felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): use profile variable in rules such as in dbus, ptrace, unix...

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-26 01:17:14 +02:00
parent f717ea7383
commit 04b6cade64
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
72 changed files with 152 additions and 151 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/abstractions/app/sudo
View file

@ -24,8 +24,8 @@
network netlink raw, # PAM network netlink raw, # PAM
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed #aa:dbus talk bus=system name=org.freedesktop.home1 label="@{p_systemd_homed}"
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
dbus (send receive) bus=session path=/org/freedesktop/systemd1 dbus (send receive) bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd.Manager interface=org.freedesktop.systemd.Manager

2
apparmor.d/abstractions/base.d/complete
View file

@ -18,7 +18,7 @@
signal (receive) set=(term,kill) peer=openbox, signal (receive) set=(term,kill) peer=openbox,
signal (receive) set=(term,kill) peer=su, signal (receive) set=(term,kill) peer=su,
ptrace (readby) peer=systemd-coredump, ptrace (readby) peer=@{p_systemd_coredump},
@{etc_rw}/localtime r, @{etc_rw}/localtime r,
/etc/locale.conf r, /etc/locale.conf r,

2
apparmor.d/abstractions/bus/net.hadess.PowerProfiles
View file

@ -4,7 +4,7 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=net.hadess.PowerProfiles label=power-profiles-daemon #aa:dbus common bus=system name=net.hadess.PowerProfiles label="@{p_power_profiles_daemon}"
include if exists <abstractions/bus/net.hadess.PowerProfiles.d> include if exists <abstractions/bus/net.hadess.PowerProfiles.d>

6
apparmor.d/abstractions/bus/net.reactivated.Fprint
View file

@ -4,12 +4,12 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=net.reactivated.Fprint label=fprintd #aa:dbus common bus=system name=net.reactivated.Fprint label="@{p_fprintd}"
dbus send bus=system path=/net/reactivated/Fprint/Manager dbus send bus=system path=/net/reactivated/Fprint/Manager
interface=net.reactivated.Fprint.Manager interface=net.reactivated.Fprint.Manager
member={GetDevices,GetDefaultDevice} member={GetDevices,GetDefaultDevice}
peer=(name="@{busname}", label=fprintd), peer=(name="@{busname}", label="@{p_fprintd}"),
dbus send bus=system path=/net/reactivated/Fprint/Manager dbus send bus=system path=/net/reactivated/Fprint/Manager
interface=net.reactivated.Fprint.Manager interface=net.reactivated.Fprint.Manager
@ -19,7 +19,7 @@
dbus send bus=system path=/net/reactivated/Fprint/Manager dbus send bus=system path=/net/reactivated/Fprint/Manager
interface=net.reactivated.Fprint.Manager interface=net.reactivated.Fprint.Manager
member={GetDevices,GetDefaultDevice} member={GetDevices,GetDefaultDevice}
peer=(name=net.reactivated.Fprint, label=fprintd), peer=(name=net.reactivated.Fprint, label="@{p_fprintd}"),
include if exists <abstractions/bus/net.reactivated.Fprint.d> include if exists <abstractions/bus/net.reactivated.Fprint.d>

10
apparmor.d/abstractions/bus/org.a11y
View file

@ -9,27 +9,27 @@
dbus receive bus=accessibility path=/org/a11y/atspi/registry dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry interface=org.a11y.atspi.Registry
member=EventListenerDeregistered member=EventListenerDeregistered
peer=(name="@{busname}", label=at-spi2-registryd), peer=(name="@{busname}", label="@{p_at_spi2_registryd}"),
dbus send bus=accessibility path=/org/a11y/atspi/registry dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry interface=org.a11y.atspi.Registry
member=GetRegisteredEvents member=GetRegisteredEvents
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd), peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"),
dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners} member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd), peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=Set member=Set
peer=(name="@{busname}", label=at-spi2-registryd), peer=(name="@{busname}", label="@{p_at_spi2_registryd}"),
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket interface=org.a11y.atspi.Socket
member=Embed member=Embed
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd), peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"),
# Session bus # Session bus

14
apparmor.d/abstractions/bus/org.bluez
View file

@ -4,37 +4,37 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.bluez label=bluetoothd #aa:dbus common bus=system name=org.bluez label="@{p_bluetoothd}"
dbus receive bus=system path=/ dbus receive bus=system path=/
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager
member=InterfacesRemoved member=InterfacesRemoved
peer=(name="{@{busname},org.bluez}", label=bluetoothd), peer=(name="{@{busname},org.bluez}", label="@{p_bluetoothd}"),
dbus send bus=system path=/ dbus send bus=system path=/
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects member=GetManagedObjects
peer=(name="{@{busname},org.bluez}", label=bluetoothd), peer=(name="{@{busname},org.bluez}", label="@{p_bluetoothd}"),
dbus send bus=system path=/org/bluez dbus send bus=system path=/org/bluez
interface=org.bluez.AgentManager@{int} interface=org.bluez.AgentManager@{int}
member={RegisterAgent,RequestDefaultAgent,UnregisterAgent} member={RegisterAgent,RequestDefaultAgent,UnregisterAgent}
peer=(name=org.bluez, label=bluetoothd), peer=(name=org.bluez, label="@{p_bluetoothd}"),
dbus send bus=system path=/org/bluez dbus send bus=system path=/org/bluez
interface=org.bluez.ProfileManager@{int} interface=org.bluez.ProfileManager@{int}
member=RegisterProfile member=RegisterProfile
peer=(name=org.bluez, label=bluetoothd), peer=(name=org.bluez, label="@{p_bluetoothd}"),
dbus send bus=system path=/org/bluez/hci@{int} dbus send bus=system path=/org/bluez/hci@{int}
interface=org.bluez.BatteryProviderManager@{int} interface=org.bluez.BatteryProviderManager@{int}
member=RegisterProfile member=RegisterProfile
peer=(name=org.bluez, label=bluetoothd), peer=(name=org.bluez, label="@{p_bluetoothd}"),
dbus send bus=system path=/org/bluez/hci@{int} dbus send bus=system path=/org/bluez/hci@{int}
interface=org.bluez.Media@{int} interface=org.bluez.Media@{int}
member=RegisterApplication member=RegisterApplication
peer=(name=org.bluez, label=bluetoothd), peer=(name=org.bluez, label="@{p_bluetoothd}"),
include if exists <abstractions/bus/org.bluez.d> include if exists <abstractions/bus/org.bluez.d>

