felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'xfce' of github.com:nobody43/apparmor.d into nobody43-xfce

Browse source 
* 'xfce' of github.com:nobody43/apparmor.d:
  xfce, fixes
  Adapt to RO root
  xfce, flags
  xfce, proper abi
  xfce, new profiles
  xfce, updates
This commit is contained in:
Alexandre Pujol 2025-03-23 16:18:46 +01:00
commit 0fce2e526d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
46 changed files with 303 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

7
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -31,6 +31,9 @@ profile dpkg-preconfigure @{exec_path} {
@{bin}/sort rix,
@{bin}/stty rix,
@{bin}/tr rix,
@{bin}/head rix,
@{bin}/readlink rix,
@{bin}/realpath rix,
@{bin}/findmnt rPx,
@{bin}/dpkg rPx -> child-dpkg,
@ -39,7 +42,9 @@ profile dpkg-preconfigure @{exec_path} {
@{lib}/apt/apt-extracttemplates rPx,
/usr/share/debconf/confmodule r,
/usr/share/dictionaries-common/{,*} r,
/etc/cloud/cloud.cfg.d/90_dpkg.cfg r,
/etc/debconf.conf r,
/etc/default/grub r,
/etc/default/mdadm r,
@ -48,6 +53,7 @@ profile dpkg-preconfigure @{exec_path} {
/etc/mdadm/mdadm.conf r,
/etc/shadow r,
/etc/ssh/sshd_config r,
/etc/X11/Xwrapper.config r,
/var/lib/locales/supported.d/{,*} r,
@ -64,6 +70,7 @@ profile dpkg-preconfigure @{exec_path} {
owner /var/cache/debconf/tmp.ci/*.config.@{rand6} w,
owner /var/cache/debconf/tmp.ci/*.passwords.@{rand6} w,
owner /var/cache/debconf/tmp.ci/*.template.@{rand6} w,
owner /var/cache/dictionaries-common/flag-wordlist-new w,
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
@{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,

1
apparmor.d/groups/bluetooth/blueman
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile blueman @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/dconf-write>
include <abstractions/desktop>

1
apparmor.d/groups/bluetooth/blueman-mechanism
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/blueman-mechanism @{lib}/blueman/blueman-mechanism
profile blueman-mechanism @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/nameservice-strict>
include <abstractions/python>

1
apparmor.d/groups/children/child-dpkg-divert
View file

@ -22,6 +22,7 @@ profile child-dpkg-divert {
/var/lib/dpkg/arch r,
/var/lib/dpkg/status r,
/var/lib/dpkg/updates/ r,
/var/lib/dpkg/updates/@{int} r,
/var/lib/dpkg/triggers/File r,
/var/lib/dpkg/triggers/Unincorp r,
/var/lib/dpkg/diversions r,

8
apparmor.d/groups/display-manager/lightdm
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/lightdm
profile lightdm @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/authentication>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
@ -36,8 +37,13 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term) peer=xfce-session,
signal (send) set=(term) peer=xorg,
#aa:dbus own bus=system name=org.freedesktop.DisplayManager
@{exec_path} mrix,
@{sh_path} rix,
@{bin}/{,e,f}grep rix,
@{bin}/df rix,
@{bin}/rm rix,
@{bin}/lightdm-*-greeter rPUx,
@ -45,6 +51,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
@{bin}/Xorg rPx,
@{bin}/plymouth rPx,
@{bin}/gnome-keyring-daemon rPx,
@{bin}/lightdm-session rPx,
@{lib}/security-misc/* rPx, #aa:only whonix
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
@ -81,6 +88,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid rw,
owner @{PROC}/@{pid}/uid_map r,
owner @{PROC}/@{pid}/mountinfo r,
/dev/tty@{int} r,

