mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-06 17:31:01 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/gnome

118 lines
3.6 KiB
Text
Raw Normal View History

some new abstractions from Mathias Gug
2007-08-27 23:49:51 +00:00
# vim:syntax=apparmor
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# ------------------------------------------------------------------
#
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# Copyright (C) 2002-2009 Novell/SUSE
Author: Jamie Strandboge <jamie@canonical.com>, Steve Langasek <steve.langasek@linaro.org>, Steve Beattie <sbeattie@ubuntu.com> Description: add multiarch support to abstractions Bug-Ubuntu: https://bugs.launchpad.net/bugs/736870 This patch add multiarch support for common shared library locations, as well as a tunables file and directory to ease adding addiotional multiarch paths. Bug: https://launchpad.net/bugs/736870
2011-03-23 12:24:11 -07:00
# Copyright (C) 2009-2011 Canonical Ltd.
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2020-05-05 00:08:39 -07:00
abi <abi/3.0>,
Change `#include` to `include` in abstractions and tunables
2020-06-09 23:28:41 +02:00
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/X>
include <abstractions/freedesktop.org>
include <abstractions/xdg-desktop>
include <abstractions/user-tmp>
include <abstractions/wayland>
some new abstractions from Mathias Gug
2007-08-27 23:49:51 +00:00
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# systemwide gtk defaults
/etc/gnome/gtkrc* r,
/etc/gtk/* r,
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
/usr/lib{,32,64}/gtk/** mr,
Author: Jamie Strandboge <jamie@canonical.com>, Steve Langasek <steve.langasek@linaro.org>, Steve Beattie <sbeattie@ubuntu.com> Description: add multiarch support to abstractions Bug-Ubuntu: https://bugs.launchpad.net/bugs/736870 This patch add multiarch support for common shared library locations, as well as a tunables file and directory to ease adding addiotional multiarch paths. Bug: https://launchpad.net/bugs/736870
2011-03-23 12:24:11 -07:00
/usr/lib/@{multiarch}/gtk/** mr,
Update abstractions/gnome with versioned gtk paths References: https://bugs.debian.org/845005 Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-11-22 00:30:42 +01:00
/usr/lib{,32,64}/gtk-[0-9]*/** mr,
/usr/lib/@{multiarch}/gtk-[0-9]*/** mr,
Add missing directory read access rules
2014-02-20 10:31:07 -05:00
/usr/share/themes/ r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/usr/share/themes/** r,
abstractions/gnome: allow /usr/share/gtk-3.0/settings.ini GTK+ 3 has a global settings file that should be readable as well.
2020-08-18 12:28:53 +02:00
/usr/share/gtk-3.0/settings.ini r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# for gnome 1 applications
/etc/orbitrc r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# gtk-2 needed some new rights
/etc/fonts/* r,
/etc/gtk-*/* r,
/etc/pango/* r,
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
/usr/lib{,32,64}/pango/** mr,
/usr/lib{,32,64}/gtk-*/** mr,
fix for LP: #611248
2010-08-03 09:13:34 -05:00
/usr/lib{,32,64}/gdk-pixbuf-*/** mr,
Author: Jamie Strandboge <jamie@canonical.com>, Steve Langasek <steve.langasek@linaro.org>, Steve Beattie <sbeattie@ubuntu.com> Description: add multiarch support to abstractions Bug-Ubuntu: https://bugs.launchpad.net/bugs/736870 This patch add multiarch support for common shared library locations, as well as a tunables file and directory to ease adding addiotional multiarch paths. Bug: https://launchpad.net/bugs/736870
2011-03-23 12:24:11 -07:00
/usr/lib/@{multiarch}/pango/** mr,
/usr/lib/@{multiarch}/gtk-*/** mr,
/usr/lib/@{multiarch}/gdk-pixbuf-*/** mr,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# per-user gtk configuration
Updated abstractions to allow creating some common config dirs
2018-08-08 19:28:25 -04:00
owner @{HOME}/.config/gtk-3.0/ w,
gnome abstraction: grant read access to ~/.config/gtk-3.0/*. E.g. Totem needs access to ~/.config/gtk-3.0/settings.ini.
2016-11-06 10:23:51 +01:00
owner @{HOME}/.config/gtk-3.0/* r,
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.gnome/Gnome r,
owner @{HOME}/.gtk r,
owner @{HOME}/.gtkrc r,
owner @{HOME}/.gtkrc-2.0 r,
owner @{HOME}/.gtk-bookmarks r,
owner @{HOME}/.themes/ r,
owner @{HOME}/.themes/** r,
gnome abstraction: allow reading per-user themes from $XDG_DATA_HOME Bug-Debian: https://bugs.debian.org/930031 As per https://developer.gnome.org/gtk3/stable/ch32s03.html, since GTK+ 3.6, $XDG_DATA_HOME/themes is preferred over $HOME/.themes. We already support the latter, let's also support the former.