10
apparmor.d/abstractions/bus/org.freedesktop.Accounts
View file

@ -4,27 +4,27 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.Accounts label=accounts-daemon #aa:dbus common bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
dbus send bus=system path=/org/freedesktop/Accounts dbus send bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts interface=org.freedesktop.Accounts
member={FindUserByName,ListCachedUsers} member={FindUserByName,ListCachedUsers}
peer=(name="@{busname}", label=accounts-daemon), peer=(name="@{busname}", label="@{p_accounts_daemon}"),
dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid} dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User interface=org.freedesktop.Accounts.User
member=*Changed member=*Changed
peer=(name="@{busname}", label=accounts-daemon), peer=(name="@{busname}", label="@{p_accounts_daemon}"),
dbus receive bus=system path=/org/freedesktop/Accounts dbus receive bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts interface=org.freedesktop.Accounts
member=UserAdded member=UserAdded
peer=(name="@{busname}", label=accounts-daemon), peer=(name="@{busname}", label="@{p_accounts_daemon}"),
dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid} dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=*Changed member=*Changed
peer=(name="@{busname}", label=accounts-daemon), peer=(name="@{busname}", label="@{p_accounts_daemon}"),
include if exists <abstractions/bus/org.freedesktop.Accounts.d> include if exists <abstractions/bus/org.freedesktop.Accounts.d>

10
apparmor.d/abstractions/bus/org.freedesktop.Avahi
View file

@ -4,27 +4,27 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.Avahi label=avahi-daemon #aa:dbus common bus=system name=org.freedesktop.Avahi label="@{p_avahi_daemon}"
dbus send bus=system path=/ dbus send bus=system path=/
interface=org.freedesktop.DBus.Peer interface=org.freedesktop.DBus.Peer
member=Ping member=Ping
peer=(name=org.freedesktop.Avahi, label=avahi-daemon), peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
dbus send bus=system path=/ dbus send bus=system path=/
interface=org.freedesktop.Avahi.Server interface=org.freedesktop.Avahi.Server
member={GetAPIVersion,GetState,Service*New} member={GetAPIVersion,GetState,Service*New}
peer=(name=org.freedesktop.Avahi, label=avahi-daemon), peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
dbus send bus=system path=/Client@{int}/ServiceBrowser@{int} dbus send bus=system path=/Client@{int}/ServiceBrowser@{int}
interface=org.freedesktop.Avahi.ServiceBrowser interface=org.freedesktop.Avahi.ServiceBrowser
member=Free member=Free
peer=(name=org.freedesktop.Avahi, label=avahi-daemon), peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int}
interface=org.freedesktop.Avahi.ServiceBrowser interface=org.freedesktop.Avahi.ServiceBrowser
member={ItemNew,AllForNow,CacheExhausted} member={ItemNew,AllForNow,CacheExhausted}
peer=(name="@{busname}", label=avahi-daemon), peer=(name="@{busname}", label="@{p_avahi_daemon}"),
include if exists <abstractions/bus/org.freedesktop.Avahi.d> include if exists <abstractions/bus/org.freedesktop.Avahi.d>

8
apparmor.d/abstractions/bus/org.freedesktop.ColorManager
View file

@ -4,22 +4,22 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.ColorManager label=colord #aa:dbus common bus=system name=org.freedesktop.ColorManager label="@{p_colord}"
dbus send bus=system path=/org/freedesktop/ColorManager dbus send bus=system path=/org/freedesktop/ColorManager
interface=org.freedesktop.ColorManager interface=org.freedesktop.ColorManager
member=GetDevices member=GetDevices
peer=(name="@{busname}", label=colord), peer=(name="@{busname}", label="@{p_colord}"),
dbus send bus=system path=/org/freedesktop/ColorManager dbus send bus=system path=/org/freedesktop/ColorManager
interface=org.freedesktop.ColorManager interface=org.freedesktop.ColorManager
member=CreateDevice member=CreateDevice
peer=(name="@{busname}", label=colord), peer=(name="@{busname}", label="@{p_colord}"),
dbus receive bus=system path=/org/freedesktop/ColorManager dbus receive bus=system path=/org/freedesktop/ColorManager
interface=org.freedesktop.ColorManager interface=org.freedesktop.ColorManager
member={DeviceAdded,DeviceRemoved} member={DeviceAdded,DeviceRemoved}
peer=(name="@{busname}", label=colord), peer=(name="@{busname}", label="@{p_colord}"),
include if exists <abstractions/bus/org.freedesktop.ColorManager.d> include if exists <abstractions/bus/org.freedesktop.ColorManager.d>

10
apparmor.d/abstractions/bus/org.freedesktop.GeoClue2
View file

@ -4,26 +4,26 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.GeoClue2 label=geoclue #aa:dbus common bus=system name=org.freedesktop.GeoClue2 label="@{p_geoclue}"
dbus send bus=system path=/org/freedesktop/GeoClue2/Agent dbus send bus=system path=/org/freedesktop/GeoClue2/Agent
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=PropertiesChanged member=PropertiesChanged
peer=(name=org.freedesktop.DBus, label=geoclue), peer=(name=org.freedesktop.DBus, label="@{p_geoclue}"),
dbus receive bus=system path=/org/freedesktop/GeoClue2/Agent dbus receive bus=system path=/org/freedesktop/GeoClue2/Agent
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=GetAll member=GetAll
peer=(name="@{busname}", label=geoclue), peer=(name="@{busname}", label="@{p_geoclue}"),
dbus send bus=system path=/org/freedesktop/GeoClue2/Manager dbus send bus=system path=/org/freedesktop/GeoClue2/Manager
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=GetAll member=GetAll
peer=(name="@{busname}", label=geoclue), peer=(name="@{busname}", label="@{p_geoclue}"),
dbus send bus=system path=/org/freedesktop/GeoClue2/Manager dbus send bus=system path=/org/freedesktop/GeoClue2/Manager
interface=org.freedesktop.GeoClue2.Manager interface=org.freedesktop.GeoClue2.Manager
member=AddAgent member=AddAgent
peer=(name="@{busname}", label=geoclue), peer=(name="@{busname}", label="@{p_geoclue}"),
include if exists <abstractions/bus/org.freedesktop.GeoClue2.d> include if exists <abstractions/bus/org.freedesktop.GeoClue2.d>