23
apparmor.d/groups/display-manager/lightdm-session Normal file
View file

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/lightdm-session
profile lightdm-session @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
@{bin}/im-launch rPx,
@{sh_path} rix,
@{bin}/mktemp rix,
@{bin}/expr rix,
include if exists <local/lightdm-session>
}
# vim:syntax=apparmor

2
apparmor.d/groups/filesystem/mount-cifs
View file

@ -10,10 +10,12 @@ include <tunables/global>
@{exec_path} = @{bin}/mount.cifs
profile mount-cifs @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_admin,
capability setpcap,
capability dac_read_search,
network inet dgram,
network inet stream,

20
apparmor.d/groups/freedesktop/pkla-admin-identities Normal file
View file

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/pkla-admin-identities
profile pkla-admin-identities @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
/etc/polkit-1/localauthority.conf.d/{,**} r,
include if exists <local/pkla-admin-identities>
}
# vim:syntax=apparmor

9
apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent
View file

@ -12,11 +12,20 @@ include <tunables/global>
@{exec_path} += @{lib}/polkit-gnome/polkit-gnome-authentication-agent-1
profile polkit-gnome-authentication-agent @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-accessibility>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/dconf-write>
include <abstractions/gnome-strict>
signal (send) set=(term) peer=polkit-agent-helper,
@{exec_path} mr,
@{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
@{lib}/polkit-agent-helper-[0-9] rPx,
@{PROC}/@{pid}/cgroup r,
include if exists <local/polkit-gnome-authentication-agent>

2
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -36,7 +36,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{bin}/tr rix,
/usr/share/gnome-system-monitor/{,**} r,
/usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
/usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
/ r,

1
apparmor.d/groups/grub/grub-mkconfig
View file

@ -65,6 +65,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
@{lib}/grub/grub-sort-version rPx,
@{lib}/libostree/grub[0-9]-@{int}_ostree rix,
/usr/share/desktop-base/*/grub/* r,
/usr/share/grub/{,**} r,
/usr/share/terminfo/** r,

1
apparmor.d/groups/grub/grub-probe
View file

@ -27,6 +27,7 @@ profile grub-probe @{exec_path} {
/ r,
/boot/ r,
/boot/grub/ r,
/boot/grub/themes/{,**} r,
@{PROC}/@{pids}/mountinfo r,

3
apparmor.d/groups/gvfs/gvfsd-computer
View file

@ -10,6 +10,9 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-computer
profile gvfsd-computer @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
@{exec_path} mr,

3
apparmor.d/groups/gvfs/gvfsd-wsdd
View file

@ -9,9 +9,12 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-wsdd
profile gvfsd-wsdd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
network netlink raw,
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd
@{exec_path} mr,
@{bin}/env r,

1
apparmor.d/groups/network/NetworkManager
View file

@ -104,6 +104,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
/etc/network/interfaces.d/{,*} r,
/etc/NetworkManager/{,**} r,
/etc/NetworkManager/system-connections/{,**} w,
@{etc_rw}/netplan/90-NM-@{uuid}.yaml w,
@{etc_rw}/resolv.conf rw,
@{etc_rw}/resolv.conf.[0-9A-Z]* rw,

1
apparmor.d/groups/network/wg-quick
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile wg-quick @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability dac_read_search,
capability net_admin,

1
apparmor.d/groups/polkit/polkitd
View file

@ -26,6 +26,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/pkla-check-authorization rPUx,
@{bin}/pkla-admin-identities rPx,
/etc/machine-id r,

4
apparmor.d/groups/systemd/systemd-hwdb
View file

@ -16,10 +16,10 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{exec_path} mr,
@{lib}/udev/#@{int} rwl,
@{lib}/udev/.#hwdb.bin@{hex16} wl -> @{lib}/udev/#@{int},
@{lib}/udev/.#hwdb.bin{@{hex16},@{rand6}} wl -> @{lib}/udev/#@{int},
@{lib}/udev/hwdb.bin w,
/etc/udev/.#hwdb.bin@{hex16} wl -> /etc/udev/#@{int},
/etc/udev/.#hwdb.bin{@{hex16},@{rand6}} wl -> /etc/udev/#@{int},
/etc/udev/hwdb.bin w,
/etc/udev/hwdb.d/{,*} r,

