mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-31 07:17:22 +01:00
56 lines
2 KiB
Text
56 lines
2 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
@{lib}/@{multiarch}/libproxy/*/modules/*.so mr,
|
|
@{lib}/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr,
|
|
@{lib}/frei0r-@{int}/*.so mr,
|
|
|
|
# FIXME: not compatible with FSP mode due conflicting x modifiers
|
|
@{lib}/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner rix,
|
|
@{lib}/@{multiarch}/gstreamer-1.0/gst-plugin-scanner rix,
|
|
@{lib}/gstreamer-1.0/gst-plugin-scanner rix,
|
|
|
|
/etc/openni2/OpenNI.ini r,
|
|
|
|
/tmp/ r,
|
|
/var/tmp/ r,
|
|
|
|
owner @{HOME}/orcexec.@{rand6} rw,
|
|
|
|
owner @{HOME}/.gstreamer-@{int}.@{int}/ rw,
|
|
owner @{HOME}/.gstreamer-@{int}.@{int}/registry.*.bin{,.tmp@{rand6}} rw,
|
|
|
|
owner @{user_cache_dirs}/gstreamer-@{int}.@{int}/ rw,
|
|
owner @{user_cache_dirs}/gstreamer-@{int}.@{int}/registry.*.bin{,.tmp@{rand6}} rw,
|
|
|
|
# The orcexec.* file is JIT compiled code for various GStreamer elements.
|
|
# If one is blocked the next is used instead.
|
|
# The orcexec file is placed under /home/user/ also when the /tmp/ dir is mounted with the noexec flag.
|
|
owner @{run}/user/@{uid}/orcexec.@{rand6} mrw,
|
|
#owner /tmp/orcexec.* mrw,
|
|
#owner @{HOME}/orcexec.* mrw,
|
|
|
|
@{run}/udev/data/+drm:card@{int}-* r, # For screen outputs
|
|
@{run}/udev/data/+usb:* r, # For /dev/bus/usb/**
|
|
|
|
@{run}/udev/data/c81:@{int} r, # For video4linux
|
|
@{run}/udev/data/c189:@{int} r, # For USB serial converters
|
|
@{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]*
|
|
|
|
@{sys}/bus/ r,
|
|
@{sys}/bus/media/devices/ r,
|
|
@{sys}/bus/usb/devices/ r,
|
|
@{sys}/class/ r,
|
|
@{sys}/class/drm/ r,
|
|
@{sys}/class/video4linux/ r,
|
|
@{sys}/devices/@{pci}/{busnum,config,devnum,descriptors,speed,uevent} r,
|
|
@{sys}/devices/system/node/ r,
|
|
@{sys}/devices/system/node/node@{int}/meminfo r,
|
|
|
|
/dev/ r,
|
|
/dev/bus/usb/ r,
|
|
/dev/dri/ r,
|
|
|
|
include if exists <abstractions/gstreamer.d>
|