felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): rewrite some dbus rules (4).

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-03 16:53:25 +00:00
parent 2af165403a
commit 1edf507abf
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
16 changed files with 74 additions and 129 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor.d/groups/apt/unattended-upgrade-shutdown
View file

@ -9,26 +9,16 @@ include <tunables/global>
@{exec_path} = /usr/share/unattended-upgrades/unattended-upgrade-shutdown
profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-network-manager-strict>
include <abstractions/bus/login>
include <abstractions/bus/network-manager>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
include <abstractions/python>
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Inhibit,
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.DBus.{Introspectable,Properties}
member={Introspect,Get},
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=PrepareForShutdown,
member=PrepareForShutdown
peer=(name=:*, label=systemd-logind),
@{exec_path} mr,

39
apparmor.d/groups/freedesktop/upowerd
View file

@ -10,43 +10,24 @@ include <tunables/global>
@{exec_path} = @{lib}/{,upower/}upowerd
profile upowerd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/login>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>
network netlink raw,
dbus (send,receive) bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.{DBus.Properties,DBus.Introspectable,UPower*},
dbus (send,receive) bus=system path=/org/freedesktop/login1
dbus bind bus=system name=org.freedesktop.UPower,
dbus receive bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.UPower{,.*}
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.DBus.Properties
member={PropertiesChanged,GetAll},
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Inhibit,
dbus send bus=system path=/
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=bluetoothd),
dbus receive bus=system path=/org/bluez/hci0
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=bluetoothd),
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={UserNew,UserRemoved,SessionNew,SessionRemoved,PrepareForShutdown,PrepareForSleep}
peer=(name=:*, label=systemd-logind),
dbus receive bus=system path=/org/bluez/hci*/**
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*),
dbus bind bus=system name=org.freedesktop.UPower,
dbus receive bus=system path=/org/bluez/hci@{int}{,/**}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=bluetoothd),
@{exec_path} mr,

15
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/xdg-desktop-portal
profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/rtkit>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -22,14 +23,17 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
ptrace (read),
dbus bind bus=session name=org.freedesktop.portal.Desktop,
dbus receive bus=session path=/org/freedesktop/portal/desktop
dbus (send, receive) bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Settings
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktop
dbus (send, receive) bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Settings
dbus (send, receive) bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.*
peer=(name=:*),
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Realtime
member=MakeThread*
peer=(name=:*),
dbus bind bus=session name=org.freedesktop.background.Monitor,
@ -44,7 +48,6 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=xdg-permission-store),
dbus send bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=xdg-document-portal),

1
apparmor.d/groups/gnome/evolution-calendar-factory
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,evolution-data-server/}evolution-calendar-factory
profile evolution-calendar-factory @{exec_path} {
include <abstractions/base>
include <abstractions/bus/network-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>

2
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -128,7 +128,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
dbus receive bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
member=ActiveChanged
member={ActiveChanged,WakeUpScreen}
peer=(name=:*, label=gjs-console),
dbus receive bus=session

7
apparmor.d/groups/gnome/nautilus
View file

@ -25,14 +25,11 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
include <abstractions/vulkan>
dbus bind bus=session name=org.gnome.Nautilus,
dbus send bus=session path=/org/gnome/Nautilus
dbus (send, receive) bus=session path=/org/gnome/Nautilus
interface=org.gtk.{Actions,Application},
dbus send bus=session path=/org/gnome/Nautilus{,/**}
dbus (send, receive) bus=session path=/org/gnome/Nautilus{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=session path=/org/gnome/Nautilus
interface=org.gtk.Application
peer=(name=org.gnome.Nautilus, label="{nautilus,gnome-shell}"),
dbus bind bus=session name=org.freedesktop.FileManager1,
dbus receive bus=session path=/org/freedesktop/FileManager1

1
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfs-udisks2-volume-monitor
profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/udisk>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>

1
apparmor.d/groups/systemd/systemd-logind
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-logind
profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
include <abstractions/base>
include <abstractions/bus/polkit>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>