/user/ rw, owner /tmp/user/ rw,
owner @{tmp}/ rw, owner @{tmp}/ rw,
/dev/ptmx rw, /dev/ptmx rw,

2
apparmor.d/profiles-m-r/run-parts
View file

@ -137,7 +137,7 @@ profile run-parts @{exec_path} {
owner @{tmp}/#@{int} rw, owner @{tmp}/#@{int} rw,
owner @{tmp}/$anacron* rw, owner @{tmp}/$anacron* rw,
owner @{tmp}/file@{rand6} ra, owner @{tmp}/file@{rand6} rw,
owner @{sys}/class/power_supply/ r, owner @{sys}/class/power_supply/ r,

2
apparmor.d/profiles-s-z/scrcpy
View file

@ -34,6 +34,8 @@ profile scrcpy @{exec_path} {
owner @{user_config_dirs}/ibus/bus/ r, owner @{user_config_dirs}/ibus/bus/ r,
owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r,
owner @{PROC}/@{pid}/cmdline r,
deny @{user_share_dirs}/gvfs-metadata/* r, deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/scrcpy> include if exists <local/scrcpy>

13
apparmor.d/profiles-s-z/smplayer
View file

@ -12,22 +12,13 @@ profile smplayer @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dri-enumerate> include <abstractions/graphics>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/fonts> include <abstractions/desktop>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/qt5-compose-cache-write> include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write> include <abstractions/qt5-settings-write>
include <abstractions/user-download-strict> include <abstractions/user-download-strict>
include <abstractions/wayland>
include <abstractions/X>
# Needed for hardware decoding
##include <abstractions/nvidia>
signal (send) set=(term, kill), signal (send) set=(term, kill),
signal (receive) set=(term, kill), signal (receive) set=(term, kill),

14
apparmor.d/profiles-s-z/steam
View file

@ -84,14 +84,14 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{lib_dirs}/** mr, @{lib_dirs}/** mr,
@{lib_dirs}/*driverquery rix, @{lib_dirs}/*driverquery rix,
@{lib_dirs}/fossilize_replay rpx, @{lib_dirs}/fossilize_replay rpx, # steam-fossilize
@{lib_dirs}/gameoverlayui rpx, @{lib_dirs}/gameoverlayui rpx, # steam-gameoverlayui
@{lib_dirs}/reaper rpx, # steam-runtime @{lib_dirs}/reaper rpx, # steam-runtime
@{lib_dirs}/steam* rix, @{lib_dirs}/steam* rix,
@{app_dirs}/@{runtime}/*entry-point rpx -> steam-runtime, @{app_dirs}/@{runtime}/*entry-point rpx -> steam-runtime,
@{share_dirs}/linux{32,64}/steamerrorreporter rpx, @{share_dirs}/linux{32,64}/steamerrorreporter rpx, # steamerrorreporter
@{runtime_dirs}/*entry-point rix, @{runtime_dirs}/*entry-point rix,
@{runtime_dirs}/@{arch}/@{bin}/srt-logger rix, @{runtime_dirs}/@{arch}/@{bin}/srt-logger rix,
@ -101,7 +101,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-input-monitor rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-input-monitor rix,
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launch-* rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launch-* rix,
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-interface-@{int} rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-interface-@{int} rix,
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, # steam-launcher
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-libcurl-* rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-libcurl-* rix,
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rix,
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-supervisor rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-supervisor rix,
@ -125,14 +125,10 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
/ r, / r,
@{bin}/ r, @{bin}/ r,
@{lib}/ r, @{lib}/ r,
/etc/ r, /etc/ r,
/home/ r, /home/ r,
/usr/ r, /usr/ r,
/usr/local/ r, /usr/local/ r,
/usr/local/lib/ r, /usr/local/lib/ r,
@ -350,6 +346,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{sys}/class/*/ r, @{sys}/class/*/ r,
@{sys}/devices/**/report_descriptor r, @{sys}/devices/**/report_descriptor r,
@{sys}/devices/**/uevent r, @{sys}/devices/**/uevent r,
@{sys}/devices/@{pci}/usb@{int}/**/{idVendor,idProduct,interface} r,
@{sys}/devices/system/cpu/kernel_max r, @{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/tty/tty@{int}/active r, @{sys}/devices/virtual/tty/tty@{int}/active r,
@ -365,6 +362,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{PROC}/@{pid}/task/@{tid}/comm r, owner @{PROC}/@{pid}/task/@{tid}/comm r,
owner @{PROC}/@{pid}/task/@{tid}/status r, owner @{PROC}/@{pid}/task/@{tid}/status r,
/dev/ r,
/dev/hidraw@{int} rw, /dev/hidraw@{int} rw,
/dev/tty rw, /dev/tty rw,

4
apparmor.d/profiles-s-z/steam-game-native
View file

@ -19,15 +19,15 @@ profile steam-game-native @{exec_path} flags=(attach_disconnected) {
include <abstractions/common/steam-game> include <abstractions/common/steam-game>
network inet dgram, network inet dgram,
network inet6 dgram,
network inet stream, network inet stream,
network inet6 dgram,
network inet6 stream, network inet6 stream,
network netlink raw, network netlink raw,
network unix stream, network unix stream,
signal receive peer=steam, signal receive peer=steam,
@{exec_path} rmix, @{exec_path} mrix,
@{sh_path} rix, @{sh_path} rix,

2
apparmor.d/profiles-s-z/steam-runtime
View file

@ -22,6 +22,8 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) {
include <abstractions/wayland> include <abstractions/wayland>
include <abstractions/X-strict> include <abstractions/X-strict>
network inet stream,
network inet6 stream,
network unix stream, network unix stream,
@{exec_path} mr, @{exec_path} mr,