mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-14 23:43:56 +01:00
e41779f576
On full system policy, use the new bwrap profile (and bwrap-app) to confine sandboxed application. It is not enabled by default as the sandbox profile is quite large. Also integrate with the gnome app that use bwrap as sandbox manager. Update other related profiles See Full system policy #252
387 lines
12 KiB
Plaintext
387 lines
12 KiB
Plaintext
# Common profile flags definition for all distributions
|
|
# One profile by line using the format: '<profile> <flags>'
|
|
|
|
bwrap attach_disconnected,mediate_deleted,complain
|
|
bwrap-app attach_disconnected,mediate_deleted,complain
|
|
default attach_disconnected,mediate_deleted,complain
|
|
default-sudo complain
|
|
systemd attach_disconnected,mediate_deleted,complain
|
|
systemd-user attach_disconnected,mediate_deleted,complain
|
|
|
|
aa-load complain
|
|
acpid attach_disconnected,complain
|
|
agetty complain
|
|
akonadi_akonotes_resource complain
|
|
akonadi_archivemail_agent complain
|
|
akonadi_birthdays_resource complain
|
|
akonadi_contacts_resource complain
|
|
akonadi_control complain
|
|
akonadi_followupreminder_agent complain
|
|
akonadi_ical_resource complain
|
|
akonadi_indexing_agent complain
|
|
akonadi_maildir_resource complain
|
|
akonadi_maildispatcher_agent complain
|
|
akonadi_mailfilter_agent complain
|
|
akonadi_mailmerge_agent complain
|
|
akonadi_migration_agent complain
|
|
akonadi_newmailnotifier_agent complain
|
|
akonadi_notes_agent complain
|
|
akonadi_sendlater_agent complain
|
|
akonadi_unifiedmailbox_agent complain
|
|
anacron complain
|
|
apport complain
|
|
at-spi-bus-launcher attach_disconnected,complain
|
|
at-spi2-registryd attach_disconnected,complain
|
|
atd complain
|
|
atril-previewer complain
|
|
auditctl attach_disconnected,complain
|
|
auditd attach_disconnected,complain
|
|
augenrules attach_disconnected,complain
|
|
avahi-autoipd complain
|
|
avahi-browse complain
|
|
avahi-publish complain
|
|
avahi-resolve complain
|
|
avahi-set-host-name complain
|
|
baloo complain
|
|
baloorunner complain
|
|
busctl complain
|
|
cc-remote-login-helper complain
|
|
cctk complain
|
|
cfdisk complain
|
|
cgdisk complain
|
|
child-open complain
|
|
chronyd attach_disconnected,complain
|
|
cockpit-askpass complain
|
|
cockpit-bridge complain
|
|
cockpit-certificate-ensure complain
|
|
cockpit-certificate-helper complain
|
|
cockpit-desktop complain
|
|
cockpit-session attach_disconnected,complain
|
|
cockpit-ssh complain
|
|
cockpit-tls complain
|
|
cockpit-ws complain
|
|
cockpit-wsinstance-factory complain
|
|
code complain
|
|
containerd-shim-runc-v2 attach_disconnected,complain
|
|
ctop complain
|
|
cups-backend-beh complain
|
|
cups-backend-brf complain
|
|
cups-backend-dnssd complain
|
|
cups-backend-implicitclass complain
|
|
cups-backend-ipp complain
|
|
cups-backend-lpd complain
|
|
cups-backend-parallel complain
|
|
cups-backend-pdf complain
|
|
cups-backend-serial complain
|
|
cups-backend-snmp complain
|
|
cups-backend-socket complain
|
|
cups-backend-usb complain
|
|
cups-browsed complain
|
|
cups-pk-helper-mechanism complain
|
|
cupsd attach_disconnected,complain
|
|
dbus-daemon attach_disconnected,complain
|
|
DiscoverNotifier complain
|
|
dkms attach_disconnected,complain
|
|
dleyna-renderer-service complain
|
|
dmesg.service complain
|
|
docker-proxy complain
|
|
dockerd attach_disconnected,complain
