apparmor/profiles/apparmor.d/abstractions/dri-common

# vim:syntax=apparmor

# This file contains common DRI-specific rules useful for GUI applications
# (needed by libdrm and similar).

  /usr/lib{,32,64}/dri/**         mr,
  /usr/lib/@{multiarch}/dri/**    mr,
  /usr/lib/fglrx/dri/**           mr,
  /dev/dri/**                     rw,
  /etc/drirc                      r,
  /usr/share/drirc.d/{,*.conf}    r,
  owner @{HOME}/.drirc            r,


  # Include additions to the abstraction
  #include if exists <abstractions/dri-common.d>
Move DRI-specific rules into it's own abstraction Add new dri-common abstraction to contain basic DRI-specific rules. This refactoring is based on a decision to have set of dri-* abstractions for fine grained control on case-by-case basis. While dri-common is included in X abstraction by default, additional DRI-related abstractions can be introduced (such as for enumerating graphics devices) while keeping them logically together with same dri- prefix. 2018-02-04 13:51:41 +02:00			`# vim:syntax=apparmor`

			`# This file contains common DRI-specific rules useful for GUI applications`
			`# (needed by libdrm and similar).`

			`/usr/lib{,32,64}/dri/** mr,`
			`/usr/lib/@{multiarch}/dri/** mr,`
			`/usr/lib/fglrx/dri/** mr,`
			`/dev/dri/** rw,`
			`/etc/drirc r,`
Move drirc.d access to dri-common abstraction Commit b5be5964609b4e0927af7c9e4f0276e50ccdc3e3 added ability to read /usr/share/drirc.d/ directory to mesa abstraction. This seems to be a mistake, as it was noted that not all GUI applications, that need access to drirc.d, also need whole mesa-related rules (including writing caches). Move /usr/share/drirc.d/ access to different abstraction. This is not a breaking change, because any GUI application will have included X abstraction already, and in the end result - dri-common abstraction too. 2019-01-27 17:34:54 +02:00			`/usr/share/drirc.d/{,*.conf} r,`
Move DRI-specific rules into it's own abstraction Add new dri-common abstraction to contain basic DRI-specific rules. This refactoring is based on a decision to have set of dri-* abstractions for fine grained control on case-by-case basis. While dri-common is included in X abstraction by default, additional DRI-related abstractions can be introduced (such as for enumerating graphics devices) while keeping them logically together with same dri- prefix. 2018-02-04 13:51:41 +02:00			`owner @{HOME}/.drirc r,`

Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com> 2019-01-24 03:03:11 -08:00
			`# Include additions to the abstraction`
			`#include if exists <abstractions/dri-common.d>`