felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update gvfsd profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-11 23:05:34 +02:00
parent f69a7e7213
commit 009fb9285d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 21 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

12
apparmor.d/groups/gvfs/gvfsd-fuse
View file

@ -23,17 +23,25 @@ profile gvfsd-fuse @{exec_path} {
dbus send bus=session path=/org/gtk/vfs/mounttracker dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker interface=org.gtk.vfs.MountTracker
member=RegisterFuse member=RegisterFuse
peer=(name=:*, label=gvfsd), peer=(name=@{busname}, label=gvfsd),
dbus receive bus=session path=/ dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable interface=org.freedesktop.DBus.Introspectable
member=Introspect member=Introspect
peer=(name=:*, label=gnome-shell), peer=(name=@{busname}, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=@{busname}, label=gvfsd-sftp),
@{exec_path} mr, @{exec_path} mr,
@{bin}/fusermount{,3} rCx -> fusermount, @{bin}/fusermount{,3} rCx -> fusermount,
owner @{run}/user/@{uid}/gvfsd-fuse/ rw,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} w,
@{PROC}/sys/fs/pipe-max-size r, @{PROC}/sys/fs/pipe-max-size r,
/dev/fuse rw, /dev/fuse rw,

20
apparmor.d/groups/gvfs/gvfsd-sftp
View file

@ -17,28 +17,26 @@ profile gvfsd-sftp @{exec_path} {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
#aa:dbus talk bus=session name=org.gtk.vfs.{M,m}ountTracker label=gvfsd
dbus receive bus=session path=/org/gtk/vfs/Daemon dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon interface=org.gtk.vfs.Daemon
member=GetConnection member=GetConnection
peer=(name=@{busname}, label=gnome-extension-gsconnect), peer=(name=@{busname}),
dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=@{busname}, label=nautilus),
dbus receive bus=session path=/org/gtk/vfs/mountable dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable interface=org.gtk.vfs.Mountable
member=Mount member=Mount
peer=(name=:*, label=gvfsd), peer=(name=@{busname}, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner interface=org.gtk.vfs.Spawner
member=Spawned member=Spawned
peer=(name=:*, label=gvfsd), peer=(name=@{busname}, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker dbus send bus=session path=/org/gtk/gvfs/mountop/@{int}
member=RegisterMount interface=org.gtk.vfs.MountOperation
peer=(name=:*, label=gvfsd), member={AskQuestion,AskPassword}
peer=(name=@{busname}),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/gvfs/gvfsd-wsdd
View file

@ -15,6 +15,7 @@ profile gvfsd-wsdd @{exec_path} {
include <abstractions/bus/org.gtk.vfs.MountTracker> include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
network inet dgram, # ip=127.0.0.1 peer=(ip=127.0.0.*, port=53),
network netlink raw, network netlink raw,
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd
@ -47,6 +48,7 @@ profile gvfsd-wsdd @{exec_path} {
@{bin}/env mr, @{bin}/env mr,
@{bin}/wsdd rPx, @{bin}/wsdd rPx,
@{run}/avahi-daemon/socket rw,
@{run}/mount/utab r, @{run}/mount/utab r,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
owner @{run}/user/@{uid}/gvfsd/wsdd rw, owner @{run}/user/@{uid}/gvfsd/wsdd rw,