felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update apparmor profiles

Browse source 
Adpated to the apparmor.d structure.

Signed-off-by: Mikhail Morfikov <mmorfikov@gmail.com>
This commit is contained in:
Mikhail Morfikov 2021-04-03 12:03:57 +02:00 • committed by Alexandre Pujol
parent 19521569ce
commit 046443a702
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
35 changed files with 798 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

68
apparmor.d/abstractions/gstreamer
View file

@ -1,45 +1,53 @@
# vim:syntax=apparmor
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only
include <abstractions/base>
include <abstractions/p11-kit>
include <abstractions/X>
abi <abi/3.0>,
##include <abstractions/p11-kit>
##include <abstractions/X>
# TODO: adjust when support finer-grained netlink rules
network netlink raw,
#network netlink raw,
/etc/udev/udev.conf r,
/etc/wildmidi/wildmidi.cfg r,
#/etc/udev/udev.conf r,
#/etc/wildmidi/wildmidi.cfg r,
/dev/ r,
/dev/bus/usb/ r,
/dev/dri/ r,
# /dev/shm is a symlink to /run/shm on ubuntu
owner /{dev,run}/shm/shmfd-* rw,
#owner /{dev,run}/shm/shmfd-* rw,
/run/udev/data/c* r,
/run/udev/data/+pci:* r,
/run/udev/data/+usb* r,
#
@{run}/udev/data/c81:* r, # For video4linux
@{run}/udev/data/c226:* r, # For /dev/dri/card[0-9]*
@{run}/udev/data/+drm:* r, # For screen outputs
#@{run}/udev/data/+pci:* r,
@{run}/udev/data/+usb:* r,
/sys/bus/ r,
/sys/bus/usb/devices/ r,
/sys/class/ r,
/sys/class/drm/ r,
/sys/devices/pci[0-9]*/**/{busnum,config,devnum,descriptors,speed,uevent} r,
/sys/devices/system/node/ r,
/sys/devices/system/node/*/meminfo r,
@{sys}/bus/ r,
@{sys}/bus/usb/devices/ r,
@{sys}/class/ r,
@{sys}/class/drm/ r,
@{sys}/devices/pci[0-9]*/**/{busnum,config,devnum,descriptors,speed,uevent} r,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node[0-9]*/meminfo r,
owner /tmp/orcexec.* mrw,
owner /{,var/}run/user/[0-9]*/orcexec.* mrw,
# needed if /tmp is mounted noexec:
owner @{HOME}/orcexec.* mr,
# The orcexec.* file is JIT compiled code for various GStreamer elements.
# If one is blocked the next is used instead.
# The orcexec file is placed under /home/user/ also when the /tmp/ dir is mounted with the noexec
# flag.
owner @{run}/user/[0-9]*/orcexec.* mrw,
#owner /tmp/orcexec.* mrw,
#owner @{HOME}/orcexec.* mrw,
/usr/lib/frei0r-[0-9]/*.so m,
# /usr/lib/@{multiarch}/dri/** mr,
/usr/lib/@{multiarch}/gstreamer[0-9]*.[0-9]*/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner mrix,
/usr/lib/@{multiarch}/libproxy/*/modules/*.so mr,
/usr/lib/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so m,
/{usr/,}lib/frei0r-[0-9]/*.so mr,
/{usr/,}lib/@{multiarch}/gstreamer[0-9]*.[0-9]*/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner mrix,
/{usr/,}lib/@{multiarch}/libproxy/*/modules/*.so mr,
/{usr/,}lib/@{multiarch}/libproxy/*/pxgsettings ixr,
/{usr/,}lib/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*.[0-9]*/ rw,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*.[0-9]*/registry.*.bin rw,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*.[0-9]*/registry.*.bin.tmp* rw,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*/ rw,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,

15
apparmor.d/abstractions/trash
View file

@ -20,7 +20,10 @@
owner @{user_share_dirs}/Trash/files/{,**} rw,
owner @{user_share_dirs}/Trash/info/ rw,
owner @{user_share_dirs}/Trash/info/*.trashinfo{,.*} rw,
owner @{user_share_dirs}/Trash/expunged/{,**} rw,
owner @{user_share_dirs}/Trash/expunged/ rw,
owner @{user_share_dirs}/Trash/expunged/[0-9]* rw,
owner @{user_share_dirs}/Trash/expunged/[0-9]*/ rw,
owner @{user_share_dirs}/Trash/expunged/[0-9]*/** rw,
# Partitions' trash location when the admin creates the .Trash/ folder in the top lvl dir
owner /{media,mnt}/*/.Trash/ rw,
@ -30,7 +33,10 @@
owner /{media,mnt}/*/.Trash/[0-9]*/files/{,**} rw,
owner /{media,mnt}/*/.Trash/[0-9]*/info/ rw,
owner /{media,mnt}/*/.Trash/[0-9]*/info/*.trashinfo{,.*} rw,
owner /{media,mnt}/*/.Trash/[0-9]*/expunged/{,**} rw,
owner /{media,mnt}/*/.Trash/[0-9]*/expunged/ rw,
owner /{media,mnt}/*/.Trash/[0-9]*/expunged/[0-9]* rw,
owner /{media,mnt}/*/.Trash/[0-9]*/expunged/[0-9]*/ rw,
owner /{media,mnt}/*/.Trash/[0-9]*/expunged/[0-9]*/** rw,
# Partitions' trash location when the admin doesn't create the .Trash/ folder in the top lvl dir
owner /{media,mnt}/*/.Trash-[0-9]*/ rw,
@ -39,4 +45,7 @@
owner /{media,mnt}/*/.Trash-[0-9]*/files/{,**} rw,
owner /{media,mnt}/*/.Trash-[0-9]*/info/ rw,
owner /{media,mnt}/*/.Trash-[0-9]*/info/*.trashinfo{,.*} rw,
owner /{media,mnt}/*/.Trash-[0-9]*/expunged/{,**} rw,
owner /{media,mnt}/*/.Trash-[0-9]*/expunged/ rw,
owner /{media,mnt}/*/.Trash-[0-9]*/expunged/[0-9]* rw,
owner /{media,mnt}/*/.Trash-[0-9]*/expunged/[0-9]*/ rw,
owner /{media,mnt}/*/.Trash-[0-9]*/expunged/[0-9]*/** rw,