Commit graph

19 commits

Author SHA1 Message Date
Matthew Garrett
d9ab83281b Add support for local additions to abstractions
Local policy may want to extend or override abstractions, so add support for including local updates to them.

Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: intrigeri <intrigeri@boum.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:06:03 -08:00
Vincas Dargis
73f01196bb audio: Fix alsa settings access
OpenAL application on Debian Buster produces deny message:
```
type=AVC msg=audit(1547295526.633:732): apparmor="DENIED"
operation="open" profile="supertuxkart" name="/etc/alsa/conf.d/"
pid=13963 comm="supertuxkart" reque
sted_mask="r" denied_mask="r" fsuid=1000 ouid=0
```

Add file rule to allow reading Alsa configuration files.
2019-01-12 14:23:28 +02:00
Vincas Dargis
f73627cbb5 Fix local pulseaudio config file access
Add rules to allow reading .conf files from $HOME/.config/pulse
and $HOME/.config/pulse/client.conf.d directories.
2017-12-17 15:56:21 +02:00
Vincas Dargis
9658471d38 Allow to read pulseaudio config subdirectories
Fixes denied "/etc/pulse/client.conf.d/00-disable-autospawn.conf" read on Debian Sid
2017-11-18 14:20:07 +00:00
intrigeri
b64edfc92b abstractions/audio: allow read-only access to OpenAL's "head-related transfer function" data sets.
These files are used by OpenAL for better spatialization of sounds
when headphones are detected.

Bug and patch by Simon McVittie <smcv@debian.org>:
https://bugs.debian.org/874665
2017-09-10 09:09:10 +02:00
intrigeri
c9bf33e17f audio abstraction: allow reading /etc/wildmidi/wildmidi.cfg. 2014-09-10 15:40:43 -07:00
Seth Arnold
3ee30ca14c Description: Remove access to pulseaudio debug socket from audio abstraction
Grant access to specific files in the /var/run/user/UID/pulse/ directory to
 remove access to potentially dangerous and non-essential files such as the
 debug (cli) socket provided by the module-cli-protocol-unix module.
Author: Tyler Hicks <tyhicks@canonical.com>
Bug-Ubuntu: https://launchpad.net/bugs/1211380
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-13 17:25:31 -08:00
Jamie Strandboge
7e9c7c37be update pulseaudio directory and cookie file paths
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-04-08 20:10:36 -05:00
Steve Beattie
e3e47a7b61 Subject: profiles - owner usage for @{HOME} rules
From: Simon Deziel <simon.deziel@gmail.com>

A fair number of the rules that apply to files in @{HOME} predate the
existence of the 'owner' qualifier. This patch adds the 'owner'
qualifier in several places.

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
Steve Beattie
e6880f9584 Bug: https://bugs.launchpad.net/bugs/794974
Add openal config support to abstractions/audio.

Bug: https://launchpad.net/bugs/794974
2011-08-04 16:52:45 -07:00
Jamie Strandboge
5e273b0892 update profiles/apparmor.d/abstractions/audio to fixup shm patch from
yesterday. Thanks to Christian Boltz.
2011-07-15 13:53:35 -05:00
Jamie Strandboge
35acee98d5 and last one for /dev/shm to /run/shm 2011-07-14 08:21:01 -05:00
Kees Cook
723a20ba7d as ACKed on IRC, drop the unused $Id$ tags everywhere 2010-12-20 12:29:10 -08:00
Jamie Strandboge
df05261cd3 add /etc/sound to audio abstraction 2010-03-08 13:49:37 -06:00
Jamie Strandboge
694c9916b9 pull in Ubuntu updates to profiles/apparmor.d 2009-11-04 14:25:42 -06:00
John Johansen
748e398c21 - various patches and cleanups from kees@ubuntu.com 2008-06-11 20:19:36 +00:00
Seth Arnold
8621cb193a some new abstractions from Mathias Gug 2007-08-27 23:49:51 +00:00
Steve Beattie
7e6e37953f This patch adds a variable definition for the location of /proc in
tunables/proc and modifies all users of /proc to use the variable instead.

I also converted some uses of /proc/*/ to /proc/[0-9]*/ to be a
little more restrictive, as well as removing some references to proc
files that are already covered by abstractions/base (the removals in
abstractions/bash seem justified as all uses of abstractions/bash are
immediately preceded by abstractions/base).
2007-05-25 02:09:30 +00:00
Seth Arnold
2e9a82868f Grand profile repository re-organization. Move directories around to
make the final install layout match the layout in the repository (at
long last :) -- now we can use a single 'make check' target to check the
profiles in the repository against both apparmor_parser and logprof.
2007-05-16 18:51:46 +00:00
Renamed from profiles/abstractions/audio (Browse further)