felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

@{HOME}/.cache -> @{user_cache_dirs}

Browse source
This commit is contained in:
Alexandre Pujol 2021-04-01 17:20:05 +01:00
parent 091d20d086
commit 1c9fc00c13
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
86 changed files with 266 additions and 266 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor.d/groups/apps/android-studio
View file

@ -133,22 +133,22 @@ profile android-studio @{exec_path} {
owner @{HOME}/.config/Google/ rw,
owner @{HOME}/.config/Google/** rwk,
owner @{HOME}/.cache/ rw,
owner "@{HOME}/.cache/Android Open Source Project/" rw,
owner "@{HOME}/.cache/Android Open Source Project/**" rw,
owner @{user_cache_dirs}/ rw,
owner "@{user_cache_dirs}/Android Open Source Project/" rw,
owner "@{user_cache_dirs}/Android Open Source Project/**" rw,
owner @{HOME}/.cache/Google/ rw,
owner @{HOME}/.cache/Google/** rwk,
owner @{user_cache_dirs}/Google/ rw,
owner @{user_cache_dirs}/Google/** rwk,
# To remove the following error:
# Location: /home/morfik/.cache/Google/AndroidStudio4.1/tmp
# java.io.IOException: Cannot run program
# "/home/morfik/.cache/Google/AndroidStudio4.1/tmp/ij659840309.tmp": error=13, Permission denied
owner @{HOME}/.cache/Google/AndroidStudio*/tmp/ij[0-9]*.tmp rwkix,
owner @{user_cache_dirs}/Google/AndroidStudio*/tmp/ij[0-9]*.tmp rwkix,
#
owner @{HOME}/.cache/Google/AndroidStudio*/tmp/jna[0-9]*.tmp mrwk,
owner @{user_cache_dirs}/Google/AndroidStudio*/tmp/jna[0-9]*.tmp mrwk,
owner @{HOME}/.cache/JNA/ rw,
owner @{HOME}/.cache/JNA/** rw,
owner @{user_cache_dirs}/JNA/ rw,
owner @{user_cache_dirs}/JNA/** rw,
owner @{HOME}/.gradle/ rw,
owner @{HOME}/.gradle/** mrwkix,

20
apparmor.d/groups/apps/calibre
View file

@ -93,18 +93,18 @@ profile calibre @{exec_path} {
owner @{HOME}/.local/share/calibre-ebook.com/calibre/ rw,
owner @{HOME}/.local/share/calibre-ebook.com/calibre/** rwk,
owner @{HOME}/.cache/ rw,
owner @{HOME}/.cache/calibre/ rw,
owner @{HOME}/.cache/calibre/** rwkl -> @{HOME}/.cache/calibre/**,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/calibre/ rw,
owner @{user_cache_dirs}/calibre/** rwkl -> @{user_cache_dirs}/calibre/**,
owner @{HOME}/.cache/qtshadercache/ rw,
owner @{HOME}/.cache/qtshadercache/#[0-9]*[0-9] rw,
owner @{HOME}/.cache/qtshadercache/[0-9a-f]* rwl -> @{HOME}/.cache/qtshadercache/#[0-9]*[0-9],
owner @{HOME}/.cache/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
owner @{HOME}/.cache/qtshadercache-*-little_endian-*/[0-9a-f]* rwl -> @{HOME}/.cache/qtshadercache-*-little_endian-*/#[0-9]*[0-9],
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/qtshadercache/[0-9a-f]* rwl -> @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9],
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/[0-9a-f]* rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9],
owner @{HOME}/.cache/gstreamer-[0-9]*/ rw,
owner @{HOME}/.cache/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,
owner @{user_cache_dirs}/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
owner /tmp/calibre_*_tmp_*/{,**} rw,
owner /tmp/calibre-*/{,**} rw,

2
apparmor.d/groups/apps/discord
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{DISCORD_LIBDIR} = /usr/share/discord
@{DISCORD_HOMEDIR} = @{HOME}/.config/discord
@{DISCORD_CACHEDIR} = @{HOME}/.cache/discord
@{DISCORD_CACHEDIR} = @{user_cache_dirs}/discord
@{exec_path} = @{DISCORD_LIBDIR}/Discord /{usr/,}bin/discord
profile discord @{exec_path} {

2
apparmor.d/groups/apps/discord-chrome-sandbox
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{DISCORD_LIBDIR} = /usr/share/discord
@{DISCORD_HOMEDIR} = @{HOME}/.config/discord
@{DISCORD_CACHEDIR} = @{HOME}/.cache/discord
@{DISCORD_CACHEDIR} = @{user_cache_dirs}/discord
@{exec_path} = @{DISCORD_LIBDIR}/chrome-sandbox

4
apparmor.d/groups/apps/filezilla
View file

@ -33,8 +33,8 @@ profile filezilla @{exec_path} {
owner @{HOME}/.config/filezilla/ rw,
owner @{HOME}/.config/filezilla/* rwk,
owner @{HOME}/.cache/filezilla/ rw,
owner @{HOME}/.cache/filezilla/default_*.png rw,
owner @{user_cache_dirs}/filezilla/ rw,
owner @{user_cache_dirs}/filezilla/default_*.png rw,
/usr/share/filezilla/{,**} r,

