felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): continue replacing [0-9]* by @{int}.

Browse source
This commit is contained in:
Alexandre Pujol 2024-02-26 21:10:53 +00:00
parent 99e4c4622d
commit 00051bd2f0
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
100 changed files with 222 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/profiles-a-f/adb
View file

@ -24,10 +24,10 @@ profile adb @{exec_path} {
/usr/share/scrcpy/scrcpy-server r,
owner /tmp/adb.[0-9]*.log rw,
owner /tmp/adb.@{int}.log rw,
owner @{HOME}/.android/ rw,
owner @{HOME}/.android/adb.[0-9]* rw,
owner @{HOME}/.android/adb.@{int} rw,
owner @{HOME}/.android/adbkey rw,
include if exists <local/adb>

8
apparmor.d/profiles-a-f/apparmor_parser
View file

@ -29,14 +29,14 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
/usr/share/apparmor-features/{,**} r,
/usr/share/apparmor/{,**} r,
owner /snap/core[0-9]*/@{int}/etc/apparmor.d/{,**} r,
owner /snap/core[0-9]*/@{int}/etc/apparmor/* r,
owner /snap/core@{int}/@{int}/etc/apparmor.d/{,**} r,
owner /snap/core@{int}/@{int}/etc/apparmor/* r,
owner /var/cache/apparmor/{,**} rw,
owner /var/lib/docker/tmp/docker-default[0-9]* r,
owner /var/lib/docker/tmp/docker-default@{int} r,
owner /var/lib/snapd/apparmor/{,**} r,
owner /var/snap/lxd/common/lxd/security/apparmor/{,**} rw,
owner /tmp/cri-containerd.apparmor.d[0-9]* r,
owner /tmp/cri-containerd.apparmor.d@{int} r,
@{sys}/kernel/security/apparmor/{,**} r,
owner @{sys}/kernel/security/apparmor/.{remove,replace,load,access} rw,

2
apparmor.d/profiles-a-f/arduino-ctags
View file

@ -15,7 +15,7 @@ profile arduino-ctags @{exec_path} {
owner /tmp/tags.* rw,
owner /tmp/arduino_build_[0-9]*/** r,
owner /tmp/arduino_build_@{int}/** r,
include if exists <local/arduino-ctags>
}

10
apparmor.d/profiles-a-f/blueman
View file

@ -48,11 +48,11 @@ profile blueman @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/bluetooth*/ r,
owner @{HOME}/bluetooth*/* rw,
owner @{user_cache_dirs}/blueman-tray-[0-9]* rw,
owner @{user_cache_dirs}/blueman-services-[0-9]* rw,
owner @{user_cache_dirs}/blueman-adapters-[0-9]* rw,
owner @{user_cache_dirs}/blueman-manager-[0-9]* rw,
owner @{user_cache_dirs}/blueman-applet-[0-9]* rw,
owner @{user_cache_dirs}/blueman-tray-@{int} rw,
owner @{user_cache_dirs}/blueman-services-@{int} rw,
owner @{user_cache_dirs}/blueman-adapters-@{int} rw,
owner @{user_cache_dirs}/blueman-manager-@{int} rw,
owner @{user_cache_dirs}/blueman-applet-@{int} rw,
owner @{user_cache_dirs}/obexd/ rw,
owner @{user_cache_dirs}/obexd/* rw,

2
apparmor.d/profiles-a-f/bluetoothd
View file

@ -35,7 +35,7 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) {
@{run}/sdp rw,
@{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard
@{sys}/devices/@{pci}/rfkill[0-9]*/name r,
@{sys}/devices/@{pci}/rfkill@{int}/name r,
@{sys}/devices/@{pci}/bluetooth/**/{uevent,name} r,
@{sys}/devices/platform/**/rfkill/**/name r,
@{sys}/devices/virtual/dmi/id/chassis_type r,

12
apparmor.d/profiles-a-f/boltd
View file

@ -34,12 +34,12 @@ profile boltd @{exec_path} flags=(attach_disconnected) {
@{sys}/bus/wmi/devices/ r,
@{sys}/class/ r,
@{sys}/devices/@{pci}/device r,
@{sys}/devices/@{pci}/domain[0-9]*/{security,uevent} r,
@{sys}/devices/@{pci}/domain[0-9]*/**/ r,
@{sys}/devices/@{pci}/domain[0-9]*/**/{authorized,generation} r,
@{sys}/devices/@{pci}/domain[0-9]*/**/{uevent,unique_id} r,
@{sys}/devices/@{pci}/domain[0-9]*/**/{vendor,device}_name r,
@{sys}/devices/@{pci}/domain[0-9]*/iommu_dma_protection r,
@{sys}/devices/@{pci}/domain@{int}/{security,uevent} r,
@{sys}/devices/@{pci}/domain@{int}/**/ r,
@{sys}/devices/@{pci}/domain@{int}/**/{authorized,generation} r,
@{sys}/devices/@{pci}/domain@{int}/**/{uevent,unique_id} r,
@{sys}/devices/@{pci}/domain@{int}/**/{vendor,device}_name r,
@{sys}/devices/@{pci}/domain@{int}/iommu_dma_protection r,
@{sys}/devices/platform/**/uevent r,
@{sys}/devices/platform/*/wmi_bus/wmi_bus-*/@{uuid}/force_power rw,
@{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,

