feat(profiles): continue replacing [0-9]* by @{int}.

This commit is contained in:
Alexandre Pujol 2024-02-26 21:10:53 +00:00
parent 99e4c4622d
commit 00051bd2f0
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
100 changed files with 222 additions and 229 deletions

View file

@ -24,11 +24,10 @@ profile sensors @{exec_path} {
@{sys}/devices/**/hwmon*/{in[0-9]_label,in[0-9]_min,in[0-9]_max} r,
@{sys}/devices/**/hwmon*/{name,temp*,*_input} r,
@{sys}/devices/**/hwmon*/**/{name,temp*,*_input} r,
@{sys}/devices/**/hwmon/hwmon@{int}/power[0-9]*_crit r,
@{sys}/devices/{,platform/*.{i2c,hdmi}/}i2c-[0-9]*/name r,
@{sys}/devices/**/hwmon/hwmon@{int}/power@{int}_crit r,
@{sys}/devices/{,platform/*.{i2c,hdmi}/}i2c-@{int}/name r,
@{sys}/devices/@{pci}/name r,
@{sys}/devices/platform/**/power_supply/**/hwmon@{int}/curr1_max r,
@{sys}/devices/virtual/hwmon/hwmon[0-9]* r,
@{sys}/devices/virtual/hwmon/hwmon@{int}/ r,
@{sys}/devices/virtual/hwmon/hwmon@{int}/{name,temp*} r,
@{sys}/devices/virtual/hwmon/hwmon@{int}/fan[0-9]_label r,

View file

@ -122,9 +122,9 @@ profile snapd @{exec_path} {
/var/cache/apparmor/*/snap* rw,
/tmp/ r,
/tmp/syscheck-mountpoint-[0-9]*/{,**} rw,
/tmp/syscheck-squashfs-[0-9]* rw,
/tmp/read-file[0-9]*/{,**} rw,
/tmp/syscheck-mountpoint-@{int}/{,**} rw,
/tmp/syscheck-squashfs-@{int} rw,
/tmp/read-file@{int}/{,**} rw,
/boot/ r,
/boot/grub/grubenv r,

View file

@ -26,7 +26,7 @@ profile spice-vdagentd @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/cgroup r,
/dev/uinput rw,
/dev/vport[0-9]*p[0-9]* rw,
/dev/vport@{int}p@{int} rw,
include if exists <local/spice-vdagentd>
}

View file

@ -166,7 +166,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
@{sys}/devices/**/input/input@{int}/ r,
@{sys}/devices/**/uevent r,
@{sys}/devices/@{pci}/class r,
@{sys}/devices/@{pci}/i2c-[0-9]*/report_descriptor r,
@{sys}/devices/@{pci}/i2c-@{int}/report_descriptor r,
@{sys}/devices/@{pci}/sound/card[0-9]*/** r,
@{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r,
@{sys}/devices/system/cpu/** r,

View file

@ -18,10 +18,10 @@ profile steam-fossilize @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.steam/steam.pipe r,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/fozpipelinesv[0-9]*/{,**} rw,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/fozpipelinesv@{int}/{,**} rw,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/mesa_shader_cache_sf/{,**} rwk,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav[0-9]*/GLCache/ rw,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav[0-9]*/GLCache/** rwk,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/ rw,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/** rwk,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
@ -31,7 +31,7 @@ profile steam-fossilize @{exec_path} flags=(attach_disconnected) {
@{PROC}/pressure/io r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner /dev/shm/fossilize-*-[0-9]*-[0-9]* rw,
owner /dev/shm/fossilize-*-@{int}-@{int} rw,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,

View file

@ -101,7 +101,7 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
@{user_share_dirs}/Steam/legacycompat/** mr,
@{user_share_dirs}/Steam/linux{32,64}/ r,
@{user_share_dirs}/Steam/linux{32,64}/**.so* mr,
@{user_share_dirs}/Steam/standalone_installscript_progress_[0-9]*.vdf rw,
@{user_share_dirs}/Steam/standalone_installscript_progress_@{int}.vdf rw,
@{user_share_dirs}/Steam/steamapps/common/*/* mr,
@{user_share_dirs}/Steam/steamapps/common/Proton*/ r,
@{user_share_dirs}/Steam/steamapps/common/Proton*/files/bin/* mrix,
@ -195,9 +195,9 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/**/input@{int}/capabilities/* r,
@{sys}/devices/**/input/input@{int}/ r,
@{sys}/devices/**/uevent r,
@{sys}/devices/@{pci}/sound/card[0-9]*/** r,
@{sys}/devices/@{pci}/sound/card@{int}/** r,
@{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r,
@{sys}/devices/system/clocksource/clocksource[0-9]*/current_clocksource r,
@{sys}/devices/system/clocksource/clocksource@{int}/current_clocksource r,
@{sys}/devices/system/cpu/** r,
@{sys}/devices/system/node/node[0-9]/cpumap r,
@{sys}/devices/system/node/online r,