4
apparmor.d/groups/apps/okular
View file

@ -57,8 +57,8 @@ profile okular @{exec_path} {
owner @{HOME}/.config/qt5ct/{,**} r,
/usr/share/qt5ct/** r,
owner @{HOME}/.cache/ rw,
owner @{HOME}/.cache/okular/{,**} rw,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/okular/{,**} rw,
/usr/share/okular/{,**} r,
/usr/share/kxmlgui5/okular/{,*} r,

6
apparmor.d/groups/apps/spotify
View file

@ -33,9 +33,9 @@ profile spotify @{exec_path} {
owner @{HOME}/.config/spotify/ rw,
owner @{HOME}/.config/spotify/** rw,
owner @{HOME}/.cache/ rw,
owner @{HOME}/.cache/spotify/ rw,
owner @{HOME}/.cache/spotify/** rwk,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/spotify/ rw,
owner @{user_cache_dirs}/spotify/** rwk,
owner @{HOME}/.Xauthority r,

4
apparmor.d/groups/apps/thunderbird
View file

@ -11,7 +11,7 @@ include <tunables/global>
@{MOZ_LIBDIR} = /{usr/,}lib/thunderbird
@{MOZ_HOMEDIR} = @{HOME}/.thunderbird
@{MOZ_CACHEDIR} = @{HOME}/.cache/thunderbird
@{MOZ_CACHEDIR} = @{user_cache_dirs}/thunderbird
@{exec_path} = @{MOZ_LIBDIR}/thunderbird{,-bin}
@{exec_path} += /{usr/,}bin/thunderbird
@ -83,7 +83,7 @@ profile thunderbird @{exec_path} {
deny @{HOME}/.mozilla/** mrwkl,
# Cache
owner @{HOME}/.cache/ rw,
owner @{user_cache_dirs}/ rw,
owner @{MOZ_CACHEDIR}/{,**} rw,
# Needed for system mails

10
apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
View file

@ -122,7 +122,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
owner @{HOME}/.config/soffice.binrc rwl -> @{HOME}/.config/#[0-9]*,
owner @{HOME}/.config/soffice.binrc.* rwl -> @{HOME}/.config/#[0-9]*,
owner @{HOME}/.config/soffice.binrc.lock rwk,
owner @{HOME}/.cache/fontconfig/** rw,
owner @{user_cache_dirs}/fontconfig/** rw,
owner @{HOME}/.config/gtk-???/bookmarks r, #Make bookmarks work
owner /{,var/}run/user/*/dconf/user rw,
@ -153,7 +153,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
/dev/tty rw,
/usr/lib{,32,64}/@{multiarch}/gstreamer???/gstreamer-???/gst-plugin-scanner rmPUx,
owner @{HOME}/.cache/gstreamer-???/** rw,
owner @{user_cache_dirs}/gstreamer-???/** rw,
unix peer=(addr=@/tmp/.ICE-unix/* label=unconfined), #Gstreamer doesn't work without this
/usr/lib{,32,64}/jvm/ r,
@ -234,7 +234,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
/usr/share/plasma/look-and-feel/**/contents/defaults r,
# TODO: remove when rules are available in abstractions/kde
owner @{HOME}/.cache/ksycoca5_??_* r, # KDE System Configuration Cache
owner @{user_cache_dirs}/ksycoca5_??_* r, # KDE System Configuration Cache
owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget
owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget
owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent()
@ -243,7 +243,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
/usr/share/knotifications5/*.notifyrc r, # KNotification::sendEvent
# TODO: remove when rules are available in abstractions/kde-write-icon-cache or similar
owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader
owner @{user_cache_dirs}/icon-cache.kcache rw, # for KIconLoader
# TODO: remove when rules are available in abstractions/kdeframeworks5 or similar
/usr/share/kservices5/*.protocol r,
@ -256,7 +256,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
owner @{HOME}/.config/QtProject.conf.lock rwk,
# TODO: use qt5-compose-cache-write abstraction when it is available
owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r,
owner @{user_cache_dirs}/qt_compose_cache_{little,big}_endian_* r,
# TODO: use recent-documents-write abstraction when it is available
owner @{HOME}/.local/share/RecentDocuments/** r,

6
apparmor.d/groups/apps/vlc
View file

@ -102,9 +102,9 @@ profile vlc @{exec_path} {
owner @{HOME}/.config/vlc/* rwkl -> @{HOME}/.config/vlc/#[0-9]*[0-9],
owner @{HOME}/.local/share/vlc/{,*} rw,
owner @{HOME}/.cache/ rw,
owner @{HOME}/.cache/vlc/{,**} rw,
owner @{HOME}/.cache/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/vlc/{,**} rw,
owner @{user_cache_dirs}/#[0-9]*[0-9] rw,
# To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
owner @{HOME}/.config/qt5ct/{,**} r,