felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): firefox: update dbus & move stacked profile outside of the abs.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-12 22:17:37 +01:00
parent aa6704bbac
commit 18010b266d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
2 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/abstractions/app/firefox
View file

@ -17,6 +17,7 @@
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
include <abstractions/bus/org.freedesktop.FileManager1> include <abstractions/bus/org.freedesktop.FileManager1>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/cups-client> include <abstractions/cups-client>
include <abstractions/dconf-write> include <abstractions/dconf-write>
include <abstractions/desktop> include <abstractions/desktop>
@ -46,6 +47,8 @@
signal (send) set=(term, kill) peer=@{profile_name}-*, signal (send) set=(term, kill) peer=@{profile_name}-*,
#aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
@{sh_path} rix, @{sh_path} rix,
@{bin}/basename rix, @{bin}/basename rix,
@{bin}/dirname rix, @{bin}/dirname rix,
@ -54,11 +57,9 @@
@{lib_dirs}/{,**} r, @{lib_dirs}/{,**} r,
@{lib_dirs}/*.so mr, @{lib_dirs}/*.so mr,
@{lib_dirs}/crashreporter rPx, @{lib_dirs}/crashreporter rPx,
@{lib_dirs}/glxtest rPx -> firefox//&firefox-glxtest,
@{lib_dirs}/minidump-analyzer rPx, @{lib_dirs}/minidump-analyzer rPx,
@{lib_dirs}/pingsender rPx, @{lib_dirs}/pingsender rPx,
@{lib_dirs}/plugin-container rPx, @{lib_dirs}/plugin-container rPx,
@{lib_dirs}/vaapitest rPx -> firefox//&firefox-vaapitest,
# Desktop integration # Desktop integration
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@ -157,7 +158,6 @@
# Silencer # Silencer
deny dbus send bus=system path=/org/freedesktop/hostname1, deny dbus send bus=system path=/org/freedesktop/hostname1,
deny /tmp/MozillaUpdateLock-* w, deny /tmp/MozillaUpdateLock-* w,
deny owner @{HOME}/ r,
deny owner @{HOME}/.* r, deny owner @{HOME}/.* r,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
deny @{run}/user/@{uid}/gnome-shell-disable-extensions w, deny @{run}/user/@{uid}/gnome-shell-disable-extensions w,

8
apparmor.d/groups/browsers/firefox
View file

@ -24,13 +24,17 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{exec_path} mrix, @{exec_path} mrix,
@{lib_dirs}/glxtest rPx -> firefox//&firefox-glxtest,
@{lib_dirs}/vaapitest rPx -> firefox//&firefox-vaapitest,
@{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemKWaylandPlugin.so mr,
@{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr,
@{lib}/mozilla/plugins/ r, @{lib}/mozilla/plugins/ r,
@{lib}/mozilla/plugins/libvlcplugin.so mr, @{lib}/mozilla/plugins/*.so mr,
# Desktop integration # Desktop integration
@{bin}/gnome-software rPx, @{bin}/gnome-software rPx,
@{bin}/kreadconfig5 rix, @{bin}/kreadconfig{,5} rPx,
@{bin}/plasma-browser-integration-host rPx, @{bin}/plasma-browser-integration-host rPx,
@{bin}/update-mime-database rPx, @{bin}/update-mime-database rPx,
@{lib}/gvfsd-metadata rPx, @{lib}/gvfsd-metadata rPx,