mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-06 17:31:01 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/X

67 lines
1.9 KiB
Text
Raw Normal View History

pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# vim:syntax=apparmor
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# ------------------------------------------------------------------
#
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# Copyright (C) 2002-2009 Novell/SUSE
allow owner read access to /var/run/lightdm/authority/[0-9]* in the X abstraction
2011-06-22 22:26:14 -05:00
# Copyright (C) 2009-2011 Canonical Ltd.
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2020-05-05 00:08:39 -07:00
abi <abi/3.0>,
Change `#include` to `include` in abstractions and tunables
2020-06-09 23:28:41 +02:00
include <abstractions/dri-common>
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# .ICEauthority files required for X authentication, per user
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.ICEauthority r,
Adjust for new ICEauthority path in /run Bug-Ubuntu: https://launchpad.net/bugs/1881357
2020-10-25 09:37:01 +00:00
owner @{run}/user/*/ICEauthority r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# .Xauthority files required for X connections, per user
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.Xauthority r,
abstractions/X: add another location for .Xauthority With the latest sddm, .Xauthority is now located at @{HOME}/.local/share/sddm/.Xauthority
2017-12-17 15:38:26 +01:00
owner @{HOME}/.local/share/sddm/.Xauthority r,
Use "run" variable in profiles Signed-off-by: nl6720 <nl6720@gmail.com>
2020-02-13 11:02:49 +02:00
owner @{run}/gdm{,3}/*/database r,
owner @{run}/lightdm/authority/[0-9]* r,
owner @{run}/lightdm/*/xauthority r,
owner @{run}/user/*/gdm/Xauthority r,
owner @{run}/user/*/X11/Xauthority r,
abstractions/X: add another xauth path Future sddm version will use $XDG_RUNTIME_DIR/xauth_XXXXXX References: - https://bugzilla.opensuse.org/show_bug.cgi?id=1174290 - https://bugzilla.suse.com/show_bug.cgi?id=1174293 - https://github.com/sddm/sddm/pull/1230 - https://github.com/jonls/redshift/issues/763
2020-07-20 20:30:34 +02:00
owner @{run}/user/*/xauth_* r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# the unix socket to use to connect to the display
profiles/apparmor.d/abstractions/X: make x11 socket writable again Unfortunately in apparmor sockets need rw access. Currently x11 can only work if abstract socket is available and used instead so those restrictions won't trigger. This partially reverts https://gitlab.com/apparmor/apparmor/-/commit/c7b836821660b561fee29ce360949aebcb7b4298
2020-10-23 12:22:10 +00:00
/tmp/.X11-unix/* rw,
abstraction updates for abstract, anonymous and netlink - the base abstraction for common abstract and anonymous rules (comments included per rule) - dbus-session-strict to add a rule for connecting to the dbus session abstract socket. I used 'peer=(label=unconfined)' here, but I could probably lose the explicit label if people preferred that - X to add a rule for connecting to the X abstract socket. Same as for dbus-session-strict - nameservice to add a rule for connecting to a netlink raw. This change could possibly be excluded, but applications using networking (at least on Ubuntu) all seem to need it. Excluding it would mean systems using nscd would need to add this and ones not using it would have a noisy denial Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:21:31 -05:00
unix (connect, receive, send)
type=stream
r2606 had updates for the dbus-session-strict and X abstractions but mistakenly did not incorporate feedback from Seth Arnold. Specifically, don't specify label=unconfined on the abstract sockets. Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 15:11:05 -05:00
peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
profiles/apparmor.d/abstractions/X: also allow unix connections to @/tmp/.ICE-unix/[0-9]*, needed by (at least) firefox and thunderbird Signed-off-by: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-07-24 15:01:46 -05:00
unix (connect, receive, send)
type=stream
peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
Bug 295086 - abstractions/X lists /usr/X11R6
2007-08-23 23:26:49 +00:00
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
/usr/include/X11/ r,
/usr/include/X11/** r,
Bug 287579 - <abstractions/X> doesn't allow access to /usr/share/X11 and other xorg directories
2007-08-23 23:12:53 +00:00
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# The X tree changes and is large -- grant read access to the whole thing
/usr/X11R6/** r,
/usr/share/X11/ r,
/usr/share/X11/** r,
/usr/X11R6/**.so* mr,
Description: allow access to egl libraries in X abstraction Bug: https://launchpad.net/bugs/1320014 Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-05-15 22:01:35 -05:00
# EGL
/usr/lib/@{multiarch}/egl/*.so* mr,
Subject: profiles - add user's XCompose file to X abstraction In testing the skype profile, I found access to my @{HOME}/.XCompose was being rejected. This patch updates the X abstraction to take a user's defined XCompose key shortcuts into account. Signed-off-by: Steve Beattie <sbeattie@ubuntu.com> Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-01-02 15:23:08 -08:00
# Xcompose
owner @{HOME}/.XCompose r,
abstractions/X: Allow (only) reading X compose cache ... (/var/cache/libx11/compose/*), and deny any write attempts Reported by darix, https://git.nordisch.org/darix/apparmor-profiles-nordisch/-/blob/master/apparmor.d/teams
2020-11-16 20:42:00 +01:00
/var/cache/libx11/compose/* r,
deny /var/cache/libx11/compose/* wlk,
Subject: profiles - add user's XCompose file to X abstraction In testing the skype profile, I found access to my @{HOME}/.XCompose was being rejected. This patch updates the X abstraction to take a user's defined XCompose key shortcuts into account. Signed-off-by: Steve Beattie <sbeattie@ubuntu.com> Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-01-02 15:23:08 -08:00
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# mouse themes
/etc/X11/cursors/ r,
/etc/X11/cursors/** r,
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:03:11 -08:00
abstractions/X: allow reading the Xauth file mutter passes to Xwayland. Bug-Debian: https://bugs.debian.org/935058 Applications running under Xwayland in a GNOME+Wayland session need read access to this file since: https://gitlab.gnome.org/jwrdegoede/mutter/commit/a8984a81c2e887623d69ec9989ae8a5025f7bd47 … that was first included in mutter 3.33.3. This rule is presumably only needed for GNOME+Wayland sessions, so one could argue that it should live in abstractions/wayland instead, but Jamie argued that it should be in the X abstraction because Xwayland is a X server.
2019-09-08 07:35:00 +00:00
# Xwayland
Use "run" variable in profiles Signed-off-by: nl6720 <nl6720@gmail.com>
2020-02-13 11:02:49 +02:00
owner @{run}/user/*/.mutter-Xwaylandauth.* r,
abstractions/X: allow reading the Xauth file mutter passes to Xwayland. Bug-Debian: https://bugs.debian.org/935058 Applications running under Xwayland in a GNOME+Wayland session need read access to this file since: https://gitlab.gnome.org/jwrdegoede/mutter/commit/a8984a81c2e887623d69ec9989ae8a5025f7bd47 … that was first included in mutter 3.33.3. This rule is presumably only needed for GNOME+Wayland sessions, so one could argue that it should live in abstractions/wayland instead, but Jamie argued that it should be in the X abstraction because Xwayland is a X server.
2019-09-08 07:35:00 +00:00
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:03:11 -08:00
# Include additions to the abstraction
abstractions: remove '#' from 'include if exists' This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'.
2020-05-30 19:46:08 +02:00
include if exists <abstractions/X.d>
Reference in a new issue Copy permalink