|
|
dolphin complain
|
|
downloadhelper complain
|
|
drkonqi complain
|
|
e2fsck complain
|
|
e2scrub_all attach_disconnected,complain
|
|
element complain
|
|
epiphany-webapp-provider complain
|
|
etckeeper complain
|
|
fail2ban-client attach_disconnected,complain
|
|
fail2ban-server attach_disconnected,complain
|
|
fdisk complain
|
|
file-roller complain
|
|
firefox-glxtest complain
|
|
firefox-kmozillahelper complain
|
|
firefox-vaapitest complain
|
|
flatpak-session-helper complain
|
|
fsck-ext4 complain
|
|
fuse-overlayfs complain
|
|
fusermount complain
|
|
gdisk complain
|
|
gdm-runtime-config complain
|
|
gdm-x-session attach_disconnected,complain
|
|
gdm-xsession complain
|
|
glib-compile-resources complain
|
|
gmenudbusmenuproxy complain
|
|
gnome-browser-connector-host complain
|
|
gnome-characters complain
|
|
gnome-control-center attach_disconnected,complain
|
|
gnome-control-center-goa-helper complain
|
|
gnome-disk-image-mounter complain
|
|
gnome-disks complain
|
|
gnome-extension-gsconnect complain
|
|
gnome-extension-manager complain
|
|
gnome-music complain
|
|
gnome-photos-thumbnailer complain
|
|
gnome-remote-desktop-daemon complain
|
|
gnome-shell attach_disconnected,mediate_deleted,complain
|
|
gnome-software complain
|
|
gnome-system-monitor attach_disconnected,complain
|
|
gnome-terminal-server complain
|
|
gnome-tweaks complain
|
|
grub-bios-setup complain
|
|
grub-editenv complain
|
|
grub-file complain
|
|
grub-fstest complain
|
|
grub-glue-efi complain
|
|
grub-kbdcomp complain
|
|
grub-macbless complain
|
|
grub-menulst2cfg complain
|
|
grub-mkconfig attach_disconnected,complain
|
|
grub-mkdevicemap complain
|
|
grub-mkfont complain
|
|
grub-mkimage complain
|
|
grub-mklayout complain
|
|
grub-mknetdir complain
|
|
grub-mkpasswd-pbkdf2 complain
|
|
grub-mkrelpath complain
|
|
grub-mkrescue complain
|
|
grub-mkstandalone complain
|
|
grub-mount complain
|
|
grub-multi-install complain
|
|
grub-ntldr-img complain
|
|
grub-probe complain
|
|
grub-reboot complain
|
|
grub-render-label complain
|
|
grub-script-check complain
|
|
grub-set-default complain
|
|
grub-syslinux2cfg complain
|
|
gsd-media-keys attach_disconnected,complain
|
|
gsd-print-notifications attach_disconnected,complain
|
|
gsd-printer attach_disconnected,complain
|
|
gsettings complain
|
|
gvfs-udisks2-volume-monitor attach_disconnected,complain
|
|
gvfsd-dav complain
|
|
hostnamectl complain
|
|
ibus-engine-table complain
|
|
ibus-memconf complain
|
|
im-launch complain
|
|
install-info complain
|
|
irqbalance attach_disconnected,complain
|
|
iwctl complain
|
|
iwd complain
|
|
kaccess complain
|
|
kactivitymanagerd complain
|
|
kalendarac complain
|
|
kauth-backlighthelper complain
|
|
kauth-chargethresholdhelper complain
|
|
kauth-discretegpuhelper complain
|
|
kauth-fontinst complain
|
|
kauth-kded-smart-helper complain
|
|
kauth-kinfocenter-dmidecode-helper complain
|
|
kcminit complain
|
|
kconf_update complain
|
|
kde-powerdevil attach_disconnected,mediate_deleted,complain
|
|
kde-systemd-start-condition complain
|
|
kded5 complain
|
|
kernel-install complain
|
|
kglobalaccel5 complain
|
|
kgx complain
|
|
kio_http_cache_cleaner complain
|
|
kiod5 complain
|
|
kioslave5 complain
|
|
kmod attach_disconnected,complain
|
|
kscreen_backend_launcher complain
|
|
ksmserver attach_disconnected,mediate_deleted,complain
|
|
ksplashqml complain
|
|
kwin_wayland attach_disconnected,mediate_deleted,complain
