felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-29 19:45:10 +00:00
parent 1f8507548f
commit 0619f4dcec
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
43 changed files with 160 additions and 208 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/gnome/evolution-alarm-notify
View file

@ -12,11 +12,12 @@ profile evolution-alarm-notify @{exec_path} {
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus/org.a11y>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read>
include <abstractions/gnome-strict>
include <abstractions/nameservice-strict>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
network netlink raw,

11
apparmor.d/groups/gnome/gdm
View file

@ -27,16 +27,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
ptrace (read) peer=unconfined,
signal (send) set=(term) peer=dbus-accessibility,
signal (send) set=(term) peer=dbus-session,
signal (send) set=(term) peer=dconf-service,
signal (send) set=(term) peer=gdm-session-worker,
signal (send) set=(term) peer=gdm-session,
signal (send) set=(term) peer=gnome-session-binary,
signal (send) set=(term) peer=jackdbus,
signal (send) set=(term) peer=tracker-miner,
signal (send) set=(term) peer=xdg-*,
signal (send) set=(term) peer=xorg,
signal (send) set=(term),
unix (bind, listen) type=stream addr="@/tmp/dbus-@{rand8}",
unix (send receive accept) type=stream addr="@/tmp/dbus-@{rand8}" peer=(label=gdm-session-worker, addr=none),

1
apparmor.d/groups/gnome/gjs-console
View file

@ -18,6 +18,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/bus/org.gnome.Shell.Introspect>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-write>
include <abstractions/gnome-strict>

8
apparmor.d/groups/gnome/gnome-characters-backgroudservice
View file

@ -11,19 +11,13 @@ profile gnome-characters-backgroudservice @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/dconf-write>
include <abstractions/wayland>
include <abstractions/gnome-strict>
@{exec_path} mr,
@{bin}/gjs-console rix,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService.*.gresource r,
/usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r,
/etc/gtk-3.0/settings.ini r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r,

25
apparmor.d/groups/gnome/gnome-control-center
View file

@ -45,12 +45,12 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{bin}/locale rix,
@{bin}/sed rix,
@{bin}/bwrap rPUx,
@{bin}/gkbd-keyboard-display rPUx,
@{bin}/gnome-software rPUx,
@{bin}/bwrap rCx -> bwrap,
@{bin}/gkbd-keyboard-display rPx,
@{bin}/gnome-software rPx,
@{bin}/openvpn rPx,
@{bin}/passwd rPx,
@{bin}/pkexec rPx,
@{bin}/pkexec rCx -> pkexec,
@{bin}/software-properties-gtk rPx,
@{bin}/usermod rPx,
@{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKitNetworkProcess rPx,
@ -165,5 +165,22 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
profile bwrap {
include <abstractions/base>
include <abstractions/common/bwrap>
@{bin}/bwrap mr,
include if exists <local/gnome-control-center_bwrap>
}
profile pkexec {
include <abstractions/base>
@{bin}/pkexec mr,
include if exists <local/gnome-control-center_pkexec>
}
include if exists <local/gnome-control-center>
}

3
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -71,6 +71,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/usr/share/gdm/greeter/autostart/{,*.desktop} r,
/usr/share/gnome-session/hardware-compatibility r,
/usr/share/gnome-session/sessions/*.session r,
/usr/share/gnome-shell/extensions/*/metadata.json r,
/usr/share/gnome/autostart/{,*.desktop} r,
@{etc_ro}/xdg/autostart/{,*.desktop} r,
@ -141,7 +142,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
@{lib}/caribou/caribou rPUx,
@{lib}/deja-dup/deja-dup-monitor rPx,
@{lib}/gsd-disk-utility-notify rPx,
@{lib}/gsd-* rPx,
@{lib}/update-notifier/ubuntu-advantage-notification rPx,
@{lib}/xapps/sn-watcher/* rPUx,
@{thunderbird_path} rPx,

3
apparmor.d/groups/gnome/gnome-shell
View file

@ -80,7 +80,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
#aa:dbus own bus=session name=org.gnome.Shell
#aa:dbus own bus=session name=com.canonical.Unity path=/com/canonical/{U,u}nity
#aa:dbus own bus=session name=com.rastersoft.dingextension interface=org.gtk.Actions
#aa:dbus own bus=session name=com.rastersoft.dingextension
#aa:dbus own bus=session name=org.gtk.Actions path=/**
#aa:dbus own bus=session name=org.gtk.MountOperationHandler
#aa:dbus own bus=session name=org.gtk.Notifications
#aa:dbus own bus=session name=org.kde.StatusNotifierWatcher path=/StatusNotifierWatcher

17
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -29,10 +29,11 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/lsblk rPx,
@{bin}/pkexec rPx,
@{bin}/sed rix,
@{sh_path} rix,
@{bin}/lsblk rPx,
@{bin}/pkexec rCx -> pkexec,
@{bin}/sed rix,
@{bin}/tr rix,
/usr/share/gnome-system-monitor/{,**} r,
/usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
@ -75,5 +76,15 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
/dev/tty rw,
profile pkexec {
include <abstractions/base>
@{bin}/pkexec mr,
include if exists <local/gnome-system-monitor_pkexec>
}
include if exists <local/gnome-system-monitor>
}

1
apparmor.d/groups/gnome/goa-identity-service
View file

@ -11,6 +11,7 @@ profile goa-identity-service @{exec_path} {
include <abstractions/base>
include <abstractions/authentication>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.MountTracker>
#aa:dbus own bus=session name=org.gnome.Identity

1
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -46,6 +46,7 @@ profile gsd-xsettings @{exec_path} {
@{exec_path} mr,
@{bin}/cat rix,
@{bin}/sed rix,
@{bin}/which{,.debianutils} rix,
@{bin}/busctl rPx,

3
apparmor.d/groups/gnome/mutter-x11-frames
View file

@ -12,11 +12,14 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus/org.a11y>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write>
include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
signal (receive) set=(term) peer=gdm,
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,