6
apparmor.d/abstractions/bus/org.freedesktop.ModemManager1
View file

@ -4,17 +4,17 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.ModemManager1 label=ModemManager #aa:dbus common bus=system name=org.freedesktop.ModemManager1 label="@{p_ModemManager}"
dbus send bus=system path=/org/freedesktop/ModemManager1 dbus send bus=system path=/org/freedesktop/ModemManager1
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects member=GetManagedObjects
peer=(name=org.freedesktop.ModemManager1, label=ModemManager), peer=(name=org.freedesktop.ModemManager1, label="@{p_ModemManager}"),
dbus send bus=system path=/org/freedesktop/ModemManager1 dbus send bus=system path=/org/freedesktop/ModemManager1
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects member=GetManagedObjects
peer=(name="@{busname}", label=ModemManager), peer=(name="@{busname}", label="@{p_ModemManager}"),
include if exists <abstractions/bus/org.freedesktop.ModemManager1.d> include if exists <abstractions/bus/org.freedesktop.ModemManager1.d>

8
apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1
View file

@ -4,22 +4,22 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.PolicyKit1 label=polkitd #aa:dbus common bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}"
dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority interface=org.freedesktop.PolicyKit1.Authority
member=Changed member=Changed
peer=(name="@{busname}", label=polkitd), peer=(name="@{busname}", label="@{p_polkitd}"),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization member=CheckAuthorization
peer=(name=org.freedesktop.PolicyKit1, label=polkitd), peer=(name=org.freedesktop.PolicyKit1, label="@{p_polkitd}"),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization member=CheckAuthorization
peer=(name="@{busname}", label=polkitd), peer=(name="@{busname}", label="@{p_polkitd}"),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority interface=org.freedesktop.PolicyKit1.Authority
member=CheckAuthorization member=CheckAuthorization

6
apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1
View file

@ -6,7 +6,7 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.RealtimeKit1 label=rtkit-daemon #aa:dbus common bus=system name=org.freedesktop.RealtimeKit1 label="@{p_rtkit_daemon}"
dbus send bus=system path=/org/freedesktop/RealtimeKit1 dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=Get member=Get
@ -15,12 +15,12 @@
dbus send bus=system path=/org/freedesktop/RealtimeKit1 dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1 interface=org.freedesktop.RealtimeKit1
member={MakeThreadHighPriority,MakeThreadRealtime} member={MakeThreadHighPriority,MakeThreadRealtime}
peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label=rtkit-daemon), peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label="@{p_rtkit_daemon}"),
dbus send bus=system path=/org/freedesktop/RealtimeKit1 dbus send bus=system path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1 interface=org.freedesktop.RealtimeKit1
member={MakeThreadHighPriorityWithPID,MakeThreadRealtimeWithPID} member={MakeThreadHighPriorityWithPID,MakeThreadRealtimeWithPID}
peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label=rtkit-daemon), peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label="@{p_rtkit_daemon}"),
include if exists <abstractions/bus/org.freedesktop.RealtimeKit1.d> include if exists <abstractions/bus/org.freedesktop.RealtimeKit1.d>

8
apparmor.d/abstractions/bus/org.freedesktop.UPower
View file

@ -4,22 +4,22 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.UPower label=upowerd #aa:dbus common bus=system name=org.freedesktop.UPower label="@{p_upowerd}"
dbus send bus=system path=/org/freedesktop/UPower dbus send bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.UPower interface=org.freedesktop.UPower
member=EnumerateDevices member=EnumerateDevices
peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), peer=(name="{@{busname},org.freedesktop.UPower}", label="@{p_upowerd}"),
dbus send bus=system path=/org/freedesktop/UPower dbus send bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=GetDisplayDevice member=GetDisplayDevice
peer=(name=org.freedesktop.UPower, label=upowerd), peer=(name=org.freedesktop.UPower, label="@{p_upowerd}"),
dbus receive bus=system path=/org/freedesktop/UPower dbus receive bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.UPower interface=org.freedesktop.UPower
member=DeviceAdded member=DeviceAdded
peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), peer=(name="{@{busname},org.freedesktop.UPower}", label="@{p_upowerd}"),
include if exists <abstractions/bus/org.freedesktop.UPower.d> include if exists <abstractions/bus/org.freedesktop.UPower.d>

2
apparmor.d/abstractions/bus/org.freedesktop.UPower.PowerProfiles
View file

@ -4,7 +4,7 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.UPower.PowerProfiles label=power-profiles-daemon #aa:dbus common bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon}
include if exists <abstractions/bus/org.freedesktop.UPower.PowerProfiles.d> include if exists <abstractions/bus/org.freedesktop.UPower.PowerProfiles.d>

2
apparmor.d/abstractions/bus/org.freedesktop.hostname1
View file

@ -4,7 +4,7 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed #aa:dbus common bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}"
dbus send bus=system path=/org/freedesktop/hostname1 dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=Get member=Get

2
apparmor.d/abstractions/bus/org.freedesktop.locale1
View file

@ -4,7 +4,7 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.locale1 label=systemd-localed #aa:dbus common bus=system name=org.freedesktop.locale1 label="@{p_systemd_localed}"
dbus send bus=system path=/org/freedesktop/locale1 dbus send bus=system path=/org/freedesktop/locale1
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=GetAll member=GetAll

