felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update pcmanfm-qt

Browse source
This commit is contained in:
Besanon 2025-08-15 09:44:56 +02:00 • committed by GitHub
parent f0a707364f
commit 03275ff5c7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 26 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

82
apparmor.d/groups/lxqt/pcmanfm-qt
View file

@ -10,13 +10,11 @@ include <tunables/global>
@{exec_path} = @{bin}/pcmanfm-qt @{exec_path} = @{bin}/pcmanfm-qt
profile pcmanfm-qt @{exec_path} { profile pcmanfm-qt @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.UDisks2> include <abstractions/bus/org.freedesktop.UDisks2>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/devices-usb> include <abstractions/devices-usb>
include <abstractions/disks-read>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/lxqt> include <abstractions/lxqt>
@ -29,26 +27,32 @@ profile pcmanfm-qt @{exec_path} {
network netlink raw, network netlink raw,
#aa:dbus own bus=session name=org.pcmanfm.PCManFM
#aa:exec kioworker #aa:exec kioworker
@{exec_path} mr, @{exec_path} mr,
@{lib}/menu-cache/menu-cached rPx, @{lib}/menu-cache/menu-cached rix,
@{lib}/exec/menu-cache/menu-cache-gen rix, @{lib}/exec/menu-cache/menu-cache-gen rix,
owner @{user_cache_dirs}/pcmanfm-qt/** r, #aa:lint ignore=too-wide
owner @{user_config_dirs}/pcmanfm-qt/lxqt/ r, # Full access to user's data
owner @{user_config_dirs}/pcmanfm-qt/lxqt/recent-files.conf.lock rwk, / r,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/desktop-items-0.conf.@{rand6} l -> @{user_config_dirs}/pcmanfm-qt/lxqt/#@{int}, /*/ r,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/dir-settings.conf~ l -> @{user_config_dirs}/pcmanfm-qt/lxqt/dir-settings.conf, @{bin}/ r,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/desktop-items-eDP-@{int}.conf.lock rwk, @{lib}/ r,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/settings.conf.lock rwk, @{MOUNTDIRS}/ r,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/settings.conf.@{rand6} l -> @{user_config_dirs}/pcmanfm-qt/lxqt/#@{int}, @{MOUNTS}/ r,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/desktop-items-0.conf.lock rwk, @{MOUNTS}/** rw,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/desktop-items-eDP-@{int}.conf l -> @{user_config_dirs}/pcmanfm-qt/lxqt/#@{int}, owner @{HOME}/ r,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/recent-files.conf.@{rand6} l -> @{user_config_dirs}/pcmanfm-qt/lxqt/#@{int}, owner @{HOME}/** rw,
owner @{user_config_dirs}/pcmanfm-qt/lxqt/settings.conf.lock.* rwk, owner @{run}/user/@{uid}/ r,
owner @{run}/user/@{uid}/** rw,
owner @{tmp}/ r,
owner @{tmp}/** rw,
owner @{user_cache_dirs}/pcmanfm-qt/{,**} rw,
owner @{user_config_dirs}/pcmanfm-qt/ rw,
owner @{user_config_dirs}/pcmanfm-qt/** rwlk -> @{user_config_dirs}/pcmanfm-qt/**,
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/class/ r, @{sys}/class/ r,
@ -61,46 +65,12 @@ profile pcmanfm-qt @{exec_path} {
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
# To read/write files in the system. The read permission is granted for all files, the write # Silence non user's data
# permission only for the owner. Also, dirs like /dev/, /efi/, /proc/, /sys/ are not included in deny @{efi}/{,**} r,
# the list. deny /opt/{,**} r,
/ r, deny /root/{,**} r,
@{efi}/ r, deny /tmp/.* rw,
@{efi}/** r, deny /tmp/.*/{,**} rw,
owner @{efi}/** rw,
/etc/ r,
/etc/** r,
owner /etc/** rw,
/home/ r,
/home/** r,
/home/** rw,
/lost+found/ r,
/lost+found/** r,
owner /lost+found/** rw,
@{MOUNTS}/ r,
@{MOUNTS}/** r,
owner @{MOUNTS}/** rw,
/opt/ r,
/opt/** r,
owner /opt/** rw,
/root/ r,
/root/** r,
owner /root/** rw,
@{run}/ r,
@{run}/** r,
owner @{run}/** rw,
/srv/ r,
/srv/** r,
owner /srv/** rw,
/tmp/ r,
/tmp/** r,
owner /tmp/** rw,
/usr/ r,
/usr/** r,
owner /usr/** rw,
/var/ r,
/var/** r,
owner /var/** rw,
/dev/tty r, /dev/tty r,