2
apparmor.d/groups/systemd/systemd-udevd
View file

@ -80,7 +80,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
/etc/nfs.conf rk,
/etc/udev/{,**} r,
/etc/udev/.#hwdb.bin* rw,
/etc/udev/.#hwdb.bin{@{hex16},@{rand6}} rw,
/etc/udev/hwdb.bin rw,
/etc/modprobe.d/ r,

2
apparmor.d/groups/utils/su
View file

@ -25,6 +25,8 @@ profile su @{exec_path} {
@{bin}/nologin rPx,
@{etc_ro}/default/su r,
/etc/default/locale r,
/etc/environment r,
@{HOME}/.xauth@{rand6} rw,

4
apparmor.d/groups/xfce/startxfce
View file

@ -19,6 +19,7 @@ profile startxfce @{exec_path} {
@{bin}/mkdir rix,
@{bin}/id rix,
@{bin}/xdg-user-dirs-update rPx,
@{bin}/xfce4-session rPx,
@{bin}/xrdb rPx,
@{bin}/systemctl rCx -> systemctl,
@ -27,6 +28,8 @@ profile startxfce @{exec_path} {
/etc/X11/xinit/xinitrc.d/{,**} r,
/etc/xdg/xfce4/{,**} r,
owner @{HOME}/.Xdefaults r,
profile systemctl flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/systemctl>
@ -36,6 +39,7 @@ profile startxfce @{exec_path} {
profile dbus {
include <abstractions/base>
include <abstractions/bus-session>
@{bin}/dbus-update-activation-environment mr,

13
apparmor.d/groups/xfce/thunar
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/thunar
profile thunar @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/deny-sensitive-home>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
@ -17,6 +19,10 @@ profile thunar @{exec_path} {
network netlink raw,
#aa:dbus own bus=session name=org.xfce.Thunar
#aa:dbus own bus=session name=org.xfce.FileManager
#aa:dbus own bus=session name=org.freedesktop.FileManager1
@{exec_path} mr,
@{bin}/thunar-volman rPx,
@ -30,6 +36,7 @@ profile thunar @{exec_path} {
/etc/fstab r,
/etc/timezone r,
/etc/xdg/{,xdg-xubuntu/}Thunar/{,**} r,
# Full access to user's data
/ r,
@ -43,6 +50,10 @@ profile thunar @{exec_path} {
owner @{run}/user/@{uid}/{,**} rw,
owner @{tmp}/{,**} rw,
@{run}/mount/utab r,
owner @{PROC}/@{pid}/mountinfo r,
# Silence non user's data
deny /boot/{,**} r,
deny /opt/{,**} r,
@ -50,8 +61,6 @@ profile thunar @{exec_path} {
deny /tmp/.* rw,
deny /tmp/.*/{,**} rw,
owner @{PROC}/@{pid}/mountinfo r,
profile dbus {
include <abstractions/base>
include <abstractions/nameservice-strict>

2
apparmor.d/groups/xfce/thunar-volman
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/thunar-volman
profile thunar-volman @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/nameservice-strict>
include <abstractions/xfce>

12
apparmor.d/groups/xfce/tumblerd
View file

@ -9,18 +9,30 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}tumbler-1/tumblerd
profile tumblerd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/gstreamer>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-write>
#aa:dbus own bus=session name=org.freedesktop.thumbnails.Cache1
#aa:dbus own bus=session name=org.freedesktop.thumbnails.Manager1
#aa:dbus own bus=session name=org.freedesktop.thumbnails.Thumbnailer1
@{exec_path} mr,
@{bin}/gdk-pixbuf-thumbnailer rPx,
/usr/share/backgrounds/xfce/{,**} r,
/usr/share/thumbnailers/{,**} r,
/etc/fstab r,
/etc/xdg/tumbler/* r,
owner /tmp/tumbler-@{rand6}.png r,
owner /tmp/tumbler-@{rand6}.??? w,
owner @{PROC}/@{pid}/mountinfo r,
/dev/ r,