8
apparmor.d/abstractions/bus/org.freedesktop.login1
View file

@ -4,22 +4,22 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus common bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member={Inhibit,CanHibernate,CanHybridSleep,CanPowerOff,CanReboot,CanSuspend,CreateSession,GetSessionByPID} member={Inhibit,CanHibernate,CanHybridSleep,CanPowerOff,CanReboot,CanSuspend,CreateSession,GetSessionByPID}
peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"),
dbus receive bus=system path=/org/freedesktop/login1 dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member={SessionNew,SessionRemoved,UserNew,UserRemoved,SeatNew,PrepareFor*} member={SessionNew,SessionRemoved,UserNew,UserRemoved,SeatNew,PrepareFor*}
peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"),
dbus send bus=system path=/org/freedesktop/login1/session/* dbus send bus=system path=/org/freedesktop/login1/session/*
interface=org.freedesktop.login1.Session interface=org.freedesktop.login1.Session
member=PauseDeviceComplete member=PauseDeviceComplete
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
include if exists <abstractions/bus/org.freedesktop.login1.d> include if exists <abstractions/bus/org.freedesktop.login1.d>

8
apparmor.d/abstractions/bus/org.freedesktop.login1.Session
View file

@ -4,22 +4,22 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus common bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member=GetSession member=GetSession
peer=(name="@{busname}", label=systemd-logind), peer=(name="@{busname}", label="@{p_systemd_logind}"),
dbus send bus=system path=/org/freedesktop/login1/session/* dbus send bus=system path=/org/freedesktop/login1/session/*
interface=org.freedesktop.login1.Session interface=org.freedesktop.login1.Session
member={ReleaseDevice,TakeControl,TakeDevice,SetBrightness,SetLockedHint,SetIdleHint} member={ReleaseDevice,TakeControl,TakeDevice,SetBrightness,SetLockedHint,SetIdleHint}
peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"),
dbus receive bus=system path=/org/freedesktop/login1/session/* dbus receive bus=system path=/org/freedesktop/login1/session/*
interface=org.freedesktop.login1.Session interface=org.freedesktop.login1.Session
member={PauseDevice,Unlock} member={PauseDevice,Unlock}
peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"),
include if exists <abstractions/bus/org.freedesktop.login1.Session.d> include if exists <abstractions/bus/org.freedesktop.login1.Session.d>

2
apparmor.d/abstractions/bus/org.freedesktop.network1
View file

@ -4,7 +4,7 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.network1 label=systemd-networkd #aa:dbus common bus=system name=org.freedesktop.network1 label="@{p_systemd_networkd}"
include if exists <abstractions/bus/org.freedesktop.network1.d> include if exists <abstractions/bus/org.freedesktop.network1.d>

4
apparmor.d/abstractions/bus/org.freedesktop.resolve1
View file

@ -4,12 +4,12 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.resolve1 label=systemd-resolved #aa:dbus common bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}"
dbus send bus=system path=/org/freedesktop/resolve1 dbus send bus=system path=/org/freedesktop/resolve1
interface=org.freedesktop.resolve1.Manager interface=org.freedesktop.resolve1.Manager
member={SetLink*,ResolveHostname} member={SetLink*,ResolveHostname}
peer=(name="{@{busname},org.freedesktop.resolve1}", label=systemd-resolved), peer=(name="{@{busname},org.freedesktop.resolve1}", label="@{p_systemd_resolved}"),
include if exists <abstractions/bus/org.freedesktop.resolve1.d> include if exists <abstractions/bus/org.freedesktop.resolve1.d>

2
apparmor.d/abstractions/bus/org.freedesktop.timedate1
View file

@ -4,7 +4,7 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=system name=org.freedesktop.timedate1 label=systemd-timedated #aa:dbus common bus=system name=org.freedesktop.timedate1 label="@{p_systemd_timedated}"
include if exists <abstractions/bus/org.freedesktop.timedate1.d> include if exists <abstractions/bus/org.freedesktop.timedate1.d>

4
apparmor.d/abstractions/bus/org.gnome.ArchiveManager1
View file

@ -4,12 +4,12 @@
abi <abi/4.0>, abi <abi/4.0>,
#aa:dbus common bus=session name=org.gnome.ArchiveManager1 label=file-roller #aa:dbus common bus=session name=org.gnome.ArchiveManager1 label="@{p_file_roller}"
dbus send bus=session path=/org/gnome/ArchiveManager1 dbus send bus=session path=/org/gnome/ArchiveManager1
interface=org.gnome.ArchiveManager1 interface=org.gnome.ArchiveManager1
member=GetSupportedTypes member=GetSupportedTypes
peer=(name="@{busname}", label=file-roller), peer=(name="@{busname}", label="@{p_file_roller}"),
include if exists <abstractions/bus/org.gnome.ArchiveManager1.d> include if exists <abstractions/bus/org.gnome.ArchiveManager1.d>

2
apparmor.d/abstractions/mapping/login
View file

@ -25,7 +25,7 @@
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member=ReleaseSession member=ReleaseSession
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
@{etc_ro}/security/group.conf r, @{etc_ro}/security/group.conf r,
@{etc_ro}/security/limits.conf r, @{etc_ro}/security/limits.conf r,

4
apparmor.d/abstractions/mapping/sshd
View file

@ -28,7 +28,7 @@
network inet6 stream, network inet6 stream,
network netlink raw, network netlink raw,
signal receive set=exists peer=systemd-journald, signal receive set=exists peer=@{p_systemd_journald},
signal receive set=hup peer=@{p_systemd}, signal receive set=hup peer=@{p_systemd},
unix bind type=stream addr=@@{udbus}/bus/sshd/system, unix bind type=stream addr=@@{udbus}/bus/sshd/system,
@ -36,7 +36,7 @@
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} member={CreateSession,ReleaseSession,CreateSessionWithPIDFD}
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
/etc/motd r, /etc/motd r,
/etc/locale.conf r, /etc/locale.conf r,

