felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-11 22:47:22 +00:00
parent 0a9021bcf1
commit 0eeefb5f09
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
11 changed files with 36 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/apt/apt-helper
View file

@ -14,10 +14,17 @@ profile apt-helper @{exec_path} {
@{exec_path} mr,
@{bin}/nm-online rPx,
@{bin}/systemctl rPx -> child-systemctl,
@{bin}/systemctl rCx -> systemctl,
@{lib}/systemd/systemd-networkd-wait-online rPx,
owner @{PROC}/@{pid}/fd/ r,
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include if exists <local/apt-helper_systemctl>
}
include if exists <local/apt-helper>
}

1
apparmor.d/groups/freedesktop/xdg-permission-store
View file

@ -15,6 +15,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup kill) peer=dbus-daemon,
signal (receive) set=(term hup kill) peer=gdm*,
signal (receive) set=(kill) peer=gdm-wayland-session//dbus,
# dbus: own bus=session name=org.freedesktop.impl.portal.PermissionStore

2
apparmor.d/groups/gnome/gdm-xsession
View file

@ -87,6 +87,8 @@ profile gdm-xsession @{exec_path} {
include <abstractions/base>
include <abstractions/systemctl>
owner /dev/tty@{int} rw,
include if exists <local/gdm-xsession_systemctl>
}

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/gnome-shell
profile gnome-shell @{exec_path} flags=(attach_disconnected) {
profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio>

2
apparmor.d/groups/gnome/gnome-software
View file

@ -27,8 +27,6 @@ profile gnome-software @{exec_path} {
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/,
signal (receive) set=(cont, term) peer=systemd-user,
@{exec_path} mr,
@{bin}/baobab rPUx,

2
apparmor.d/groups/gnome/org.gnome.NautilusPreviewer
View file

@ -17,6 +17,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/private-files-strict>
include <abstractions/video>
include <abstractions/openssl>
network netlink raw,
@ -28,6 +29,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
/usr/share/poppler/{,**} r,
/usr/share/sushi/org.gnome.NautilusPreviewer.*.gresource r,
/usr/share/ladspa/rdf/{,**} r,
/etc/machine-id r,

2
apparmor.d/groups/systemd/systemd-logind
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-logind
profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
profile systemd-logind @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.PolicyKit1>

2
apparmor.d/groups/systemd/systemd-networkd
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-networkd
profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.hostname1>