felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update gvfs services to the abs changes.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-14 18:14:30 +02:00
parent 784ced0da3
commit 1fba94a197
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
32 changed files with 237 additions and 166 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/gvfs/gvfs-afc-volume-monitor
View file

@ -17,7 +17,7 @@ profile gvfs-afc-volume-monitor @{exec_path} {
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

4
apparmor.d/groups/gvfs/gvfs-goa-volume-monitor
View file

@ -17,12 +17,12 @@ profile gvfs-goa-volume-monitor @{exec_path} {
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
dbus send bus=session path=/org/gnome/OnlineAccounts
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label=goa-daemon),
peer=(name=@{busname}, label=goa-daemon),
@{exec_path} mr,

2
apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor
View file

@ -21,7 +21,7 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} {
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

2
apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor
View file

@ -20,7 +20,7 @@ profile gvfs-mtp-volume-monitor @{exec_path} {
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

4
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -12,7 +12,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write>
include <abstractions/devices-usb>
include <abstractions/disks-read>
@ -35,7 +35,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

8
apparmor.d/groups/gvfs/gvfsd
View file

@ -18,20 +18,22 @@ profile gvfsd @{exec_path} {
#aa:dbus own bus=session name=org.gtk.vfs.Daemon
#aa:dbus own bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker
# The server side of abstractions/bus/session/org.gtk.vfs.Mountable
dbus send bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name=:*, label=gvfsd-*),
peer=(name=@{busname}, label=gvfsd-*),
# The server side of abstractions/bus/session/org.gtk.vfs.Spawner
dbus receive bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=:*, label=gvfsd-*),
peer=(name=@{busname}, label=gvfsd-*),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-admin
View file

@ -10,6 +10,10 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-admin
profile gvfsd-admin @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/mime>
include <abstractions/nameservice-strict>
@ -19,6 +23,13 @@ profile gvfsd-admin @{exec_path} {
capability fowner,
capability setuid,
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,
#aa:lint ignore=too-wide

11
apparmor.d/groups/gvfs/gvfsd-afc
View file

@ -10,6 +10,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-afc
profile gvfsd-afc @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-afp
View file

@ -10,6 +10,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-afp
profile gvfsd-afp @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-afp-browse
View file

@ -10,6 +10,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-afp-browse
profile gvfsd-afp-browse @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-archive
View file

@ -10,9 +10,20 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-archive
profile gvfsd-archive @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,
owner @{HOME}/**.{tar,tar.gz,zip} r,

11
apparmor.d/groups/gvfs/gvfsd-burn
View file

@ -10,6 +10,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-burn
profile gvfsd-burn @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-cdda
View file

@ -10,6 +10,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-cdda
profile gvfsd-cdda @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

9
apparmor.d/groups/gvfs/gvfsd-computer
View file

@ -11,9 +11,18 @@ include <tunables/global>
profile gvfsd-computer @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
#aa:dbus talk bus=session name=org.gtk.Private.RemoteVolumeMonitor label=gvfs-afc-volume-monitor
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-dav
View file

@ -10,6 +10,10 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-dav
profile gvfsd-dav @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/dconf-write>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
@ -24,6 +28,13 @@ profile gvfsd-dav @{exec_path} {
network inet6 dgram,
network netlink raw,
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,
owner @{run}/user/@{uid}/gvfsd/ rw,

26
apparmor.d/groups/gvfs/gvfsd-dnssd
View file

@ -12,32 +12,14 @@ profile gvfsd-dnssd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.gtk.vfs.Daemon>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/bus/system/org.freedesktop.Avahi.Server>
include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_dnssd
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member={MountLocation,LookupMount,RegisterMount}
peer=(name="@{busname}", label=gvfsd),
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable

11
apparmor.d/groups/gvfs/gvfsd-ftp
View file

@ -10,6 +10,10 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-ftp
profile gvfsd-ftp @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/dconf-write>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
@ -20,6 +24,13 @@ profile gvfsd-ftp @{exec_path} {
network inet6 stream,
network netlink raw,
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,
include if exists <local/gvfsd-ftp>

16
apparmor.d/groups/gvfs/gvfsd-fuse
View file

@ -11,7 +11,9 @@ include <tunables/global>
profile gvfsd-fuse @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/nameservice-strict>
capability sys_admin,
@ -20,21 +22,13 @@ profile gvfsd-fuse @{exec_path} {
unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse//fusermount),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=RegisterFuse
peer=(name=@{busname}, label=gvfsd),
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=@{busname}, label=gvfsd-sftp),
@{exec_path} mr,
@{bin}/fusermount{,3} rCx -> fusermount,

11
apparmor.d/groups/gvfs/gvfsd-google
View file

@ -10,6 +10,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-google
profile gvfsd-google @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-gphoto2
View file

@ -10,6 +10,17 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-gphoto2
profile gvfsd-gphoto2 @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

24
apparmor.d/groups/gvfs/gvfsd-http
View file

@ -11,9 +11,11 @@ include <tunables/global>
profile gvfsd-http @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/dconf-write>
include <abstractions/freedesktop.org>
# include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
@ -25,25 +27,15 @@ profile gvfsd-http @{exec_path} {
network netlink raw,
unix type=stream peer=(label=gnome-shell),
unix type=stream peer=(label=gnome-extension-gsconnect),
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_http
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=RegisterMount
peer=(name=:*, label=gvfsd),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