View file

@ -46,7 +46,7 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/**/hwmon@{int}/ r,
@{sys}/devices/**/hwmon@{int}/name r,
@{sys}/devices/**/hwmon@{int}/temp[0-9]*_{max,crit} r,
@{sys}/devices/**/hwmon@{int}/temp@{int}_{max,crit} r,
@{sys}/devices/**/path r,
@{sys}/devices/virtual/dmi/id/product_name r,
@ -57,10 +57,10 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/thermal/thermal_zone@{int}/ r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/mode rw,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/policy rw,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/trip_point_[0-9]*_temp rw,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/trip_point_[0-9]*_type r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/trip_point_[0-9]*_hyst r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/cdev[0-9]*_trip_point r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/trip_point_@{int}_temp rw,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/trip_point_@{int}_type r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/trip_point_@{int}_hyst r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/cdev@{int}_trip_point r,
@{sys}/devices/virtual/thermal/cooling_device[@{int}/ r,
@{sys}/devices/virtual/thermal/cooling_device@{int}/cur_state rw,
@ -72,7 +72,7 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/powercap/intel-rapl{,-mmio}/intel-rapl{,-mmio}:@{int}/* r,
@{sys}/devices/virtual/powercap/intel-rapl{,-mmio}/intel-rapl{,-mmio}:@{int}/constraint_* w,
@{sys}/devices/virtual/powercap/intel-rapl{,-mmio}/intel-rapl{,-mmio}:@{int}/enabled w,
@{sys}/devices/virtual/powercap/intel-rapl{,-mmio}/intel-rapl{,-mmio}:@{int}/intel-rapl:[0-9]*:[0-9]*/{,*} r,
@{sys}/devices/virtual/powercap/intel-rapl{,-mmio}/intel-rapl{,-mmio}:@{int}/intel-rapl:@{int}/{,*} r,
/dev/acpi_thermal_rel rw,
/dev/input/ r,

View file

@ -16,9 +16,9 @@ profile thinkfan @{exec_path} {
/etc/thinkfan.conf r,
/etc/thinkfan.yaml r,
@{sys}/devices/**/hwmon/**/pwm[0-9]* rw,
@{sys}/devices/**/hwmon/**/pwm[0-9]*_enable rw,
@{sys}/devices/**/hwmon/**/temp[0-9]*_input r,
@{sys}/devices/**/hwmon/**/pwm@{int} rw,
@{sys}/devices/**/hwmon/**/pwm@{int}_enable rw,
@{sys}/devices/**/hwmon/**/temp@{int}_input r,
@{PROC}/acpi/ibm/thermal r,
@{PROC}/acpi/ibm/fan rw,

View file

@ -43,7 +43,7 @@ profile tint2 @{exec_path} {
owner @{HOME}/.Xauthority r,
owner /tmp/tint2-@{pid}-[0-9]*.png rw,
owner /tmp/tint2-@{pid}-@{int}.png rw,
# Battery applet
@{sys}/class/power_supply/ r,

View file

@ -126,7 +126,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/@{pci}/{ata,usb,mmc}[0-9]/{,**/}remove rw,
@{sys}/devices/virtual/bdi/**/read_ahead_kb r,
@{sys}/devices/virtual/block/*/{,**} rw,
@{sys}/devices/virtual/block/loop[0-9]*/uevent rw,
@{sys}/devices/virtual/block/loop@{int}/uevent rw,
@{sys}/devices/virtual/dmi/id/product_uuid r,
@{sys}/devices/virtual/nvme-subsystem/{,**} r,
@{sys}/fs/ r,
@ -139,7 +139,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/mounts r,
/dev/loop-control rw,
/dev/null.[0-9]* rw,
/dev/null.@{int} rw,
include if exists <local/udisksd>
}

View file

@ -29,7 +29,7 @@ profile unhide-tcp @{exec_path} {
@{PROC}/@{pids}/fd/ r,
# For logs
/**/unhide-tcp_[0-9]*-[0-9]*-[0-9]*.log w,
/**/unhide-tcp_@{int}-@{int}-@{int}.log w,
include if exists <local/unhide-tcp>
}