4
apparmor.d/profiles-a-f/browserpass
View file

@ -22,8 +22,8 @@ profile browserpass @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.mozilla/firefox/[0-9a-z]*.*/extensions/* r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/startupCache/scriptCache-*.bin r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/startupCache/startupCache.*.little r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/safebrowsing-updating/google[0-9]/goog-phish-proto-[0-9]*.vlpset rw,
owner /tmp/mozilla-temp-[0-9]* r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/safebrowsing-updating/google[0-9]/goog-phish-proto-@{int}.vlpset rw,
owner /tmp/mozilla-temp-@{int} r,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

2
apparmor.d/profiles-a-f/cawbird
View file

@ -40,7 +40,7 @@ profile cawbird @{exec_path} {
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/cawbird-* rw,
/usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r,
/usr/share/xml/iso-codes/{,**} r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,

6
apparmor.d/profiles-a-f/claws-mail
View file

@ -49,9 +49,9 @@ profile claws-mail @{exec_path} flags=(complain) {
owner @{user_mail_dirs}/ rw,
owner @{user_mail_dirs}/** rwl -> @{user_mail_dirs}/**,
owner /tmp/claws-mail-[0-9]*/ rw,
owner /tmp/claws-mail-[0-9]*/@{hex} rw,
owner /tmp/claws-mail-[0-9]*/@{hex}.lock rwk,
owner /tmp/claws-mail-@{int}/ rw,
owner /tmp/claws-mail-@{int}/@{hex} rw,
owner /tmp/claws-mail-@{int}/@{hex}.lock rwk,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,

2
apparmor.d/profiles-a-f/code
View file

@ -53,7 +53,7 @@ profile code flags=(attach_disconnected) {
@{code_config_dirs}/extensions/** rPUx,
@{HOME}/.go/bin/* rPUx,
@{lib}/go/bin/* rPUx,
@{bin}/python[0-9]* rUx
@{bin}/python3.@{int} rUx,
/etc/shells r,
/etc/lsb-release r,

6
apparmor.d/profiles-a-f/conky
View file

@ -129,8 +129,8 @@ profile conky @{exec_path} {
# Temperatures and Fans
@{bin}/sensors rPUx,
@{sys}/devices/**/hwmon@{int}/temp[0-9]*_input r,
@{sys}/devices/**/hwmon/hwmon@{int}/temp[0-9]*_input r,
@{sys}/devices/**/hwmon@{int}/temp@{int}_input r,
@{sys}/devices/**/hwmon/hwmon@{int}/temp@{int}_input r,
@{sys}/class/hwmon/ r,
@{PROC}/acpi/ibm/fan r,
@ -142,7 +142,7 @@ profile conky @{exec_path} {
@{PROC}/@{pid}/net/route r,
owner /tmp/xauth-[0-9]*-_[0-9] r,
owner /tmp/xauth-@{int}-_[0-9] r,
/usr/share/X11/XErrorDB r,

2
apparmor.d/profiles-a-f/downloadhelper
View file

@ -32,7 +32,7 @@ profile downloadhelper @{exec_path} {
owner @{HOME}/.mozilla/firefox/[0-9a-z]*.*/extensions/* r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/startupCache/scriptCache-*.bin r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/startupCache/startupCache.*.little r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/safebrowsing-updating/google[0-9]/goog-phish-proto-[0-9]*.vlpset rw,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/safebrowsing-updating/google@{int}/goog-phish-proto-@{int}.vlpset rw,
owner /tmp/vdh-*.tmp rw,

2
apparmor.d/profiles-a-f/flatpak-session-helper
View file

@ -26,7 +26,7 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
/var/lib/flatpak/app/*/**/@{lib}/** rPx -> flatpak-app,
owner @{run}/user/@{uid}/.flatpak-helper/{,**} rw,
owner @{run}/user/@{uid}/.flatpak-helper/pkcs11-flatpak-[0-9]* rw,
owner @{run}/user/@{uid}/.flatpak-helper/pkcs11-flatpak-@{int} rw,
owner @{PROC}/@{pids}/fd/ r,

4
apparmor.d/profiles-a-f/fprintd
View file

@ -32,8 +32,8 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
@{sys}/class/hidraw/ r,
@{sys}/devices/@{pci}/hidraw/hidraw[0-9]*/uevent r,
@{sys}/devices/virtual/**/hidraw/hidraw[0-9]*/uevent r,
@{sys}/devices/@{pci}/hidraw/hidraw@{int}/uevent r,
@{sys}/devices/virtual/**/hidraw/hidraw@{int}/uevent r,
include if exists <local/fprintd>
}

2
apparmor.d/profiles-a-f/fritzing
View file

@ -62,7 +62,7 @@ profile fritzing @{exec_path} {
@{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]*
@{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx
@{run}/udev/data/c166:[0-9]* r, # for /dev/ttyACM[0-9]*
@{run}/udev/data/c166:@{int} r, # for /dev/ttyACM[0-9]*
/dev/ttyS@{int} rw,
/dev/ttyACM@{int} rw,