3
apparmor.d/groups/gvfs/gvfsd-localtest
View file

@ -10,6 +10,9 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-localtest
profile gvfsd-localtest @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
@{exec_path} mr,

6
apparmor.d/groups/gvfs/gvfsd-metadata
View file

@ -11,6 +11,9 @@ include <tunables/global>
profile gvfsd-metadata @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/disks-read>
network netlink raw,
@ -18,11 +21,12 @@ profile gvfsd-metadata @{exec_path} {
signal (receive) set=(usr1) peer=pacman,
#aa:dbus own bus=session name=org.gtk.vfs.Metadata path=/org/gtk/vfs/{m,M}etadata
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

16
apparmor.d/groups/gvfs/gvfsd-mtp
View file

@ -10,6 +10,10 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-mtp
profile gvfsd-mtp @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/dconf-write>
include <abstractions/deny-sensitive-home>
include <abstractions/devices-usb>
@ -19,10 +23,18 @@ profile gvfsd-mtp @{exec_path} {
network netlink raw,
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,
owner @{HOME}/{,**} rw, # FIXME: ?
owner @{MOUNTS}/{,**} rw,
owner @{HOME}/ r,
owner @{HOME}/** rw,
owner @{MOUNTS}/** rw,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,

26
apparmor.d/groups/gvfs/gvfsd-network
View file

@ -11,38 +11,20 @@ include <tunables/global>
profile gvfsd-network @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.Daemon>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/dconf-write>
include <abstractions/gschemas>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name="@{busname}", label=gvfsd),
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member={MountLocation,LookupMount,RegisterMount}
peer=(name="@{busname}", label=gvfsd),
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=@{busname}),
@{exec_path} mr,
owner @{run}/user/@{uid}/gvfsd/ rw,

11
apparmor.d/groups/gvfs/gvfsd-nfs
View file

@ -10,12 +10,23 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-nfs
profile gvfsd-nfs @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/nameservice-strict>
network inet stream,
network inet6 stream,
network netlink raw,
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,
include if exists <local/gvfsd-nfs>

19
apparmor.d/groups/gvfs/gvfsd-recent
View file

@ -11,27 +11,16 @@ include <tunables/global>
profile gvfsd-recent @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.Daemon>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/deny-sensitive-home>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-read>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=RegisterMount
peer=(name="@{busname}", label=gvfsd),
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable

29
apparmor.d/groups/gvfs/gvfsd-sftp
View file

@ -11,32 +11,21 @@ include <tunables/global>
profile gvfsd-sftp @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/consoles>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/secrets-service>
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
#aa:dbus talk bus=session name=org.gtk.vfs.{M,m}ountTracker label=gvfsd
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=@{busname}),
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name=@{busname}, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name=@{busname}, label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/mountop/@{int}
interface=org.gtk.vfs.MountOperation
member={AskQuestion,AskPassword}
peer=(name=@{busname}),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

11
apparmor.d/groups/gvfs/gvfsd-smb
View file

@ -10,6 +10,10 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-smb
profile gvfsd-smb @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/dconf-write>
include <abstractions/freedesktop.org>
@ -19,6 +23,13 @@ profile gvfsd-smb @{exec_path} {
network inet dgram,
network inet6 dgram,
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,
/etc/samba/smb.conf r,

18
apparmor.d/groups/gvfs/gvfsd-smb-browse
View file

@ -11,7 +11,9 @@ include <tunables/global>
profile gvfsd-smb-browse @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/dconf-write>
include <abstractions/gschemas>
include <abstractions/nameservice-strict>
@ -23,16 +25,12 @@ profile gvfsd-smb-browse @{exec_path} {
network inet6 dgram,
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_smb_browse
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name="@{busname}", label=gvfsd),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

22
apparmor.d/groups/gvfs/gvfsd-trash
View file

@ -11,7 +11,9 @@ include <tunables/global>
profile gvfsd-trash @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/trash-strict>
@ -21,26 +23,12 @@ profile gvfsd-trash @{exec_path} {
network inet6 stream,
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=RegisterMount
peer=(name="@{busname}", label=gvfsd),
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name="@{busname}", label=gnome-shell),
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr,

24
apparmor.d/groups/gvfs/gvfsd-wsdd
View file

@ -11,32 +11,16 @@ profile gvfsd-wsdd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/bus/session/org.gtk.vfs.Daemon>
include <abstractions/bus/session/org.gtk.vfs.Mountable>
include <abstractions/bus/session/org.gtk.vfs.Spawner>
include <abstractions/nameservice-strict>
network inet dgram, # ip=127.0.0.1 peer=(ip=127.0.0.*, port=53),
network netlink raw,
#aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable
member=Mount
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
interface=org.gtk.vfs.Spawner
member=Spawned
peer=(name="@{busname}", label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=RegisterMount
peer=(name="@{busname}", label=gvfsd),
dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=@{busname}, label=gvfsd-network),
#aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable