mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-06 18:25:05 +01:00
271 lines
7.9 KiB
Text
271 lines
7.9 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2015-2022 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}bin/qbittorrent
|
|
profile qbittorrent @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/X>
|
|
include <abstractions/gtk>
|
|
include <abstractions/fonts>
|
|
include <abstractions/fontconfig-cache-read>
|
|
include <abstractions/freedesktop.org>
|
|
include <abstractions/user-download-strict>
|
|
include <abstractions/private-files-strict>
|
|
include <abstractions/qt5>
|
|
include <abstractions/qt5-compose-cache-write>
|
|
include <abstractions/qt5-settings-write>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/ibus>
|
|
include <abstractions/dbus-strict>
|
|
include <abstractions/dbus-session-strict>
|
|
include <abstractions/dbus-accessibility-strict>
|
|
include <abstractions/dbus-network-manager-strict>
|
|
include <abstractions/dbus-gtk>
|
|
include <abstractions/wayland>
|
|
include <abstractions/dri-enumerate>
|
|
include <abstractions/mesa>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
include <abstractions/ssl_certs>
|
|
|
|
signal (send) set=(term, kill) peer=qbittorrent//python3,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink dgram,
|
|
network netlink raw,
|
|
|
|
dbus (send) bus=session path=/StatusNotifierWatcher
|
|
interface=org.freedesktop.DBus.Introspectable
|
|
member=Introspect
|
|
peer=(name=org.kde.StatusNotifierWatcher),
|
|
|
|
dbus (send) bus=session path=/StatusNotifierWatcher
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=Get
|
|
peer=(name=org.kde.StatusNotifierWatcher),
|
|
|
|
dbus (send) bus=session path=/StatusNotifierWatcher
|
|
interface=org.kde.StatusNotifierWatcher
|
|
member=RegisterStatusNotifierItem
|
|
peer=(name=org.kde.StatusNotifierWatcher),
|
|
|
|
dbus (send) bus=session path=/StatusNotifierItem
|
|
interface=org.kde.StatusNotifierItem
|
|
member={NewToolTip,NewIcon}
|
|
peer=(name=org.freedesktop.DBus),
|
|
|
|
dbus (receive) bus=session path=/StatusNotifierItem
|
|
interface=org.kde.StatusNotifierItem
|
|
member=Activate
|
|
peer=(name=:*),
|
|
|
|
dbus (receive) bus=session path=/StatusNotifierItem
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=GetAll
|
|
peer=(name=:*),
|
|
|
|
dbus (receive) bus=session path=/MenuBar
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=GetAll
|
|
peer=(name=:*),
|
|
|
|
dbus (send) bus=session path=/MenuBar
|
|
interface=com.canonical.dbusmenu
|
|
member=ItemsPropertiesUpdated
|
|
peer=(name=org.freedesktop.DBus),
|
|
|
|
dbus (receive) bus=session path=/MenuBar
|
|
interface=com.canonical.dbusmenu
|
|
member={GetLayout,GetGroupProperties,AboutToShow,AboutToShowGroup,EventGroup,Event}
|
|
peer=(name=:*),
|
|
|
|
dbus (send) bus=session path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={RequestName,ReleaseName}
|
|
peer=(name=org.freedesktop.DBus),
|
|
|
|
dbus (send) bus=accessibility path=/org/a11y/atspi/accessible/root
|
|
interface=org.a11y.atspi.Socket
|
|
member=Embed
|
|
peer=(name=org.a11y.atspi.Registry),
|
|
|
|
dbus (receive) bus=accessibility path=/org/a11y/atspi/accessible/root
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=Set
|
|
peer=(name=:*),
|
|
|
|
dbus (bind) bus=session
|
|
name=org.kde.StatusNotifierItem-*,
|
|
|
|
owner /tmp/dbus-[0-9a-zA-Z]* rw,
|
|
|
|
@{exec_path} mr,
|
|
|
|
# For "search engine"
|
|
/{usr/,}bin/python3.[0-9]* rCx -> python3,
|
|
|
|
# Qbittorrent home dirs
|
|
owner @{user_config_dirs}/qBittorrent/ rw,
|
|
owner @{user_config_dirs}/qBittorrent/** rwkl -> @{user_config_dirs}/qBittorrent/#[0-9]*[0-9],
|
|
owner @{user_share_dirs}/data/ rw,
|
|
owner @{user_share_dirs}/{,data/}qBittorrent/ rw,
|
|
owner @{user_share_dirs}/{,data/}qBittorrent/** rwl -> @{user_share_dirs}/{,data/}qBittorrent/**/#[0-9]*[0-9],
|
|
# Old dir, not recommended to use:
|