2
apparmor.d/groups/avahi/avahi-browse
View file

@ -17,7 +17,7 @@ profile avahi-browse @{exec_path} {
dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int} dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int}
interface=org.freedesktop.Avahi.ServiceTypeBrowser interface=org.freedesktop.Avahi.ServiceTypeBrowser
member={ItemNew,AllForNow,CacheExhausted} member={ItemNew,AllForNow,CacheExhausted}
peer=(name=:*, label=avahi-daemon), peer=(name=:*, label="@{p_avahi_daemon}"),
@{exec_path} mr, @{exec_path} mr,

4
apparmor.d/groups/avahi/avahi-resolve
View file

@ -17,12 +17,12 @@ profile avahi-resolve @{exec_path} {
dbus send bus=system path=/Client@{int}/AddressResolver@{int} dbus send bus=system path=/Client@{int}/AddressResolver@{int}
interface=org.freedesktop.Avahi.AddressResolver interface=org.freedesktop.Avahi.AddressResolver
member={Free,HostNameResolverNew} member={Free,HostNameResolverNew}
peer=(name=:*, label=avahi-daemon), peer=(name=:*, label="@{p_avahi_daemon}"),
dbus receive bus=system path=/Client@{int}/AddressResolver@{int} dbus receive bus=system path=/Client@{int}/AddressResolver@{int}
interface=org.freedesktop.Avahi.AddressResolver interface=org.freedesktop.Avahi.AddressResolver
member={Failure,Found} member={Failure,Found}
peer=(name=:*, label=avahi-daemon), peer=(name=:*, label="@{p_avahi_daemon}"),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/bluetooth/bluetoothctl
View file

@ -15,7 +15,7 @@ profile bluetoothctl @{exec_path} {
network bluetooth raw, network bluetooth raw,
#aa:dbus talk bus=system name=org.bluez label=bluetoothd #aa:dbus talk bus=system name=org.bluez label="@{p_bluetoothd}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/bluetooth/obexd
View file

@ -22,7 +22,7 @@ profile obexd @{exec_path} {
dbus receive bus=system path=/org/bluez/obex/@{uuid} dbus receive bus=system path=/org/bluez/obex/@{uuid}
interface=org.bluez.Profile1 interface=org.bluez.Profile1
member=Release member=Release
peer=(name=:*, label=bluetoothd), peer=(name=:*, label="@{p_bluetoothd}"),
@{exec_path} mr, @{exec_path} mr,

1
apparmor.d/groups/bus/ibus-dconf
View file

@ -15,6 +15,7 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) {
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
signal receive set=kill peer=@{p_systemd_user},
signal receive set=term peer=ibus-daemon, signal receive set=term peer=ibus-daemon,
dbus receive bus=session dbus receive bus=session

2
apparmor.d/groups/cups/cups-browsed
View file

@ -29,7 +29,7 @@ profile cups-browsed @{exec_path} {
dbus receive bus=system path=/ dbus receive bus=system path=/
interface=org.freedesktop.Avahi.Server interface=org.freedesktop.Avahi.Server
member=StateChanged member=StateChanged
peer=(name=:*, label=avahi-daemon), peer=(name=:*, label="@{p_avahi_daemon}"),
dbus receive bus=system path=/org/freedesktop/NetworkManager dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager interface=org.freedesktop.NetworkManager

4
apparmor.d/groups/filesystem/udisksd
View file

@ -65,8 +65,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
signal receive set=int peer=@{p_systemd}, signal receive set=int peer=@{p_systemd},
#aa:dbus own bus=system name=org.freedesktop.UDisks2 #aa:dbus own bus=system name=org.freedesktop.UDisks2
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
#aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}"
@{exec_path} mr, @{exec_path} mr,

4
apparmor.d/groups/flatpak/flatpak
View file

@ -41,8 +41,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
signal send peer=flatpak-app, signal send peer=flatpak-app,
#aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper #aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
#aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}"
dbus send bus=session path=/org/freedesktop/portal/documents dbus send bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.portal.Documents interface=org.freedesktop.portal.Documents

6
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -50,12 +50,12 @@ profile pulseaudio @{exec_path} {
dbus receive bus=system path=/Client@{int}/ServiceResolver@{int} dbus receive bus=system path=/Client@{int}/ServiceResolver@{int}
interface=org.freedesktop.Avahi.ServiceResolver interface=org.freedesktop.Avahi.ServiceResolver
member=Found member=Found
peer=(name=:*, label=avahi-daemon), peer=(name=:*, label="@{p_avahi_daemon}"),
dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int}
interface=org.freedesktop.Avahi.ServiceBrowser interface=org.freedesktop.Avahi.ServiceBrowser
member=ItemRemove member=ItemRemove
peer=(name=:*, label=avahi-daemon), peer=(name=:*, label="@{p_avahi_daemon}"),
dbus send bus=system path=/ dbus send bus=system path=/
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager
@ -65,7 +65,7 @@ profile pulseaudio @{exec_path} {
dbus send bus=system path=/Client@{int}/ServiceResolver@{int} dbus send bus=system path=/Client@{int}/ServiceResolver@{int}
interface=org.freedesktop.Avahi.ServiceResolver interface=org.freedesktop.Avahi.ServiceResolver
member={Found,Free} member={Found,Free}
peer=(name=org.freedesktop.Avahi, label=avahi-daemon), peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
@{exec_path} mrix, @{exec_path} mrix,

2
apparmor.d/groups/freedesktop/upower
View file

@ -13,7 +13,7 @@ profile upower @{exec_path} {
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/consoles> include <abstractions/consoles>
#aa:dbus own bus=system name=org.freedesktop.UPower label=upowerd #aa:dbus own bus=system name=org.freedesktop.UPower label="@{p_upowerd}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/freedesktop/xorg
View file

@ -48,7 +48,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/login1/session/* dbus send bus=system path=/org/freedesktop/login1/session/*
interface=org.freedesktop.login1.Session interface=org.freedesktop.login1.Session
member=ReleaseControl member=ReleaseControl
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
@{exec_path} mrix, @{exec_path} mrix,