View file

@ -37,7 +37,7 @@ profile update-smart-drivedb @{exec_path} {
/var/lib/smartmontools/drivedb/drivedb.h{,.*} rw,
owner /var/lib/smartmontools/drivedb/.gnupg.[0-9]*.tmp/{,**} rw,
owner /var/lib/smartmontools/drivedb/.gnupg.@{int}.tmp/{,**} rw,
# For shell pwd
/root/ r,
@ -55,8 +55,8 @@ profile update-smart-drivedb @{exec_path} {
/var/lib/smartmontools/drivedb/drivedb.h.new.raw{,.asc} r,
owner /var/lib/smartmontools/drivedb/.gnupg.[0-9]*.tmp/ rw,
owner /var/lib/smartmontools/drivedb/.gnupg.[0-9]*.tmp/** rwkl -> /var/lib/smartmontools/drivedb/.gnupg.[0-9]*.tmp/**,
owner /var/lib/smartmontools/drivedb/.gnupg.@{int}.tmp/ rw,
owner /var/lib/smartmontools/drivedb/.gnupg.@{int}.tmp/** rwkl -> /var/lib/smartmontools/drivedb/.gnupg.@{int}.tmp/**,
}

View file

@ -25,8 +25,8 @@ profile usbguard @{exec_path} {
/etc/usbguard/*.conf rw,
/etc/usbguard/IPCAccessControl.d/{,*} rw,
/dev/shm/qb-usbguard-{request,response,event}-[0-9]*-[0-9]*-[0-9]*-{header,data} rw,
/dev/shm/qb-[0-9]*-[0-9]*-[0-9]*-*/qb-{request,response,event}-usbguard-{header,data} rw,
/dev/shm/qb-usbguard-{request,response,event}-@{int}-@{int}-@{int}-{header,data} rw,
/dev/shm/qb-@{int}-@{int}-@{int}-*/qb-{request,response,event}-usbguard-{header,data} rw,
# For "usbguard generate-policy"
@{sys}/devices/@{pci}/uevent r,

View file

@ -29,10 +29,10 @@ profile usbguard-applet-qt @{exec_path} {
owner @{user_config_dirs}/USBGuard/* rwkl -> @{user_config_dirs}/USBGuard/#@{int},
/dev/shm/#@{int} rw,
/dev/shm/qb-usbguard-{request,response,event}-[0-9]*-[0-9]*-[0-9]*-{header,data} rw,
/dev/shm/qb-[0-9]*-[0-9]*-[0-9]*-*/qb-{request,response,event}-usbguard-{header,data} rw,
/dev/shm/qb-usbguard-{request,response,event}-@{int}-@{int}-@{int}-{header,data} rw,
/dev/shm/qb-@{int}-@{int}-@{int}-*/qb-{request,response,event}-usbguard-{header,data} rw,
owner @{run}/user/@{uid}/sni-qt_usbguard-applet-qt_[0-9]*-[a-zA-Z0-9]*/{,**} rw,
owner @{run}/user/@{uid}/sni-qt_usbguard-applet-qt_@{int}-[a-zA-Z0-9]*/{,**} rw,
owner @{PROC}/@{pid}/cmdline r,
@{PROC}/sys/kernel/core_pattern r,

View file

@ -29,9 +29,9 @@ profile usbguard-daemon @{exec_path} flags=(attach_disconnected) {
/var/log/usbguard/usbguard-audit.log rw,
/dev/shm/ r,
/dev/shm/qb-usbguard-{request,response,event}-[0-9]*-[0-9]*-[0-9]*-{header,data} rw,
/dev/shm/qb-[0-9]*-[0-9]*-[0-9]*-*/ rw,
/dev/shm/qb-[0-9]*-[0-9]*-[0-9]*-*/qb-{request,response,event}-usbguard-{header,data} rw,
/dev/shm/qb-usbguard-{request,response,event}-@{int}-@{int}-@{int}-{header,data} rw,
/dev/shm/qb-@{int}-@{int}-*/ rw,
/dev/shm/qb-@{int}-@{int}-@{int}-*/qb-{request,response,event}-usbguard-{header,data} rw,
@{sys}/devices/@{pci}/uevent r,

View file

@ -15,8 +15,8 @@ profile usbguard-dbus @{exec_path} {
deny capability sys_nice,
@{exec_path} mr,
/dev/shm/qb-usbguard-{request,response,event}-[0-9]*-[0-9]*-[0-9]*-{header,data} rw,
/dev/shm/qb-[0-9]*-[0-9]*-[0-9]*-*/qb-{request,response,event}-usbguard-{header,data} rw,
/dev/shm/qb-usbguard-{request,response,event}-@{int}-@{int}-@{int}-{header,data} rw,
/dev/shm/qb-@{int}-@{int}-@{int}-*/qb-{request,response,event}-usbguard-{header,data} rw,
include if exists <local/usbguard-dbus>
}