4
apparmor.d/groups/xfce/xfce-clipman-settings
View file

@ -9,8 +9,12 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-clipman-settings
profile xfce-clipman-settings @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/xfce>
#aa:dbus own bus=session name=org.xfce.clipman.settings
@{exec_path} mr,
@{open_path} rPx -> child-open-help,

5
apparmor.d/groups/xfce/xfce-notifyd
View file

@ -10,6 +10,8 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}xfce4/notifyd/xfce4-notifyd
profile xfce-notifyd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
@ -22,6 +24,9 @@ profile xfce-notifyd @{exec_path} {
network inet6 stream,
network netlink raw,
#aa:dbus own bus=session name=org.xfce.Notifyd
#aa:dbus own bus=session name=org.freedesktop.Notifications
@{exec_path} mr,
owner @{user_cache_dirs}/xfce4/notifyd/ rw,

18
apparmor.d/groups/xfce/xfce-panel
View file

@ -9,12 +9,22 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-panel @{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0
profile xfce-panel @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-system>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/thumbnails-cache-read>
include <abstractions/app-launcher-user>
include <abstractions/audio-client>
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>
include <abstractions/xfce>
ptrace (read) peer=xfce-terminal,
#aa:dbus own bus=session name=org.xfce.Panel
#aa:dbus own bus=session name=org.kde.StatusNotifierWatcher
@{exec_path} mr,
@{bin}/exo-open rix,
@ -26,6 +36,7 @@ profile xfce-panel @{exec_path} {
@{bin}/sudo rCx -> root,
/usr/share/desktop-directories/{,**} r,
/usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
/usr/share/livecheck/** r,
/usr/share/xfce4/{,**} r,
@ -33,15 +44,20 @@ profile xfce-panel @{exec_path} {
/etc/machine-id r,
/etc/timezone r,
/etc/xdg/menus/{,**} r,
/etc/xdg/xfce4/{,**} r,
/etc/xdg/{,xdg-xubuntu/}xfce4/{,**} r,
owner @{user_cache_dirs}/xfce4/notifyd/icons/ rw,
owner @{user_cache_dirs}/xfce4-indicator-plugin.log w,
owner @{user_config_dirs}/xfce4/panel/{,**} rw,
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} w,
@{PROC}/cmdline r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mountinfo r,
deny @{user_share_dirs}/gvfs-metadata/{,*} r,
profile root {
include <abstractions/base>
include <abstractions/app/sudo>

7
apparmor.d/groups/xfce/xfce-power-manager
View file

@ -9,9 +9,16 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-power-manager
profile xfce-power-manager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/xfce>
include <abstractions/nameservice-strict>
#aa:dbus own bus=session name=org.xfce.PowerManager
#aa:dbus own bus=session name=org.freedesktop.PowerManagement
@{exec_path} mr,
@{bin}/xfpm-power-backlight-helper rPx,

4
apparmor.d/groups/xfce/xfce-screensaver
View file

@ -9,11 +9,15 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-screensaver
profile xfce-screensaver @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/authentication>
include <abstractions/graphics>
include <abstractions/xfce>
include <abstractions/nameservice-strict>
#aa:dbus own bus=session name=org.xfce.ScreenSaver
@{exec_path} mr,
@{sh_path} rix,