4
apparmor.d/groups/gnome/gdm
View file

@ -34,8 +34,8 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=system name=org.gnome.DisplayManager #aa:dbus own bus=system name=org.gnome.DisplayManager
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
@{exec_path} mr, @{exec_path} mr,

6
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -49,13 +49,13 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
unix bind type=stream addr=@@{udbus}/bus/gdm-session-wor/system, unix bind type=stream addr=@@{udbus}/bus/gdm-session-wor/system,
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
#aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label=systemd-homed #aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label="@{p_systemd_homed}"
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member={*Session,CreateSessionWithPIDFD} member={*Session,CreateSessionWithPIDFD}
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
@{exec_path} mrix, @{exec_path} mrix,

2
apparmor.d/groups/gnome/gnome-calendar
View file

@ -32,7 +32,7 @@ profile gnome-calendar @{exec_path} {
#aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Sources@{int} label=evolution-source-registry #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Sources@{int} label=evolution-source-registry
#aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon #aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon
#aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color
#aa:dbus talk bus=system name=org.freedesktop.GeoClue2 label=geoclue #aa:dbus talk bus=system name=org.freedesktop.GeoClue2 label="@{p_geoclue}"
dbus send bus=session path=/org/gnome/evolution/dataserver/SourceManager{,/**} dbus send bus=session path=/org/gnome/evolution/dataserver/SourceManager{,/**}
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager

16
apparmor.d/groups/gnome/gnome-control-center
View file

@ -45,18 +45,18 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
#aa:dbus talk bus=system name=com.ubuntu.WhoopsiePreferences label=whoopsie-preferences #aa:dbus talk bus=system name=com.ubuntu.WhoopsiePreferences label=whoopsie-preferences
#aa:dbus talk bus=system name=net.hadess.SwitcherooControl label=switcheroo-control #aa:dbus talk bus=system name=net.hadess.SwitcherooControl label=switcheroo-control
#aa:dbus talk bus=system name=net.reactivated.Fprint.Manager label=fprintd #aa:dbus talk bus=system name=net.reactivated.Fprint.Manager label="@{p_fprintd}"
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
#aa:dbus talk bus=system name=org.freedesktop.bolt1 label=boltd #aa:dbus talk bus=system name=org.freedesktop.bolt1 label=boltd
#aa:dbus talk bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed #aa:dbus talk bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}"
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
#aa:dbus talk bus=system name=org.freedesktop.ModemManager1 label=ModemManager #aa:dbus talk bus=system name=org.freedesktop.ModemManager1 label="@{p_ModemManager}"
#aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager
#aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}"
#aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" #aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}"
#aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd
#aa:dbus talk bus=system name=org.freedesktop.UPower label=upowerd #aa:dbus talk bus=system name=org.freedesktop.UPower label="@{p_upowerd}"
#aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=power-profiles-daemon #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon}
@{exec_path} mr, @{exec_path} mr,

4
apparmor.d/groups/gnome/gnome-firmware
View file

@ -20,8 +20,8 @@ profile gnome-firmware @{exec_path} {
network inet6 stream, network inet6 stream,
network netlink raw, network netlink raw,
#aa:dbus talk bus=system name=org.freedesktop.fwupd label=fwupd path=/ #aa:dbus talk bus=system name=org.freedesktop.fwupd label="@{p_fwupd}" path=/
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
@{exec_path} mr, @{exec_path} mr,
@{open_path} rPx -> child-open-help, @{open_path} rPx -> child-open-help,

2
apparmor.d/groups/gnome/gnome-keyring-daemon
View file

@ -33,7 +33,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member=GetSession member=GetSession
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -32,7 +32,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term) peer=gsd-*, signal (send) set=(term) peer=gsd-*,
#aa:dbus own bus=session name=org.gnome.SessionManager #aa:dbus own bus=session name=org.gnome.SessionManager
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
dbus send bus=session path=/org/freedesktop/DBus dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus interface=org.freedesktop.DBus

12
apparmor.d/groups/gnome/gnome-shell
View file

@ -83,11 +83,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
# Talk with gnome-shell # Talk with gnome-shell
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
#aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd
#aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord #aa:dbus talk bus=system name=org.freedesktop.ColorManager label="@{p_colord}"
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
#aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=power-profiles-daemon #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon}
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm #aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
#aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding #aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding
@ -103,11 +103,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority interface=org.freedesktop.PolicyKit1.Authority
member=RegisterAuthenticationAgent member=RegisterAuthenticationAgent
peer=(name=:*, label=polkitd), peer=(name=:*, label="@{p_polkitd}"),
dbus receive bus=system path=/org/freedesktop/PolicyKit1/AuthenticationAgent dbus receive bus=system path=/org/freedesktop/PolicyKit1/AuthenticationAgent
interface=org.freedesktop.PolicyKit1.AuthenticationAgent interface=org.freedesktop.PolicyKit1.AuthenticationAgent
member=BeginAuthentication member=BeginAuthentication
peer=(name=:*, label=polkitd), peer=(name=:*, label="@{p_polkitd}"),
dbus send bus=system path=/org/freedesktop/NetworkManager/AgentManager dbus send bus=system path=/org/freedesktop/NetworkManager/AgentManager
interface=org.freedesktop.NetworkManager.AgentManager interface=org.freedesktop.NetworkManager.AgentManager

2
apparmor.d/groups/gnome/gsd-color
View file

@ -28,7 +28,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=session name=org.gnome.SettingsDaemon.Color #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Color
#aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord #aa:dbus talk bus=system name=org.freedesktop.ColorManager label="@{p_colord}"
dbus receive bus=session path=/org/gtk/Settings dbus receive bus=session path=/org/gtk/Settings
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties

8
apparmor.d/groups/gnome/gsd-housekeeping
View file

@ -24,10 +24,10 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=session name=org.gnome.SettingsDaemon.Housekeeping #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Housekeeping
dbus receive bus=session dbus send bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.DBus.Introspectable interface=org.freedesktop.systemd1.Manager
member=Introspect member=Subscribe
peer=(name=:*, label=gnome-shell), peer=(name=org.freedesktop.systemd1),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -38,7 +38,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member=PowerOff member=PowerOff
peer=(name=:*, label=systemd-logind), peer=(name=:*, label="@{p_systemd_logind}"),
dbus send bus=session path=/ dbus send bus=session path=/
interface=org.freedesktop.DBus interface=org.freedesktop.DBus