|
|
kwin_wayland_wrapper complain
|
|
kwin_x11 complain
|
|
landscape-sysinfo complain
|
|
landscape-sysinfo.wrapper complain
|
|
last complain
|
|
lastlog complain
|
|
ldconfig.service complain
|
|
libvirt-dbus complain
|
|
libvirtd attach_disconnected,complain
|
|
locale-gen complain
|
|
localectl complain
|
|
login attach_disconnected,complain
|
|
loginctl complain
|
|
lvm attach_disconnected,complain
|
|
lvmconfig complain
|
|
lvmdump complain
|
|
lvmpolld complain
|
|
man complain
|
|
mdevctl complain
|
|
mke2fs complain
|
|
ModemManager attach_disconnected,complain
|
|
molly-guard complain
|
|
mount attach_disconnected,complain
|
|
multipath attach_disconnected,complain
|
|
multipathd complain
|
|
nautilus complain
|
|
needrestart attach_disconnected,complain
|
|
needrestart-iucode-scan-versions complain
|
|
networkctl attach_disconnected,complain
|
|
networkd-dispatcher complain
|
|
nm-openvpn-service-openvpn-helper complain
|
|
nmap complain
|
|
nmcli complain
|
|
nullmailer-send complain
|
|
nvidia-detector complain
|
|
nvidia-persistenced complain
|
|
org.gnome.NautilusPreviewer complain
|
|
os-prober attach_disconnected,complain
|
|
package-data-downloader complain
|
|
packagekitd attach_disconnected,complain
|
|
pass-import complain
|
|
passim complain
|
|
passimd attach_disconnected,complain
|
|
pidof complain
|
|
pinentry complain
|
|
pinentry-curses complain
|
|
pinentry-gnome3 complain
|
|
pinentry-gtk-2 complain
|
|
pkexec complain
|
|
pkttyagent complain
|
|
plasma-browser-integration-host complain
|
|
plasma-discover complain
|
|
plasmashell mediate_deleted,complain
|
|
plymouth complain
|
|
plymouth-set-default-theme attach_disconnected,complain
|
|
plymouthd complain
|
|
polkit-kde-authentication-agent complain
|
|
remmina complain
|
|
run-parts complain
|
|
runuser complain
|
|
s3fs complain
|
|
sdcv complain
|
|
sddm attach_disconnected,mediate_deleted,complain
|
|
sftp-server complain
|
|
slirp4netns attach_disconnected,complain
|
|
snap complain
|
|
snap-bootstrap complain
|
|
snap-device-helper complain
|
|
snap-discard-ns complain
|
|
snap-failure complain
|
|
snap-repair complain
|
|
snap-seccomp complain
|
|
snap-update-ns complain
|
|
snapd complain
|
|
snapd-apparmor complain
|
|
snapd-core-fixup complain
|
|
spice-vdagent complain
|
|
spice-vdagentd attach_disconnected,complain
|
|
ssh complain
|
|
sshd attach_disconnected,complain
|
|
ssservice complain
|
|
startplasma complain
|
|
startx attach_disconnected,complain
|
|
steam attach_disconnected,mediate_deleted,complain
|
|
steam-fossilize attach_disconnected,complain
|
|
steam-game attach_disconnected,complain
|
|
steam-gameoverlayui complain
|
|
steam-reaper complain
|
|
sulogin complain
|
|
switcheroo-control attach_disconnected,complain
|
|
swtpm complain
|
|
swtpm_ioctl complain
|
|
swtpm_localca complain
|
|
swtpm_setup complain
|
|
systemd-analyze complain
|
|
systemd-ask-password complain
|
|
systemd-backlight complain
|
|
systemd-binfmt attach_disconnected,complain
|
|
systemd-cgls complain
|
|
systemd-cgtop complain
|
|
systemd-coredump attach_disconnected,mediate_deleted,complain
|
|
systemd-cryptsetup complain
|
|
systemd-dissect complain
|
|
systemd-escape complain
|
|
systemd-firstboot complain
|
|
systemd-generator-bless-boot attach_disconnected,complain
|
|
systemd-generator-cloud-init attach_disconnected,complain
|
|