11
apparmor.d/groups/xfce/xfce-session
View file

@ -9,6 +9,10 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-session
profile xfce-session @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/bus-session>
include <abstractions/bus-accessibility>
include <abstractions/fontconfig-cache-read>
include <abstractions/app-launcher-user>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
@ -16,6 +20,8 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term) peer=lightdm,
#aa:dbus own bus=session name=org.xfce.SessionManager
@{exec_path} mr,
@{sh_path} rix,
@ -33,6 +39,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
@{lib}/msgcollector/msgdispatcher_xdg_autostart rPx,
@{lib}/sdwdate-gui/start-maybe rPx,
@{lib}/setup-wizard-dist/setup-dist_check_for_start rPx,
@{lib}/xapps/sn-watcher/xapp-sn-watcher rPUx,
/usr/share/kde-power-savings-disable-in-vms/{,**} r,
/usr/share/kde-screen-locker-disable-in-vms/{,**} r,
@ -48,11 +55,15 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
/etc/xdg/autostart/*.desktop r,
owner @{user_cache_dirs}/sessions/{,**} rw,
owner @{user_config_dirs}/autostart/ r,
owner @{user_config_dirs}/autostart/*.desktop r,
owner @{tmp}/.xfsm-ICE-@{rand6} rw,
owner @{PROC}/@{pid}/stat r,
@{sys}/class/i2c-adapter/ r,
/dev/tty rw,
profile systemctl flags=(attach_disconnected) {

11
apparmor.d/groups/xfce/xfce-terminal
View file

@ -9,6 +9,9 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-terminal
profile xfce-terminal @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/audio-client>
include <abstractions/consoles>
include <abstractions/dconf-write>
@ -16,6 +19,10 @@ profile xfce-terminal @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/xfce>
signal send,
#aa:dbus own bus=session name=org.xfce.Terminal5
@{exec_path} mr,
@{open_path} rPx -> child-open-help,
@ -28,7 +35,10 @@ profile xfce-terminal @{exec_path} {
@{bin}/micro rPUx,
@{bin}/nvtop rPx,
@{editor_path} rPUx,
/usr/share/ r,
/usr/share/desktop-base/profiles/xdg-config/ r,
/usr/share/xfce4/ r,
/usr/share/xfce4/terminal/{,**} r,
@ -36,6 +46,7 @@ profile xfce-terminal @{exec_path} {
/etc/xdg/ r,
/etc/xdg/xfce4/ r,
owner @{user_config_dirs}/xfce4/ r,
owner @{user_config_dirs}/xfce4/terminal/{,**} r,
owner @{tmp}/#@{int} rw,

5
apparmor.d/groups/xfce/xfconfd
View file

@ -10,11 +10,14 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}xfce4/xfconf/xfconfd
profile xfconfd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/xfce>
#aa:dbus own bus=session name=org.xfce.Xfconf
@{exec_path} mr,
/etc/xdg/xfce4/xfconf/** r,
/etc/xdg/{,xdg-xubuntu/}xfce4/xfconf/** r,
owner @{HOME}/ r,

9
apparmor.d/groups/xfce/xfdesktop
View file

@ -10,14 +10,23 @@ include <tunables/global>
profile xfdesktop @{exec_path} {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/xfce>
#aa:dbus own bus=session name=org.xfce.xfdesktop
@{exec_path} mr,
@{bin}/xfce4-mime-helper rix,
/etc/xdg/{,xdg-xubuntu/}xfce4/helpers.rc r,
/etc/xdg/menus/{,*.menu} r,
/usr/share/xfce4/helpers/{,*.desktop} r,
/usr/share/desktop-directories/{,*.directory} r,
/usr/share/backgrounds/xfce/{,**} r,
/etc/fstab r,

6
apparmor.d/groups/xfce/xfsettingsd
View file

@ -10,8 +10,14 @@ include <tunables/global>
profile xfsettingsd @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/fontconfig-cache-read>
include <abstractions/xfce>
#aa:dbus own bus=session name=org.xfce.SettingsDaemon
@{exec_path} mr,
/etc/xdg/autostart/xfsettingsd.desktop r,

