felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

General profiles update.

Browse source
This commit is contained in:
Alexandre Pujol 2021-04-29 21:02:28 +01:00
parent 559020861b
commit 0c494ed2ba
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
31 changed files with 61 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/desktop/accounts-daemon
View file

@ -18,6 +18,8 @@ profile accounts-daemon @{exec_path} {
capability sys_ptrace,
deny capability sys_nice,
ptrace (read) peer=unconfined,
@{exec_path} mr,
owner /var/lib/AccountsService/ r,

3
apparmor.d/groups/glib/glib-compile-schemas
View file

@ -10,6 +10,9 @@ include <tunables/global>
profile glib-compile-schemas @{exec_path} {
include <abstractions/base>
network inet stream,
network inet6 stream,
@{exec_path} mr,
/usr/share/glib-2.0/schemas/{,*} r,

7
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -24,11 +24,14 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
capability sys_nice,
capability sys_tty_config,
signal (send) set=hup peer=gsd-*,
signal (receive) set=term peer=gdm,
signal (send) set=hup peer=dbus-daemon,
signal (send) set=hup peer=gjs-console,
signal (send) set=hup peer=gnome-*,
signal (send) set=hup peer=gsd-*,
signal (send) set=hup peer=ibus-*,
signal (send) set=hup peer=xwayland,
signal (send) set=term peer=gdm-wayland-session,
signal (receive) set=term peer=gdm,
network netlink raw,

2
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -13,8 +13,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
include <abstractions/nameservice-strict>
signal (send) set=(term) peer=gsd-*,
signal (receive) set=(term, hup) peer=gdm*,
signal (receive) set=(term) peer=gdm-wayland-session,
signal (receive) set=(term) peer=gdm,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-a11y-settings
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-color
View file

@ -12,7 +12,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
include <abstractions/fonts>
include <abstractions/gtk>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-datetime
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-housekeeping
View file

@ -11,7 +11,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/thumbnails-cache-read>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -12,7 +12,7 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/fonts>
include <abstractions/gtk>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -13,7 +13,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
include <abstractions/fonts>
include <abstractions/gtk>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
network netlink raw,

2
apparmor.d/groups/gnome/gsd-power
View file

@ -15,7 +15,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
network netlink raw,
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-print-notifications
View file

@ -14,7 +14,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
network inet stream,
network inet6 stream,
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
signal (send) set=(hup) peer=gsd-printer,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-printer
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-printer @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
signal (receive) set=(hup) peer=gsd-print-notifications,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-rfkill
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
network netlink raw,

2
apparmor.d/groups/gnome/gsd-screensaver-proxy
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-sharing
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-smartcard
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-sound
View file

@ -10,7 +10,7 @@ include <tunables/global>
profile gsd-sound @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-wacom
View file

@ -13,7 +13,7 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
include <abstractions/fonts>
include <abstractions/gtk>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, hup) peer=gdm*,
@{exec_path} mr,

2
apparmor.d/groups/gnome/tracker-extract
View file

@ -28,6 +28,8 @@ profile tracker-extract @{exec_path} {
owner @{MOUNTS}/*/{,**} r,
owner /tmp/*/{,**} r,
owner @{PROC}/@{pid}/fd/ r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

3
apparmor.d/groups/pacman/pacdiff
View file

@ -13,6 +13,9 @@ profile pacdiff @{exec_path} {
capability dac_read_search,
capability mknod,
network inet stream,
network inet6 stream,
@{exec_path} mr,
/{usr/,}bin/pacman-conf rPx,

5
apparmor.d/groups/pacman/pacman-conf
View file

@ -9,7 +9,10 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pacman-conf
profile pacman-conf @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
network inet stream,
network inet6 stream,
@{exec_path} mr,
/etc/pacman.conf r,

2
apparmor.d/groups/systemd/child-systemctl
View file

@ -18,8 +18,8 @@ profile child-systemctl {
include <abstractions/consoles>
include <abstractions/wutmp>
capability sys_ptrace,
capability net_admin,
capability sys_ptrace,
ptrace (read),

2
apparmor.d/groups/systemd/systemd-machined
View file

@ -27,7 +27,7 @@ profile systemd-machined @{exec_path} flags=(complain) {
/etc/machine-id r,
@{run}/systemd/machines/{,**} r,
@{run}/systemd/machines/{,**} rw,
@{run}/systemd/userdb/io.systemd.Machine rw,
include if exists <local/systemd-machined>