felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

@{HOME}/.cache -> @{user_cache_dirs}

Browse source
This commit is contained in:
Alexandre Pujol 2021-04-01 17:20:05 +01:00
parent 091d20d086
commit 1c9fc00c13
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
86 changed files with 266 additions and 266 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/browsers/brave
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{HOME}/.cache/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{exec_path} = @{BRAVE_INSTALLDIR}/brave{,-beta,-dev}
profile brave @{exec_path} {
@ -94,8 +94,8 @@ profile brave @{exec_path} {
owner @{BRAVE_HOMEDIR}/WidevineCdm/libwidevinecdm.so mrw,
# Cache files
owner @{HOME}/.cache/ rw,
owner @{HOME}/.cache/BraveSoftware/ rw,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/BraveSoftware/ rw,
owner @{BRAVE_CACHEDIR}/{,**/} rw,
owner @{BRAVE_CACHEDIR}/*/**/{*-,}index rw,
owner @{BRAVE_CACHEDIR}/*/**/[a-f0-9]*_? rw,

2
apparmor.d/groups/browsers/brave-browser
View file

@ -4,7 +4,7 @@
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{HOME}/.cache/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
abi <abi/3.0>,

2
apparmor.d/groups/browsers/brave-sandbox
View file

@ -4,7 +4,7 @@
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{HOME}/.cache/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
abi <abi/3.0>,

2
apparmor.d/groups/browsers/chromium
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
@{CHROMIUM_CACHEDIR} = @{user_cache_dirs}/chromium
@{exec_path} = /{usr/,}bin/chromium
profile chromium @{exec_path} {

2
apparmor.d/groups/browsers/chromium-chrome-sandbox
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
@{CHROMIUM_CACHEDIR} = @{user_cache_dirs}/chromium
@{exec_path} = @{CHROMIUM_INSTALLDIR}/chrome-sandbox

4
apparmor.d/groups/browsers/chromium-chromium
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
@{CHROMIUM_CACHEDIR} = @{user_cache_dirs}/chromium
@{exec_path} = @{CHROMIUM_INSTALLDIR}/chromium
profile chromium-chromium @{exec_path} {
@ -91,7 +91,7 @@ profile chromium-chromium @{exec_path} {
owner @{HOME}/.local/share/.org.chromium.Chromium.* rw,
# Cache files
owner @{HOME}/.cache/ rw,
owner @{user_cache_dirs}/ rw,
owner @{CHROMIUM_CACHEDIR}/{,**/} rw,
owner @{CHROMIUM_CACHEDIR}/*/**/{*-,}index rw,
owner @{CHROMIUM_CACHEDIR}/*/**/[a-f0-9]*_? rw,

8
apparmor.d/groups/browsers/firefox
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{MOZ_LIBDIR} = /{usr/,}lib/firefox{,-esr}
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
@{MOZ_CACHEDIR} = @{user_cache_dirs}/mozilla
@{exec_path} = @{MOZ_LIBDIR}/firefox{,-bin,-esr}
profile firefox @{exec_path} {
@ -84,12 +84,12 @@ profile firefox @{exec_path} {
owner @{MOZ_HOMEDIR}/native-messaging-hosts/org.keepassxc.keepassxc_browser.json r,
# Cache
owner @{HOME}/.cache/ rw,
owner @{user_cache_dirs}/ rw,
owner @{MOZ_CACHEDIR}/ rw,
owner @{MOZ_CACHEDIR}/** rwk,
owner @{HOME}/.cache/gstreamer-[0-9]*/ rw,
owner @{HOME}/.cache/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,
owner @{user_cache_dirs}/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
deny @{sys}/devices/system/cpu/present r,
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,

2
apparmor.d/groups/browsers/firefox-crashreporter
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{MOZ_LIBDIR} = /{usr/,}lib/firefox
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
@{MOZ_CACHEDIR} = @{user_cache_dirs}/mozilla
@{exec_path} = @{MOZ_LIBDIR}/crashreporter
profile firefox-crashreporter @{exec_path} {

2
apparmor.d/groups/browsers/firefox-minidump-analyzer
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{MOZ_LIBDIR} = /{usr/,}lib/firefox
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
@{MOZ_CACHEDIR} = @{user_cache_dirs}/mozilla
@{exec_path} = /{usr/,}lib/firefox/minidump-analyzer
profile firefox-minidump-analyzer @{exec_path} {