2
apparmor.d/groups/gnome/gsd-power
View file

@ -43,7 +43,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/UPower/KbdBacklight dbus send bus=system path=/org/freedesktop/UPower/KbdBacklight
interface=org.freedesktop.UPower.KbdBacklight interface=org.freedesktop.UPower.KbdBacklight
member=GetBrightness member=GetBrightness
peer=(name=:*, label=upowerd), peer=(name=:*, label="@{p_upowerd}"),
dbus receive bus=session path=/org/gtk/Settings dbus receive bus=session path=/org/gtk/Settings
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties

7
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -36,12 +36,7 @@ profile gsd-xsettings @{exec_path} {
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid} dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User interface=org.freedesktop.Accounts.User
member=SetInputSources member=SetInputSources
peer=(name=:*, label=accounts-daemon), peer=(name=:*, label="@{p_accounts_daemon}"),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetId
peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
@{exec_path} mr, @{exec_path} mr,

5
apparmor.d/groups/gnome/loupe
View file

@ -21,6 +21,11 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
#aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=@{busname}, label=@{p_systemd_hostnamed}),
@{exec_path} mr, @{exec_path} mr,
@{bin}/bwrap rCx -> bwrap, @{bin}/bwrap rCx -> bwrap,

2
apparmor.d/groups/kde/sddm
View file

@ -58,7 +58,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
dbus receive bus=system path=/org/freedesktop/DisplayManager/Seat@{int} dbus receive bus=system path=/org/freedesktop/DisplayManager/Seat@{int}
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=PropertiesChanged member=PropertiesChanged
peer=(name=:*, label=systemd-logind), peer=(name=:*, label="@{p_systemd_logind}"),
dbus send bus=system path=/org/freedesktop/DisplayManager/Seat@{int} dbus send bus=system path=/org/freedesktop/DisplayManager/Seat@{int}
interface=org.freedesktop.DBus.Introspectable interface=org.freedesktop.DBus.Introspectable

6
apparmor.d/groups/network/NetworkManager
View file

@ -46,7 +46,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
#aa:dbus talk bus=system name=fi.w1.wpa_supplicant1 label=wpa-supplicant #aa:dbus talk bus=system name=fi.w1.wpa_supplicant1 label=wpa-supplicant
#aa:dbus talk bus=system name=org.fedoraproject.FirewallD1 label=firewalld #aa:dbus talk bus=system name=org.fedoraproject.FirewallD1 label=firewalld
#aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher #aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher
#aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}"
dbus send bus=system path=/org/freedesktop/nm_dispatcher dbus send bus=system path=/org/freedesktop/nm_dispatcher
interface=org.freedesktop.nm_dispatcher interface=org.freedesktop.nm_dispatcher
@ -60,12 +60,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/ dbus receive bus=system path=/
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager
member=InterfacesRemoved member=InterfacesRemoved
peer=(name=:*, label=bluetoothd), peer=(name=:*, label="@{p_bluetoothd}"),
dbus send bus=system path=/ dbus send bus=system path=/
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects member=GetManagedObjects
peer=(name=:*, label=bluetoothd), peer=(name=:*, label="@{p_bluetoothd}"),
dbus send bus=system path=/org/freedesktop dbus send bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager interface=org.freedesktop.DBus.ObjectManager

2
apparmor.d/groups/network/networkd-dispatcher
View file

@ -16,7 +16,7 @@ profile networkd-dispatcher @{exec_path} {
dbus receive bus=system path=/org/freedesktop/network1{,/link/*} dbus receive bus=system path=/org/freedesktop/network1{,/link/*}
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=PropertiesChanged member=PropertiesChanged
peer=(name=:*, label=systemd-networkd), peer=(name=:*, label="@{p_systemd_networkd}"),
@{exec_path} mr, @{exec_path} mr,

4
apparmor.d/groups/polkit/polkit-agent-helper
View file

@ -35,12 +35,12 @@ profile polkit-agent-helper @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=GetAll member=GetAll
peer=(name=:*, label=polkitd), peer=(name=:*, label="@{p_polkitd}"),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority interface=org.freedesktop.PolicyKit1.Authority
member=AuthenticationAgentResponse2 member=AuthenticationAgentResponse2
peer=(name=:*, label=polkitd), peer=(name=:*, label="@{p_polkitd}"),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/snap/snapd
View file

@ -55,7 +55,7 @@ profile snapd @{exec_path} {
dbus send bus=system path=/org/freedesktop/ dbus send bus=system path=/org/freedesktop/
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member={SetWallMessage,ScheduleShutdown} member={SetWallMessage,ScheduleShutdown}
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
dbus send bus=system path=/org/freedesktop/timedate1 dbus send bus=system path=/org/freedesktop/timedate1
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties

2
apparmor.d/groups/ssh/sshd
View file

@ -56,7 +56,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/login1 dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager interface=org.freedesktop.login1.Manager
member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} member={CreateSession,ReleaseSession,CreateSessionWithPIDFD}
peer=(name=org.freedesktop.login1, label=systemd-logind), peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"),
@{exec_path} mrix, @{exec_path} mrix,

2
apparmor.d/groups/systemd/homectl
View file

@ -19,7 +19,7 @@ profile homectl @{exec_path} {
signal send peer=child-pager, signal send peer=child-pager,
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed #aa:dbus talk bus=system name=org.freedesktop.home1 label="@{p_systemd_homed}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/systemd/hostnamectl
View file

@ -15,7 +15,7 @@ profile hostnamectl @{exec_path} {
capability net_admin, capability net_admin,
#aa:dbus talk bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed #aa:dbus talk bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}"
dbus send bus=system path=/org/freedesktop/hostname1 dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=GetAll member=GetAll