systemd-generator-cryptsetup attach_disconnected,complain
|
|
systemd-generator-debug attach_disconnected,complain
|
|
systemd-generator-ds-identify attach_disconnected,complain
|
|
systemd-generator-environment-arch complain
|
|
systemd-generator-environment-flatpak complain
|
|
systemd-generator-fstab attach_disconnected,complain
|
|
systemd-generator-getty attach_disconnected,complain
|
|
systemd-generator-gpt-auto attach_disconnected,complain
|
|
systemd-generator-hibernate-resume attach_disconnected,complain
|
|
systemd-generator-integritysetup attach_disconnected,complain
|
|
systemd-generator-ostree attach_disconnected,complain
|
|
systemd-generator-run attach_disconnected,complain
|
|
systemd-generator-system-update attach_disconnected,complain
|
|
systemd-generator-user-autostart complain
|
|
systemd-generator-user-environment complain
|
|
systemd-generator-user-environment-flatpak complain
|
|
systemd-generator-veritysetup attach_disconnected,complain
|
|
systemd-homed attach_disconnected,complain
|
|
systemd-homework complain
|
|
systemd-hostnamed attach_disconnected,complain
|
|
systemd-hwdb attach_disconnected,mediate_deleted,complain
|
|
systemd-inhibit attach_disconnected,complain
|
|
systemd-localed attach_disconnected,complain
|
|
systemd-logind attach_disconnected,complain
|
|
systemd-machine-id-setup attach_disconnected,complain
|
|
systemd-modules-load complain
|
|
systemd-mount complain
|
|
systemd-network-generator complain
|
|
systemd-oomd attach_disconnected,complain
|
|
systemd-portabled complain
|
|
systemd-random-seed complain
|
|
systemd-remount-fs complain
|
|
systemd-resolve complain
|
|
systemd-resolved attach_disconnected,complain
|
|
systemd-shutdown complain
|
|
systemd-sleep complain
|
|
systemd-timedated attach_disconnected,complain
|
|
systemd-tty-ask-password-agent complain
|
|
systemd-udevd attach_disconnected,complain
|
|
systemd-update-done complain
|
|
systemd-update-utmp complain
|
|
systemd-user-runtime-dir complain
|
|
systemd-user-sessions complain
|
|
systemd-userdbd attach_disconnected,complain
|
|
systemd-userwork complain
|
|
systemd-vconsole-setup complain
|
|
systemd.service attach_disconnected,complain
|
|
systemsettings complain
|
|
thunderbird complain
|
|
thunderbird-glxtest complain
|
|
thunderbird-vaapitest complain
|
|
transmission-gtk complain
|
|
udisksctl complain
|
|
udisksd attach_disconnected,complain
|
|
umount complain
|
|
umount.udisks2 complain
|
|
update-ca-certificates complain
|
|
update-grub complain
|
|
update-secureboot-policy complain
|
|
userdbctl complain
|
|
utempter complain
|
|
virt-manager attach_disconnected,complain
|
|
virtinterfaced attach_disconnected,complain
|
|
virtiofsd complain,attach_disconnected
|
|
virtlockd complain
|
|
virtnetworkd complain,attach_disconnected
|
|
virtnodedevd attach_disconnected,complain
|
|
virtsecretd attach_disconnected,complain
|
|
virtstoraged attach_disconnected,complain
|
|
vlc complain
|
|
wg complain
|
|
wg-quick complain
|
|
xdg-dbus-proxy attach_disconnected,complain
|
|
xdg-desktop-icon complain
|
|
xdg-desktop-portal attach_disconnected,complain
|
|
xdg-desktop-portal-gnome complain
|
|
xdg-desktop-portal-gtk complain
|
|
xdg-desktop-portal-kde complain
|
|
xdg-document-portal attach_disconnected,complain
|
|
xdg-permission-store attach_disconnected,complain
|
|
xdg-user-dirs-gtk-update complain
|
|
xdm-xsession complain
|
|
xembedsniproxy complain
|
|
xsettingsd complain
|