apparmor/profiles/apparmor.d/abstractions/dbus-session

# vim:syntax=apparmor
# ------------------------------------------------------------------
#
#    Copyright (C) 2011 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  /usr/bin/dbus-launch ix,

  # unique per-machine identifier
  /etc/machine-id r,
  /var/lib/dbus/machine-id r,
  dbus bus=session,
add dbus-session abstraction 2010-04-19 12:38:17 -05:00			`# vim:syntax=apparmor`
			`# ------------------------------------------------------------------`
			`#`
profiles/apparmor.d/abstractions/dbus-session: Per discussion with John Johansen, use 'ix' instead of 'Pix' for dbus-launch since if someone happens to define a profile for dbus-launch and it is loosely confined, then users of this abstraction could end up launching a program via dbus-launch in a less confined manner than intended. This sort of thing should not be possible via an abstraction (and people are always free to profile using Pix if they prefer). 2011-05-09 18:09:24 +02:00			`# Copyright (C) 2011 Canonical Ltd.`
add dbus-session abstraction 2010-04-19 12:38:17 -05:00			`#`
			`# This program is free software; you can redistribute it and/or`
			`# modify it under the terms of version 2 of the GNU General Public`
			`# License published by the Free Software Foundation.`
			`#`
			`# ------------------------------------------------------------------`

profiles/apparmor.d/abstractions/dbus-session: Per discussion with John Johansen, use 'ix' instead of 'Pix' for dbus-launch since if someone happens to define a profile for dbus-launch and it is loosely confined, then users of this abstraction could end up launching a program via dbus-launch in a less confined manner than intended. This sort of thing should not be possible via an abstraction (and people are always free to profile using Pix if they prefer). 2011-05-09 18:09:24 +02:00			`/usr/bin/dbus-launch ix,`
profiles - Allow reading /etc/machine-id in the dbus-session abstraction. From: intrigeri <intrigeri@boum.org> D-Bus now uses /etc/machine-id in some cases: https://bugs.freedesktop.org/show_bug.cgi?id=35228 Acked-by: Steve Beattie <steve@nxnw.org> 2013-09-11 16:03:32 -07:00
			`# unique per-machine identifier`
			`/etc/machine-id r,`
tighten up the dbus abstractions 2010-08-03 12:04:37 -05:00			`/var/lib/dbus/machine-id r,`
profiles: Allow full D-Bus access in system and session abstractions Before D-Bus mediation support was added to AppArmor, the dbus and dbus-session abstractions granted full access to the system and session buses, respectively. In order to continue granting full access to those buses, bus-specific D-Bus mediation rules need to be added to the abstractions. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> 2013-12-19 23:17:10 -08:00			`dbus bus=session,`