2
apparmor.d/groups/systemd/localectl
View file

@ -16,7 +16,7 @@ profile localectl @{exec_path} {
signal send set=cont peer=child-pager, signal send set=cont peer=child-pager,
#aa:dbus talk bus=system name=org.freedesktop.locale1 label=systemd-localed #aa:dbus talk bus=system name=org.freedesktop.locale1 label="@{p_systemd_localed}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/systemd/loginctl
View file

@ -20,7 +20,7 @@ profile loginctl @{exec_path} flags=(attach_disconnected) {
signal send set=cont peer=child-pager, signal send set=cont peer=child-pager,
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/systemd/networkctl
View file

@ -26,7 +26,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) {
unix (bind) type=stream addr=@@{udbus}/bus/networkctl/system, unix (bind) type=stream addr=@@{udbus}/bus/networkctl/system,
#aa:dbus talk bus=system name=org.freedesktop.network1 label=systemd-networkd #aa:dbus talk bus=system name=org.freedesktop.network1 label="@{p_systemd_networkd}"
dbus send bus=system path=/org/freedesktop/network1{,/**} dbus send bus=system path=/org/freedesktop/network1{,/**}
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties
member=Get member=Get

2
apparmor.d/groups/systemd/resolvectl
View file

@ -15,7 +15,7 @@ profile resolvectl @{exec_path} {
signal send set=cont peer=child-pager, signal send set=cont peer=child-pager,
#aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/systemd/systemd-inhibit
View file

@ -14,7 +14,7 @@ profile systemd-inhibit @{exec_path} flags=(attach_disconnected) {
capability net_admin, capability net_admin,
capability sys_resource, capability sys_resource,
signal receive set=term peer=packagekitd, signal receive set=term peer=@{p_packagekitd},
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/systemd/systemd-networkd
View file

@ -42,7 +42,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/hostname1 dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.hostname1 interface=org.freedesktop.hostname1
member=SetHostname member=SetHostname
peer=(name=org.freedesktop.hostname1, label=systemd-hostnamed), peer=(name=org.freedesktop.hostname1, label="@{p_systemd_hostnamed}"),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -22,7 +22,7 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
network inet6 stream, network inet6 stream,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-timesyn/bus-api-timesync, unix (bind) type=stream addr=@@{udbus}/bus/systemd-timesyn/bus-api-timesync,
unix (send, receive) type=dgram addr=none peer=(label=@{p_systemd}, addr=none), unix (send, receive) type=dgram addr=none peer=(label=@{p_sd}, addr=none),
#aa:dbus own bus=system name=org.freedesktop.timesync1 #aa:dbus own bus=system name=org.freedesktop.timesync1

2
apparmor.d/groups/systemd/systemd-tty-ask-password-agent
View file

@ -20,7 +20,7 @@ profile systemd-tty-ask-password-agent @{exec_path} {
signal receive set=(term cont winch) peer=*//systemctl, signal receive set=(term cont winch) peer=*//systemctl,
signal receive set=(term cont winch) peer=deb-systemd-invoke, signal receive set=(term cont winch) peer=deb-systemd-invoke,
signal receive set=(term cont winch) peer=default, signal receive set=(term cont winch) peer=default,
signal receive set=(term cont winch) peer=logrotate, signal receive set=(term cont winch) peer=@{p_logrotate},
signal receive set=(term cont winch) peer=makepkg//sudo, signal receive set=(term cont winch) peer=makepkg//sudo,
signal receive set=(term cont winch) peer=role_*, signal receive set=(term cont winch) peer=role_*,
signal receive set=(term cont winch) peer=rpm, signal receive set=(term cont winch) peer=rpm,

2
apparmor.d/groups/utils/chsh
View file

@ -24,7 +24,7 @@ profile chsh @{exec_path} {
network netlink raw, network netlink raw,
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed #aa:dbus talk bus=system name=org.freedesktop.home1 label="@{p_systemd_homed}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/utils/login
View file

@ -34,7 +34,7 @@ profile login @{exec_path} flags=(attach_disconnected) {
ptrace read, ptrace read,
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/profiles-a-f/evince
View file

@ -30,7 +30,7 @@ profile evince @{exec_path} {
#aa:dbus own bus=session name=org.gnome.evince #aa:dbus own bus=session name=org.gnome.evince
#aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label=gsd-media-keys #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label="@{p_gsd_media_keys}"
#aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
@{exec_path} rix, @{exec_path} rix,

2
apparmor.d/profiles-a-f/fwupdmgr
View file

@ -27,7 +27,7 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected) {
network inet6 dgram, network inet6 dgram,
network netlink raw, network netlink raw,
#aa:dbus talk bus=system name=org.freedesktop.fwupd label=fwupd path=/ #aa:dbus talk bus=system name=org.freedesktop.fwupd label="@{p_fwupd}" path=/
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/profiles-m-r/qemu-ga
View file

@ -34,7 +34,7 @@ profile qemu-ga @{exec_path} {
unix type=stream addr=@@{udbus}/bus/shutdown/system, unix type=stream addr=@@{udbus}/bus/shutdown/system,
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}"
include if exists <local/qemu-ga_systemctl> include if exists <local/qemu-ga_systemctl>
} }

6
apparmor.d/tunables/multiarch.d/profiles
View file

@ -8,10 +8,10 @@
# All variables that refer to a profile name should be prefixed with `p_` # All variables that refer to a profile name should be prefixed with `p_`
# Name of the systemd profiles. Can be `unconfined` or `systemd`, `systemd-user` # Name of the systemd profiles. Can be `unconfined` or `systemd`, `systemd-user`
@{p_systemd}=unconfined @{p_sd}=unconfined
@{p_systemd_executor}=unconfined @{p_sdu}=unconfined
@{p_systemd_user}=unconfined @{p_systemd_user}=unconfined
@{p_systemd_user_executor}=unconfined @{p_systemd}=unconfined
# Name of the dbus daemon profiles # Name of the dbus daemon profiles
@{p_dbus_accessibility}=dbus-accessibility @{p_dbus_accessibility}=dbus-accessibility