mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-06 17:31:01 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/dbus-session

21 lines
731 B
Text
Raw Normal View History

add dbus-session abstraction
2010-04-19 12:38:17 -05:00
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
profiles: Add strict session bus abstraction Move some of the file rules from the existing permissive session bus abstraction into a new strict session bus abstraction. Leave the dbus-launch rule in the permissive profile since not all applications will need it. The strict abstraction only allows for calling the Hello, AddMatch, RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods that are exported by the D-Bus daemon. The permissive abstraction reuses the strict abstraction and then allows all communications on the session bus. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com> Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-01-10 15:35:09 -06:00
# Copyright (C) 2011-2013 Canonical Ltd.
add dbus-session abstraction
2010-04-19 12:38:17 -05:00
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
profiles: Add strict session bus abstraction Move some of the file rules from the existing permissive session bus abstraction into a new strict session bus abstraction. Leave the dbus-launch rule in the permissive profile since not all applications will need it. The strict abstraction only allows for calling the Hello, AddMatch, RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods that are exported by the D-Bus daemon. The permissive abstraction reuses the strict abstraction and then allows all communications on the session bus. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com> Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-01-10 15:35:09 -06:00
# This abstraction grants full session bus access. Consider using the
# dbus-session-strict abstraction for fine-grained bus mediation.
profiles - Allow reading /etc/machine-id in the dbus-session abstraction. From: intrigeri <intrigeri@boum.org> D-Bus now uses /etc/machine-id in some cases: https://bugs.freedesktop.org/show_bug.cgi?id=35228 Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-11 16:03:32 -07:00
profiles: Add strict session bus abstraction Move some of the file rules from the existing permissive session bus abstraction into a new strict session bus abstraction. Leave the dbus-launch rule in the permissive profile since not all applications will need it. The strict abstraction only allows for calling the Hello, AddMatch, RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods that are exported by the D-Bus daemon. The permissive abstraction reuses the strict abstraction and then allows all communications on the session bus. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com> Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-01-10 15:35:09 -06:00
#include <abstractions/dbus-session-strict>
/usr/bin/dbus-launch ix,
profiles: Allow full D-Bus access in system and session abstractions Before D-Bus mediation support was added to AppArmor, the dbus and dbus-session abstractions granted full access to the system and session buses, respectively. In order to continue granting full access to those buses, bus-specific D-Bus mediation rules need to be added to the abstractions. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-19 23:17:10 -08:00
dbus bus=session,
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:03:11 -08:00
# Include additions to the abstraction
#include if exists <abstractions/dbus-session.d>
Reference in a new issue Copy permalink