2
apparmor.d/groups/xfce/xfwm
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/xfwm4
profile xfwm @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/audio-client>
include <abstractions/fontconfig-cache-write>
include <abstractions/graphics>

2
apparmor.d/profiles-a-f/filezilla
View file

@ -29,6 +29,7 @@ profile filezilla @{exec_path} {
network netlink raw,
signal send set=(term, kill) peer=fzsftp,
signal send set=(term, kill) peer=fzputtygen,
@{exec_path} mr,
@ -36,6 +37,7 @@ profile filezilla @{exec_path} {
@{bin}/uname rix,
@{bin}/fzsftp rPx, # When using SFTP protocol
@{bin}/fzputtygen rPUx,
@{bin}/lsb_release rPx -> lsb_release,
/usr/share/filezilla/{,**} r,

15
apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer Normal file
View file

@ -0,0 +1,15 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/gdk-pixbuf-thumbnailer
profile gdk-pixbuf-thumbnailer @{exec_path} {
include <abstractions/base>
include if exists <local/gdk-pixbuf-thumbnailer>
}
# vim:syntax=apparmor

2
apparmor.d/profiles-g-l/iceauth
View file

@ -16,7 +16,7 @@ profile iceauth @{exec_path} {
owner @{tmp}/.xfsm-ICE-@{rand6} r,
owner @{tmp}/user/@{uid}/.xfsm-ICE-@{rand6} r,
owner @{run}/user/@{uid}/ICEauthority rl -> @{run}/user/@{uid}/ICEauthority-n,
owner @{run}/user/@{uid}/ICEauthority rwl -> @{run}/user/@{uid}/ICEauthority-n,
owner @{run}/user/@{uid}/ICEauthority-c w,
owner @{run}/user/@{uid}/ICEauthority-l wl -> @{run}/user/@{uid}/ICEauthority-c,
owner @{run}/user/@{uid}/ICEauthority-n rw,

1
apparmor.d/profiles-g-l/im-launch
View file

@ -22,6 +22,7 @@ profile im-launch @{exec_path} {
@{bin}/sed rix,
@{bin}/sleep rix,
@{bin}/startplasma-x11 rPx,
@{bin}/startxfce4 rPx,
@{bin}/true rix,
@{bin}/uim-toolbar-gtk3 rPUx,
@{bin}/uim-xim rPUx,

8
apparmor.d/profiles-g-l/libreoffice
View file

@ -74,11 +74,14 @@ profile libreoffice @{exec_path} {
/usr/share/mythes/{,**} r,
/usr/share/thumbnailers/{,**} r,
/etc/java{,@{version}}-openjdk/{,**} r,
/etc/java{,-}{,@{version}}-openjdk/{,**} r,
/etc/libreoffice/{,**} r,
/etc/paperspecs r,
/etc/papersize r,
/etc/xdg/* r,
owner /var/spool/libreoffice/uno_packages/cache/stamp.sys w,
owner @{user_cache_dirs}/libreoffice/{,**} rw,
owner @{user_config_dirs}/libreoffice/ rw,
owner @{user_config_dirs}/libreoffice/** rwk,
@ -97,7 +100,7 @@ profile libreoffice @{exec_path} {
owner @{tmp}/*.tmp/{,**} rwk,
owner @{tmp}/hsperfdata_@{user}/ rw,
owner @{tmp}/hsperfdata_@{user}/@{int} rwk,
owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} w,
owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex32} rw,
owner @{run}/user/@{uid}/#@{int} rw,
@ -106,6 +109,7 @@ profile libreoffice @{exec_path} {
@{sys}/kernel/mm/hugepages/ r,
@{sys}/kernel/mm/transparent_hugepage/enabled r,
@{sys}/kernel/mm/transparent_hugepage/shmem_enabled r,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/{cpu,memory}.max r,
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/**/memory.max r,
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r,

