mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Subject: profiles - owner usage for @{HOME} rules

Browse source 
From: Simon Deziel <simon.deziel@gmail.com>

A fair number of the rules that apply to files in @{HOME} predate the
existence of the 'owner' qualifier. This patch adds the 'owner'
qualifier in several places.

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
This commit is contained in:
Steve Beattie 2013-01-04 22:05:53 -08:00
parent 33bfedb95a
commit e3e47a7b61
7 changed files with 38 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
profiles/apparmor.d/abstractions/X
View file

@ -13,10 +13,10 @@
# .ICEauthority files required for X authentication, per user
@{HOME}/.ICEauthority r,
owner @{HOME}/.ICEauthority r,
# .Xauthority files required for X connections, per user
@{HOME}/.Xauthority r,
owner @{HOME}/.Xauthority r,
owner /{,var/}run/gdm{,3}/*/database r,
owner /{,var/}run/lightdm/authority/[0-9]* r,

6
profiles/apparmor.d/abstractions/audio
View file

@ -40,12 +40,12 @@
/usr/share/alsa/** r,
/usr/share/sounds/** r,
@{HOME}/.esd_auth r,
@{HOME}/.asoundrc r,
owner @{HOME}/.esd_auth r,
owner @{HOME}/.asoundrc r,
/etc/esound/esd.conf r,
# libcanberra
@{HOME}/.cache/event-sound-cache.* rwk,
owner @{HOME}/.cache/event-sound-cache.* rwk,
# pulse
/etc/pulse/ r,

16
profiles/apparmor.d/abstractions/fonts
View file

@ -33,14 +33,14 @@
/usr/share/texmf/{,*/}fonts/** r,
/var/lib/ghostscript/** r,
@{HOME}/.fonts.conf r,
@{HOME}/.fonts/ r,
@{HOME}/.fonts/** r,
@{HOME}/.fonts.cache-2 mr,
@{HOME}/.{,cache/}fontconfig/ r,
@{HOME}/.{,cache/}fontconfig/** mrl,
@{HOME}/.fonts.conf.d/ r,
@{HOME}/.fonts.conf.d/** r,
owner @{HOME}/.fonts.conf r,
owner @{HOME}/.fonts/ r,
owner @{HOME}/.fonts/** r,
owner @{HOME}/.fonts.cache-2 mr,
owner @{HOME}/.{,cache/}fontconfig/ r,
owner @{HOME}/.{,cache/}fontconfig/** mrl,
owner @{HOME}/.fonts.conf.d/ r,
owner @{HOME}/.fonts.conf.d/** r,
/usr/local/share/fonts/ r,
/usr/local/share/fonts/** r,

24
profiles/apparmor.d/abstractions/gnome
View file

@ -38,24 +38,24 @@
/usr/lib/@{multiarch}/gdk-pixbuf-*/** mr,
# per-user gtk configuration
@{HOME}/.gnome/Gnome r,
@{HOME}/.gtk r,
@{HOME}/.gtkrc r,
@{HOME}/.gtkrc-2.0 r,
@{HOME}/.gtk-bookmarks r,
@{HOME}/.themes/ r,
@{HOME}/.themes/** r,
owner @{HOME}/.gnome/Gnome r,
owner @{HOME}/.gtk r,
owner @{HOME}/.gtkrc r,
owner @{HOME}/.gtkrc-2.0 r,
owner @{HOME}/.gtk-bookmarks r,
owner @{HOME}/.themes/ r,
owner @{HOME}/.themes/** r,
# for gtk file dialog
@{HOME}/.config/gtk-2.0/** r,
@{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
owner @{HOME}/.config/gtk-2.0/** r,
owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
# from evolution-mail
@{HOME}/.gconfd/lock/* r,
@{HOME}/.gnome/application-info r,
owner @{HOME}/.gconfd/lock/* r,
owner @{HOME}/.gnome/application-info r,
# per-user font business
@{HOME}/.fonts.cache-* rwl,
owner @{HOME}/.fonts.cache-* rwl,
# icon caches
/var/cache/**/icon-theme.cache r,

12
profiles/apparmor.d/abstractions/gnupg
View file

@ -2,9 +2,9 @@
# gnupg sub-process running permissions
# user configurations
@{HOME}/.gnupg/options r,
@{HOME}/.gnupg/pubring.gpg r,
@{HOME}/.gnupg/random_seed rw,
@{HOME}/.gnupg/secring.gpg r,
@{HOME}/.gnupg/so/*.x86_64 mr,
@{HOME}/.gnupg/trustdb.gpg rw,
owner @{HOME}/.gnupg/options r,
owner @{HOME}/.gnupg/pubring.gpg r,
owner @{HOME}/.gnupg/random_seed rw,
owner @{HOME}/.gnupg/secring.gpg r,
owner @{HOME}/.gnupg/so/*.x86_64 mr,
owner @{HOME}/.gnupg/trustdb.gpg rw,

14
profiles/apparmor.d/abstractions/kde
View file

@ -23,13 +23,13 @@
/etc/kde3/* r,
/etc/kde4rc r,
@{HOME}/.DCOPserver_* r,
@{HOME}/.ICEauthority r,
@{HOME}/.fonts.* lrw,
@{HOME}/.kde{,4}/share/config/kdeglobals rw,
@{HOME}/.kde{,4}/share/config/*.lock rwl,
@{HOME}/.qt/** rw,
@{HOME}/.config/Trolltech.conf rwk,
owner @{HOME}/.DCOPserver_* r,
owner @{HOME}/.ICEauthority r,
owner @{HOME}/.fonts.* lrw,
owner @{HOME}/.kde{,4}/share/config/kdeglobals rw,
owner @{HOME}/.kde{,4}/share/config/*.lock rwl,
owner @{HOME}/.qt/** rw,
owner @{HOME}/.config/Trolltech.conf rwk,
/usr/share/icons/ r,
/usr/share/icons/** r,

1
profiles/apparmor.d/abstractions/ubuntu-browsers.d/user-files
View file

@ -5,7 +5,6 @@
@{HOME}/ r,
@{HOME}/** r,
owner @{HOME}/** w,
owner @{HOME}/Desktop/** r,
# Do not allow read and/or write to particularly sensitive/problematic files
#include <abstractions/private-files>