mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-31 07:17:22 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): merge gdm-session.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-13 15:52:23 +00:00
parent 3bb5ea72df
commit fef6390b9e
Failed to generate hash of commit
3 changed files with 21 additions and 74 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
apparmor.d/groups/gnome/gdm-wayland-session → apparmor.d/groups/gnome/gdm-session
View file

@ -6,10 +6,11 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/{,gdm/}gdm-wayland-session
profile gdm-wayland-session @{exec_path} {
@{exec_path} = @{lib}/{,gdm/}gdm-{x,wayland}-session
profile gdm-session @{exec_path} {
include <abstractions/base>
include <abstractions/bash>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.systemd1-session>
@ -26,6 +27,7 @@ profile gdm-wayland-session @{exec_path} {
signal (send) set=(term) peer=dbus-daemon,
signal (send) set=(term) peer=dbus-run-session,
signal (send) set=(term) peer=gnome-session-binary,
signal (send) set=term peer=xorg,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
@ -65,6 +67,11 @@ profile gdm-wayland-session @{exec_path} {
@{lib}/gnome-session-binary rPx,
@{lib}/xdg-permission-store rPx,
# only: xorg
@{bin}/Xorg rPx,
/etc/gdm{3,}/Prime/Default rix,
/etc/gdm{3,}/Xsession rPx,
/usr/share/dbus-1/{,**} r,
/usr/share/dconf/profile/gdm r,
/usr/share/defaults/at-spi2/accessibility.conf r,
@ -75,6 +82,7 @@ profile gdm-wayland-session @{exec_path} {
/usr/share/libdebuginfod-common/debuginfod.sh r,
@{etc_ro}/profile.d/{,*} r,
/etc/dbus-1/{,**} r,
/etc/debuginfod/{,*} r,
/etc/default/im-config r,
/etc/gdm{3,}/custom.conf r,
@ -89,20 +97,24 @@ profile gdm-wayland-session @{exec_path} {
/etc/sysconfig/proxy r,
/etc/sysconfig/windowmanager r,
/var/lib/gdm{3,}/.cache/gdm/ rw,
/var/lib/gdm{3,}/.cache/gdm/Xauthority rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
owner @{HOME}/.alias r,
owner @{HOME}/.i18n r,
@{run}/gdm{3,}/custom.conf r,
@{run}/systemd/userdb/ r,
@{run}/systemd/users/@{uid} r,
@{run}/user/@{uid}/at-spi/ w,
@{run}/user/@{uid}/at-spi/bus w,
owner @{run}/user/@{uid}/dbus-1/ rw,
owner @{run}/user/@{uid}/dbus-1/services/ rw,
owner @{run}/user/@{uid}/gdm/ w,
owner @{run}/user/@{uid}/gdm/Xauthority rw, # only: xorg
owner /tmp/dbus-@{rand10} w,
@{sys}/module/apparmor/parameters/enabled r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pids}/oom_score_adj rw,
@ -113,5 +125,5 @@ profile gdm-wayland-session @{exec_path} {
/dev/tty@{int} rw,
include if exists <local/gdm-wayland-session>
include if exists <local/gdm-session>
}

5
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -33,7 +33,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
signal (receive) set=term peer=gdm,
signal (receive) set=hup peer=@{systemd},
signal (send) set=(hup term) peer=gdm-{x,wayland}-session,
signal (send) set=(hup term) peer=gdm-session,
signal (send) set=hup peer=at-spi*,
signal (send) set=hup peer=dbus-daemon,
signal (send) set=hup peer=dbus-run-session,
@ -64,8 +64,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
@{bin}/gnome-keyring-daemon rPx,
@{bin}/unix_chkpwd rPx,
@{etc_ro}/X11/xdm/Xstartup rPUx,
@{lib}/{,gdm/}gdm-wayland-session rPx,
@{lib}/{,gdm/}gdm-x-session rPx,
@{lib}/{,gdm/}gdm-{x,wayland}-session rPx -> gdm-session,
/etc/gdm{3,}/{Pre,Post}Session/Default rix,
/etc/gdm{3,}/PostLogin/Default rix,
/etc/gdm{3,}/PrimeOff/Default rix,

64
apparmor.d/groups/gnome/gdm-x-session
View file

@ -1,64 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/{,gdm/}gdm-x-session
profile gdm-x-session @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.systemd1-session>
include <abstractions/bus/org.gnome.DisplayManager>
signal (receive) set=(hup term) peer=gdm-session-worker,
signal (receive) set=(term) peer=gdm,
signal (send) set=term peer=dbus-run-session,
signal (send) set=term peer=gnome-session-binary,
signal (send) set=term peer=xorg,
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=UpdateActivationEnvironment
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,
@{bin}/{true,false} rix,
@{bin}/dbus-daemon rix,
@{bin}/dbus-run-session rix,
@{bin}/gjs-console rPx,
@{bin}/gnome-session rix,
@{bin}/gsettings rPx,
@{bin}/Xorg rPx,
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rix,
@{lib}/at-spi2-registryd rix,
@{lib}/dconf-service rPx,
@{lib}/gnome-session-binary rPx,
@{lib}/xdg-permission-store rPx,
/etc/gdm{3,}/Prime/Default rix,
/etc/gdm{3,}/Xsession rPx,
/usr/share/gdm/gdm.schemas r,
/etc/gdm{3,}/custom.conf r,
/etc/gdm{3,}/daemon.conf r,
/etc/sysconfig/displaymanager r,
/var/lib/gdm{3,}/.cache/gdm/ rw,
/var/lib/gdm{3,}/.cache/gdm/Xauthority rw,
@{run}/gdm{3,}/custom.conf r,
owner @{run}/user/@{uid}/gdm/ w,
owner @{run}/user/@{uid}/gdm/Xauthority rw,
owner @{PROC}/@{pid}/fd/ r,
/dev/tty@{int} rw,
include if exists <local/gdm-x-session>
}