|
# deny owner @{user_share_dirs}/data/qBittorrent/ rw,
|
|
|
|
# Cache dir
|
|
owner @{user_cache_dirs}/ rw,
|
|
owner @{user_cache_dirs}/#[0-9]*[0-9] rw,
|
|
owner @{user_cache_dirs}/qBittorrent/{,**} rw,
|
|
|
|
# To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
|
|
owner @{user_config_dirs}/qt5ct/{,**} r,
|
|
/usr/share/qt5ct/** r,
|
|
|
|
# Torrent files
|
|
owner @{user_torrents_dirs}/ r,
|
|
owner @{user_torrents_dirs}/** rw,
|
|
|
|
# GeoIP settings
|
|
/usr/share/GeoIP/GeoIP.dat r,
|
|
|
|
/dev/disk/by-label/ r,
|
|
|
|
/dev/shm/#[0-9]*[0-9] rw,
|
|
|
|
owner @{PROC}/@{pids}/fd/ r,
|
|
deny owner @{PROC}/@{pids}/cmdline r,
|
|
owner @{PROC}/@{pids}/mountinfo r,
|
|
owner @{PROC}/@{pids}/mounts r,
|
|
owner @{PROC}/@{pids}/comm r,
|
|
deny @{PROC}/sys/kernel/random/boot_id r,
|
|
|
|
/usr/share/hwdata/pnp.ids r,
|
|
|
|
# TMP
|
|
owner /tmp/qtsingleapp-qBitto-* rw,
|
|
owner /tmp/qtsingleapp-qBitto-*-lockfile rwk,
|
|
owner /tmp/.qBittorrent/ rw,
|
|
owner /tmp/.qBittorrent/* rwl -> /tmp/.qBittorrent/*,
|
|
owner /tmp/mozilla_*/*.torrent rw,
|
|
owner /tmp/*.torrent rw,
|
|
# To load/add torrents from the search engine
|
|
owner /tmp/tmp* rw,
|
|
owner /tmp/.*/{,s} rw,
|
|
|
|
owner /tmp/xauth-[0-9]*-_[0-9] rw,
|
|
|
|
# file_inherit
|
|
owner /dev/tty[0-9]* rw,
|
|
|
|
# X-tiny
|
|
owner @{run}/user/@{uid}/ICEauthority r,
|
|
|
|
# gnome-tiny
|
|
/usr/share/gvfs/remote-volume-monitors/{,*} r,
|
|
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
|
|
|
# Launch external apps
|
|
/{usr/,}bin/xdg-{open,mime} rCx -> open,
|
|
|
|
# Allowed apps to open
|
|
/{usr/,}bin/spacefm rPx,
|
|
/{usr/,}bin/smplayer rPx,
|
|
/{usr/,}bin/vlc rPx,
|
|
/{usr/,}bin/mpv rPx,
|
|
/{usr/,}bin/geany rPx,
|
|
/{usr/,}bin/viewnior rPUx,
|
|
/{usr/,}bin/qpdfview rPx,
|
|
/{usr/,}bin/ebook-viewer rPx,
|
|
/{usr/,}lib/firefox/firefox rPx,
|
|
/{usr/,}bin/nautilus rPx,
|
|
|
|
profile open {
|
|
include <abstractions/base>
|
|
include <abstractions/xdg-open>
|
|
include <abstractions/dbus-gtk>
|
|
|
|
dbus (send) bus=session path=/org/gnome/{Nautilus,Totem,gedit}
|
|
interface=org.freedesktop.Application
|
|
member=Open
|
|
peer=(name="org.gnome.{Nautilus,Totem,gedit}"),
|
|
|
|
/{usr/,}bin/xdg-open mr,
|
|
|
|
# Allowed apps to open
|
|
/{usr/,}bin/spacefm rPx,
|
|
/{usr/,}bin/smplayer rPx,
|
|
/{usr/,}bin/vlc rPx,
|
|
/{usr/,}bin/mpv rPx,
|
|
/{usr/,}bin/geany rPx,
|
|
/{usr/,}bin/viewnior rPUx,
|
|
/{usr/,}bin/qpdfview rPx,
|
|
/{usr/,}bin/ebook-viewer rPx,
|
|
/{usr/,}lib/firefox/firefox rPx,
|
|
/{usr/,}bin/engrampa rPx,
|
|
|
|
/{usr/,}bin/{ba,da,}sh rix,
|
|
/{usr/,}bin/{g,m,}awk rix,
|
|
/{usr/,}bin/readlink rix,
|
|
/{usr/,}bin/basename rix,
|
|
/{usr/,}bin/xfce4-mime-helper rix,
|
|
|
|
owner @{HOME}/ r,
|
|
|
|
owner @{run}/user/@{uid}/ r,
|
|
|
|
# file_inherit
|
|
owner @{MOUNTS}/torrent/** r,
|
|
owner @{MOUNTS}/torrent/**.[0-9a-f]*.parts rw,
|
|
owner "@{MOUNTS}/torrent/**.!qB" rw,
|
|
|
|
owner @{HOME}/.xsession-errors w,
|
|
|
|
include if exists <local/qbittorrent_open>
|
|
}
|
|
|
|
profile python3 {
|
|
include <abstractions/base>
|
|
include <abstractions/python>
|
|
include <abstractions/openssl>
|
|
include <abstractions/ssl_certs>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
signal (receive) set=(term, kill) peer=qbittorrent,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
/{usr/,}bin/python3.[0-9]* r,
|
|
|
|
owner @{user_share_dirs}/{,data/}qBittorrent/nova[0-9]/{,**} rw,
|
|
|
|
# Used while searching for torrents
|
|
owner /dev/shm/sem.mp-* rwl -> /dev/shm/[0-9]*[0-9],
|
|
owner /dev/shm/* rw,
|
|
|
|
# To load/add torrents from the search engine
|
|
owner /tmp/[0-9]*[0-9] rw,
|
|
owner /tmp/tmp* rw,
|
|
|
|
# file_inherit
|
|
owner @{MOUNTS}/torrent/** r,
|
|
deny /dev/dri/card[0-9]* rw,
|
|
|
|
include if exists <local/qbittorrent_python3>
|
|
}
|
|
|
|
include if exists <local/qbittorrent>
|
|
}
|