mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-06 17:31:01 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/dbus-session-strict

26 lines
809 B
Text
Raw Normal View History

profiles: Add strict session bus abstraction Move some of the file rules from the existing permissive session bus abstraction into a new strict session bus abstraction. Leave the dbus-launch rule in the permissive profile since not all applications will need it. The strict abstraction only allows for calling the Hello, AddMatch, RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods that are exported by the D-Bus daemon. The permissive abstraction reuses the strict abstraction and then allows all communications on the session bus. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com> Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-01-10 15:35:09 -06:00
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
# Copyright (C) 2011-2013 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# unique per-machine identifier
/etc/machine-id r,
/var/lib/dbus/machine-id r,
abstraction updates for abstract, anonymous and netlink - the base abstraction for common abstract and anonymous rules (comments included per rule) - dbus-session-strict to add a rule for connecting to the dbus session abstract socket. I used 'peer=(label=unconfined)' here, but I could probably lose the explicit label if people preferred that - X to add a rule for connecting to the X abstract socket. Same as for dbus-session-strict - nameservice to add a rule for connecting to a netlink raw. This change could possibly be excluded, but applications using networking (at least on Ubuntu) all seem to need it. Excluding it would mean systems using nscd would need to add this and ones not using it would have a noisy denial Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:21:31 -05:00
unix (connect, receive, send)
type=stream
r2606 had updates for the dbus-session-strict and X abstractions but mistakenly did not incorporate feedback from Seth Arnold. Specifically, don't specify label=unconfined on the abstract sockets. Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 15:11:05 -05:00
peer=(addr="@/tmp/dbus-*"),
abstraction updates for abstract, anonymous and netlink - the base abstraction for common abstract and anonymous rules (comments included per rule) - dbus-session-strict to add a rule for connecting to the dbus session abstract socket. I used 'peer=(label=unconfined)' here, but I could probably lose the explicit label if people preferred that - X to add a rule for connecting to the X abstract socket. Same as for dbus-session-strict - nameservice to add a rule for connecting to a netlink raw. This change could possibly be excluded, but applications using networking (at least on Ubuntu) all seem to need it. Excluding it would mean systems using nscd would need to add this and ones not using it would have a noisy denial Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:21:31 -05:00
profiles: Add strict session bus abstraction Move some of the file rules from the existing permissive session bus abstraction into a new strict session bus abstraction. Leave the dbus-launch rule in the permissive profile since not all applications will need it. The strict abstraction only allows for calling the Hello, AddMatch, RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods that are exported by the D-Bus daemon. The permissive abstraction reuses the strict abstraction and then allows all communications on the session bus. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com> Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-01-10 15:35:09 -06:00
dbus send
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
peer=(name=org.freedesktop.DBus),
Reference in a new issue Copy permalink