felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2022-02-22 20:51:28 +00:00
parent 0ee2e4f7ad
commit 2064783251
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
14 changed files with 61 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

15
apparmor.d/groups/browsers/chromium-chromium
View file

@ -1,7 +1,10 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Warning: Such a profile is limitted as it gives access to a lot of resources.
abi <abi/3.0>,
include <tunables/global>
@ -164,14 +167,12 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
deny @{sys}/devices/virtual/tty/tty[0-9]/active r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
# To remove the following error:
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
# The irq file is needed to render pages.
@{sys}/devices/pci[0-9]*/**/irq r,
@{sys}/devices/pci[0-9]*/**/usb[0-9]*/**/report_descriptor r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
@{sys}/devices/virtual/**/report_descriptor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
/var/tmp/ r,
/tmp/ r,

9
apparmor.d/groups/browsers/firefox
View file

@ -65,6 +65,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/gpa rPUx,
/{usr/,}bin/keepassxc-proxy rPUx,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/opt/net.downloadhelper.coapp/bin/net.downloadhelper.coapp* rPx,
# Allowed apps to open
/{usr/,}bin/xdg-open rCx -> open,
@ -132,10 +133,10 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
# For Cryptographic Attestation of Personhood
#@{sys}/bus/ r,
#@{sys}/class/ r,
#@{sys}/class/hidraw/ r,
#@{run}/udev/data/c241:[0-9]* r, # dynamic
@{sys}/bus/ r,
@{sys}/class/ r,
@{sys}/class/hidraw/ r,
@{run}/udev/data/c241:[0-9]* r, # dynamic
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r,