2
apparmor.d/groups/browsers/firefox-pingsender
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{MOZ_LIBDIR} = /{usr/,}lib/firefox
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
@{MOZ_CACHEDIR} = @{user_cache_dirs}/mozilla
@{exec_path} = @{MOZ_LIBDIR}/pingsender
profile firefox-pingsender @{exec_path} {

2
apparmor.d/groups/browsers/firefox-plugin-container
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{MOZ_LIBDIR} = /{usr/,}lib/firefox{,-esr}
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
@{MOZ_CACHEDIR} = @{user_cache_dirs}/mozilla
@{exec_path} = @{MOZ_LIBDIR}/plugin-container
profile firefox-plugin-container @{exec_path} {

4
apparmor.d/groups/browsers/google-chrome-chrome
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{HOME}/.cache/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{user_cache_dirs}/google-chrome{,-beta,-unstable}
@{exec_path} = @{CHROME_INSTALLDIR}/chrome{,-beta,-unstable}
profile google-chrome-chrome @{exec_path} {
@ -87,7 +87,7 @@ profile google-chrome-chrome @{exec_path} {
owner @{HOME}/.local/share/.com.google.Chrome.* rw,
# Cache files
owner @{HOME}/.cache/ rw,
owner @{user_cache_dirs}/ rw,
owner @{CHROME_CACHEDIR}/{,**/} rw,
owner @{CHROME_CACHEDIR}/*/**/{*-,}index rw,
owner @{CHROME_CACHEDIR}/*/**/[a-f0-9]*_? rw,

2
apparmor.d/groups/browsers/google-chrome-chrome-sandbox
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{HOME}/.cache/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{user_cache_dirs}/google-chrome{,-beta,-unstable}
@{exec_path} = @{CHROME_INSTALLDIR}/chrome-sandbox
profile google-chrome-chrome-sandbox @{exec_path} {

2
apparmor.d/groups/browsers/google-chrome-google-chrome
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{HOME}/.cache/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{user_cache_dirs}/google-chrome{,-beta,-unstable}
@{exec_path} = @{CHROME_INSTALLDIR}/google-chrome{,-beta,-unstable}
profile google-chrome-google-chrome @{exec_path} {

4
apparmor.d/groups/browsers/opera
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{HOME}/.cache/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{user_cache_dirs}/opera{,-beta,-developer}
@{exec_path} = @{OPERA_INSTALLDIR}/opera{,-beta,-developer}
profile opera @{exec_path} {
@ -78,7 +78,7 @@ profile opera @{exec_path} {
owner @{HOME}/.local/share/.org.chromium.Chromium.* rw,
# Cache files
owner @{HOME}/.cache/ rw,
owner @{user_cache_dirs}/ rw,
owner @{OPERA_CACHEDIR}/{,**/} rw,
owner @{OPERA_CACHEDIR}/**/{*-,}index rw,
owner @{OPERA_CACHEDIR}/**/[a-f0-9]*_? rw,

2
apparmor.d/groups/browsers/opera-crashreporter
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{HOME}/.cache/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{user_cache_dirs}/opera{,-beta,-developer}
@{exec_path} = @{OPERA_INSTALLDIR}/opera_crashreporter
profile opera-crashreporter @{exec_path} {

2
apparmor.d/groups/browsers/opera-sandbox
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{HOME}/.cache/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{user_cache_dirs}/opera{,-beta,-developer}
@{exec_path} = @{OPERA_INSTALLDIR}/opera_sandbox
profile opera-sandbox @{exec_path} {

4
apparmor.d/groups/browsers/torbrowser.Browser.firefox
View file

@ -117,8 +117,8 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
# Silence denial logs about permissions we don't need
deny /dev/dri/ rwklx,
deny @{HOME}/.cache/fontconfig/ rw,
deny @{HOME}/.cache/fontconfig/** rw,
deny @{user_cache_dirs}/fontconfig/ rw,
deny @{user_cache_dirs}/fontconfig/** rw,
deny @{HOME}/.config/gtk-2.0/ rw,
deny @{HOME}/.config/gtk-2.0/** rw,
deny @{PROC}/@{pid}/net/route r,