apparmor/profiles/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration

# vim:syntax=apparmor
# Users of this abstraction need to include the ubuntu-helpers abstraction
# in the toplevel profile. Eg:
#   include <abstractions/ubuntu-helpers>

  abi <abi/3.0>,

  # Apport
  /usr/bin/apport-bug Cx -> sanitized_helper,

  # Package installation
  /usr/bin/apturl Cxr -> sanitized_helper,
  /usr/share/software-center/software-center Cxr -> sanitized_helper,

  # Input Methods
  /usr/bin/scim Cx -> sanitized_helper,
  /usr/bin/scim-bridge Cx -> sanitized_helper,

  # File managers
  /usr/bin/nautilus Cxr -> sanitized_helper,
  /usr/bin/{t,T}hunar Cxr -> sanitized_helper,
  /usr/bin/dolphin Cxr -> sanitized_helper,

  # Themes
  /usr/bin/gnome-appearance-properties Cxr -> sanitized_helper,

  # Kubuntu
  /usr/lib/mozilla/kmozillahelper Cxr -> sanitized_helper,

  # Exo-aware applications
  include <abstractions/exo-open>

  # unity webapps integration. Could go in its own abstraction
  owner /run/user/*/dconf/user rw,
  owner @{HOME}/.local/share/unity-webapps/availableapps*.db rwk,
  /usr/bin/debconf-communicate Cxr -> sanitized_helper,
  owner @{HOME}/.config/libaccounts-glib/accounts.db rk,
update ubuntu abstractions to use '# vim:syntax=apparmor' 2010-12-21 12:53:33 -06:00			`# vim:syntax=apparmor`
Change `#include` to `include` in abstractions and tunables 2020-06-09 23:28:41 +02:00			`# Users of this abstraction need to include the ubuntu-helpers abstraction`
don't #include ubuntu-helpers in the abstractions. This can only be included once in policy, otherwise you will get an error regarding multiple definitions for sanitized_helper 2012-01-11 09:00:35 +01:00			`# in the toplevel profile. Eg:`
Change `#include` to `include` in abstractions and tunables 2020-06-09 23:28:41 +02:00			`# include <abstractions/ubuntu-helpers>`
update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com> 2020-05-05 00:08:39 -07:00			`abi <abi/3.0>,`

add Ubuntu-specific profiles/apparmor.d/abstractions/ubuntu-browsers.d/* for use with browser profiles 2010-08-06 16:01:57 -05:00			`# Apport`
update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00			`/usr/bin/apport-bug Cx -> sanitized_helper,`
add Ubuntu-specific profiles/apparmor.d/abstractions/ubuntu-browsers.d/* for use with browser profiles 2010-08-06 16:01:57 -05:00
			`# Package installation`
update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00			`/usr/bin/apturl Cxr -> sanitized_helper,`
			`/usr/share/software-center/software-center Cxr -> sanitized_helper,`
add Ubuntu-specific profiles/apparmor.d/abstractions/ubuntu-browsers.d/* for use with browser profiles 2010-08-06 16:01:57 -05:00
			`# Input Methods`
update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00			`/usr/bin/scim Cx -> sanitized_helper,`
			`/usr/bin/scim-bridge Cx -> sanitized_helper,`
add Ubuntu-specific profiles/apparmor.d/abstractions/ubuntu-browsers.d/* for use with browser profiles 2010-08-06 16:01:57 -05:00
			`# File managers`
update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00			`/usr/bin/nautilus Cxr -> sanitized_helper,`
			`/usr/bin/{t,T}hunar Cxr -> sanitized_helper,`
add Dolphin (default Kubuntu file manager) to the list of file managers in abstractions/ubuntu-browsers.d/ubuntu-integration. Patch by Felix Geyer <debfx@ubuntu.com> Acked-by: Seth Arnold <seth.arnold at canonical.com> Acked-by: Christian Boltz <apparmor@cboltz.de> 2013-07-01 17:48:58 +02:00			`/usr/bin/dolphin Cxr -> sanitized_helper,`
abstractions/ubuntu-browsers.d/ubuntu-integration: update for kmozillahelper and gnome-appearance-properties (LP: #514356, LP: #573344) abstractions/ubuntu-browsers.d/user-files: update for /net (LP: #593413) 2010-08-18 10:06:40 -05:00
			`# Themes`
update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00			`/usr/bin/gnome-appearance-properties Cxr -> sanitized_helper,`
abstractions/ubuntu-browsers.d/ubuntu-integration: update for kmozillahelper and gnome-appearance-properties (LP: #514356, LP: #573344) abstractions/ubuntu-browsers.d/user-files: update for /net (LP: #593413) 2010-08-18 10:06:40 -05:00
			`# Kubuntu`
update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00			`/usr/lib/mozilla/kmozillahelper Cxr -> sanitized_helper,`
allow ixr access to exo-open in Ubuntu integration abstraction (LP: #890894) 2012-01-03 17:22:27 -06:00
			`# Exo-aware applications`
Adjust ubuntu-integration to use abstractions/exo-open Bug-Ubuntu: https://launchpad.net/bugs/1891338 2020-10-25 09:37:01 +00:00			`include <abstractions/exo-open>`
Subject: using webapps triggers firefox rejections Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1056418 From: Steve Beattie <steve.beattie@canonical.com> Came from 0021-webapps_abstraction.patch in the Ubuntu apparmor packaging. jdstrand: +1 (this is in the Ubuntu namespace, so feel free to commit) 2014-02-13 18:10:05 -08:00
			`# unity webapps integration. Could go in its own abstraction`
			`owner /run/user/*/dconf/user rw,`
			`owner @{HOME}/.local/share/unity-webapps/availableapps*.db rwk,`
			`/usr/bin/debconf-communicate Cxr -> sanitized_helper,`
			`owner @{HOME}/.config/libaccounts-glib/accounts.db rk,`