5
apparmor.d/profiles-m-r/nemo
View file

@ -21,7 +21,12 @@ profile nemo @{exec_path} {
@{exec_path} mr,
@{open_path} rPx -> child-open,
@{bin}/gdk-pixbuf-thumbnailer rPx,
/usr/share/nemo/** r,
/usr/share/thumbnailers/{,*.thumbnailer} r,
# Full access to user's data
/ r,

6
apparmor.d/profiles-m-r/remmina
View file

@ -22,6 +22,7 @@ profile remmina @{exec_path} {
include <abstractions/bus/org.kde.StatusNotifierWatcher>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/ibus>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
@ -30,6 +31,8 @@ profile remmina @{exec_path} {
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
network netlink raw,
#aa:dbus own bus=session name=org.remmina.Remmina
@ -63,6 +66,9 @@ profile remmina @{exec_path} {
owner @{run}/user/@{uid}/keyring/ssh rw,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
include if exists <local/remmina>
}

2
apparmor.d/profiles-m-r/run-parts
View file

@ -255,6 +255,8 @@ profile run-parts @{exec_path} {
@{run}/reboot-required w,
@{run}/reboot-required.pkgs rw,
@{sys}/module/compression r,
@{PROC}/devices r,
@{PROC}/cmdline r,

1
apparmor.d/profiles-s-z/system-config-printer-applet
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/system-config-printer-applet /usr/share/system-config-printer/applet.py
profile system-config-printer-applet @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/python>
include <abstractions/nameservice-strict>

61
apparmor.d/profiles-s-z/ucf Normal file
View file

@ -0,0 +1,61 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/ucf
profile ucf @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl>
@{exec_path} r,
@{sh_path} rix,
@{bin}/{,e}grep rix,
@{bin}/basename rix,
@{bin}/cat rix,
@{bin}/cp rix,
@{bin}/dirname rix,
@{bin}/{m,g,}awk rix,
@{bin}/getopt rix,
@{bin}/id rix,
@{bin}/md5sum rix,
@{bin}/mkdir rix,
@{bin}/mv rix,
@{bin}/readlink rix,
@{bin}/rm rix,
@{bin}/sed rix,
@{bin}/seq rix,
@{bin}/stat rix,
@{bin}/tr rix,
@{bin}/which{,.debianutils} rix,
@{bin}/dpkg-query rpx,
@{bin}/dpkg-divert rPx,
@{pager_path} rCx -> child-pager,
/usr/share/debconf/frontend rPx, # TODO: rCx -> debonc-frontend,
/usr/share/** r,
/etc/default/* rw,
/etc/libreoffice/registry/** r,
/etc/ucf.conf r,
/var/lib/ucf/** rw,
# For shell pwd
/ r,
/root/ r,
owner /tmp/tmp.@{rand10} r,
include if exists <local/ucf>
}
# vim:syntax=apparmor

4
dists/flags/main.flags
View file

@ -111,6 +111,7 @@ flatpak-validate-icon complain
fstrim complain
fuse-overlayfs complain
fusermount complain
gdk-pixbuf-thumbnailer complain
gdm-generate-config complain
gdm-runtime-config complain
gdm-session attach_disconnected,complain
@ -215,6 +216,7 @@ libreoffice complain
libvirt-dbus complain
libvirtd attach_disconnected,complain
lightdm attach_disconnected,complain
lightdm-session complain
locale-gen complain
localectl complain
localsearch complain
@ -251,6 +253,7 @@ pam_kwallet_init complain
pam-tmpdir-helper complain
passimd attach_disconnected,complain
pkttyagent complain
pkla-admin-identities complain
plank complain
plasma_waitforname complain
plasma-browser-integration-host complain
@ -346,6 +349,7 @@ systemsettings complain
telegram-desktop complain
totem attach_disconnected,complain
tracker-writeback complain
ucf complain
udev-dmi-memory-id complain
udisksctl complain
udisksd attach_disconnected,complain