2019-12-11 06:31:37 +00:00
owner @{user_share_dirs}/themes/ r,
owner @{user_share_dirs}/themes/** r,
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# for gtk file dialog
Updated abstractions to allow creating some common config dirs
2018-08-08 19:28:25 -04:00
owner @{HOME}/.config/gtk-2.0/ w,
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.config/gtk-2.0/** r,
owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# from evolution-mail
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.gconfd/lock/* r,
owner @{HOME}/.gnome/application-info r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# per-user font business
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.fonts.cache-* rwl,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
profiles/gnome: add @{HOME}/.cache/gtk-3.0 Found this path is used by gtk_compose_hash_get_cache_path() in gtkcomposetable.c.
2019-02-19 18:16:49 +01:00
# GtkComposeTable
owner @{HOME}/.cache/gtk-3.0/** r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# icon caches
/var/cache/**/icon-theme.cache r,
/usr/share/**/icon-theme.cache r,
some new abstractions from Mathias Gug
2007-08-27 23:49:51 +00:00
abstractions/gnome: allow reading GLib schemas. Based on Cameron Norman's initial work (http://bazaar.launchpad.net/~cameronnemo/apparmor/gnome-abstraction/revision/3111) with the following changes: * don't include GTK+ 3.0 configuration: already done earlier * generalize to future GLib versions * support /usr/local * allow reading the parent directory as well, following the lead of usr.lib.telepathy: this is harmless and could be needed in some cases.
2017-07-03 09:44:43 +02:00
# GLib schemas
/usr/{local/,}share/glib-[0-9]*/schemas/ r,
/usr/{local/,}share/glib-[0-9]*/schemas/** r,
some new abstractions from Mathias Gug
2007-08-27 23:49:51 +00:00
# gnome VFS modules
- various patches and cleanups from kees@ubuntu.com
2008-06-11 20:19:36 +00:00
/etc/gnome-vfs-2.0/modules/ r,
some new abstractions from Mathias Gug
2007-08-27 23:49:51 +00:00
/etc/gnome-vfs-2.0/modules/* r,
/usr/lib/gnome-vfs-2.0/modules/*.so mr,
Author: Jamie Strandboge <jamie@canonical.com>, Steve Langasek <steve.langasek@linaro.org>, Steve Beattie <sbeattie@ubuntu.com> Description: add multiarch support to abstractions Bug-Ubuntu: https://bugs.launchpad.net/bugs/736870 This patch add multiarch support for common shared library locations, as well as a tunables file and directory to ease adding addiotional multiarch paths. Bug: https://launchpad.net/bugs/736870
2011-03-23 12:24:11 -07:00
/usr/lib/@{multiarch}/gnome-vfs-2.0/modules/*.so mr,
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# gvfs
/usr/share/gvfs/remote-volume-monitors/ r,
/usr/share/gvfs/remote-volume-monitors/* r,
Subject: profiles - use @{pid} tunable This patch adds the kernelvars tunable to the global set that is usually included by default in apparmor policies. It then converts the rules that are intended to match /proc/pid to use this tunable. Signed-off-by: Steve Beattie <sbeattie@ubuntu.com> Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-01-02 15:34:38 -08:00
@{PROC}/@{pid}/mounts r,
Use "run" variable in profiles Signed-off-by: nl6720 <nl6720@gmail.com>
2020-02-13 11:02:49 +02:00
@{run}/mount/utab r,
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# printing
/etc/papersize r,
/etc/cups/lpoptions r,
/usr/share/cups/charmaps/** r,
# holds MIT-MAGIC-COOKIE for gnome
Use "run" variable in profiles Signed-off-by: nl6720 <nl6720@gmail.com>
2020-02-13 11:02:49 +02:00
owner @{run}/gdm/auth*/database r,
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
abstractions/gnome: add /etc/gnome/defaults.list
2009-11-10 14:04:26 -06:00
# mime-types
/etc/gnome/defaults.list r,
abstractions/gnome: also allow /etc/xdg/mimeapps.list References: - https://launchpad.net/bugs/1792027
2019-12-17 15:51:59 -06:00
/etc/xdg/{,*-}mimeapps.list r,
Add missing directory read access rules
2014-02-20 10:31:07 -05:00
/usr/share/gnome/applications/ r,
profiles/apparmor.d/abstractions/gnome: add read access to /usr/share/gnome/applications/mimeinfo.cache, which is now needed by Gnome applications.
2011-07-12 07:38:17 -05:00
/usr/share/gnome/applications/mimeinfo.cache r,
Update gnome abstraction to allow unix connections to dbus-vfs-daemon abstract socket. Note, DBus mediation is still in effect so rules still need to be added for accessing the DBus API (LP: #1375067) Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-10-06 14:06:23 -05:00
# Allow connecting to the GNOME vfs socket (still need corresponding DBus
# rules)
unix (send, receive, connect)
type=stream
peer=(addr="@/dbus-vfs-daemon/socket-*"),
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:03:11 -08:00
# Include additions to the abstraction
abstractions: remove '#' from 'include if exists' This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'.
2020-05-30 19:46:08 +02:00
include if exists <abstractions/gnome.d>
Reference in a new issue Copy permalink