View file

@ -13,8 +13,8 @@ profile usbguard-notifier @{exec_path} {
@{exec_path} mr,
/dev/shm/qb-usbguard-{request,response,event}-[0-9]*-[0-9]*-[0-9]*-{header,data} rw,
/dev/shm/qb-[0-9]*-[0-9]*-[0-9]*-*/qb-{request,response,event}-usbguard-{header,data} rw,
/dev/shm/qb-usbguard-{request,response,event}-@{int}-@{int}-@{int}-{header,data} rw,
/dev/shm/qb-@{int}-@{int}-@{int}-*/qb-{request,response,event}-usbguard-{header,data} rw,
owner @{PROC}/@{pid}/loginuid r,

View file

@ -13,8 +13,8 @@ profile utmpdump @{exec_path} {
@{exec_path} mr,
/var/log/wtmp{,.[0-9]*} r,
/var/log/btmp{,.[0-9]*} r,
/var/log/wtmp{,.@{int}} r,
/var/log/btmp{,.@{int}} r,
include if exists <local/utmpdump>
}

View file

@ -33,7 +33,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
@{sh_path} rix,
@{bin}/python3.@{int} r,
@{lib}/python3.@{int}/site-packages/__pycache__/guestfs.cpython-[0-9]*.pyc.[0-9]* w,
@{lib}/python3.@{int}/site-packages/__pycache__/guestfs.cpython-@{int}.pyc.@{int} w,
@{bin}/ r,
@{bin}/env rix,

View file

@ -65,7 +65,7 @@ profile wireplumber @{exec_path} {
@{sys}/devices/**/device:*/**/path r,
@{sys}/devices/**/sound/**/pcm_class r,
@{sys}/devices/**/sound/**/uevent r,
@{sys}/devices/@{pci}/video4linux/video[0-9]*/uevent r,
@{sys}/devices/@{pci}/video4linux/video@{int}/uevent r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,

View file

@ -79,7 +79,7 @@ profile wireshark @{exec_path} {
/dev/shm/#@{int} rw,
owner /tmp/wireshark_extcap_ciscodump_[0-9]*_* rw,
owner /tmp/wireshark_extcap_ciscodump_@{int}_* rw,
# Allowed apps to open
@{lib}/firefox/firefox rPUx,

View file

@ -33,10 +33,10 @@ profile wpa-action @{exec_path} {
/etc/network/interfaces r,
/etc/network/interfaces.d/{,*} r,
owner @{run}/wpa_action.wlan[0-9]*.ifupdown rw,
owner @{run}/wpa_action.wlan[0-9]*.timestamp rw,
owner @{run}/network/ifstate.wlan[0-9]* rwk,
owner @{run}/sendsigs.omit.d/wpasupplicant.wpa_supplicant.wlan[0-9]*.pid rw,
owner @{run}/wpa_action.wlan@{int}.ifupdown rw,
owner @{run}/wpa_action.wlan@{int}.timestamp rw,
owner @{run}/network/ifstate.wlan@{int} rwk,
owner @{run}/sendsigs.omit.d/wpasupplicant.wpa_supplicant.wlan@{int}.pid rw,
include if exists <local/wpa-action>
}

View file

@ -18,7 +18,7 @@ profile wpa-cli @{exec_path} {
/etc/inputrc r,
owner @{HOME}/.wpa_cli_history rw,
owner @{HOME}/.wpa_cli_history-[0-9]*.tmp rw,
owner @{HOME}/.wpa_cli_history-@{int}.tmp rw,
owner @{run}/wpa_supplicant/ r,
owner /tmp/wpa_ctrl_@{pid}-[0-9] rw,

View file

@ -19,7 +19,7 @@ profile xsel @{exec_path} {
owner @{user_cache_dirs}/xsel.log rw,
owner @{HOME}/.Xauthority r,
owner /tmp/xauth-[0-9]*-_[0-9] r,
owner /tmp/xauth-@{int}-_[0-9] r,
# file_inherit
owner /dev/tty@{int} rw,

View file

@ -61,7 +61,7 @@ profile youtube-viewer @{exec_path} {
/etc/wgetrc r,
owner @{HOME}/.wget-hsts r,
owner @{HOME}/wget-log{,.[0-9]*} rw,
owner @{HOME}/wget-log{,.@{int}} rw,
}