felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2022-02-22 20:51:28 +00:00
parent 0ee2e4f7ad
commit 2064783251
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
14 changed files with 61 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

15
apparmor.d/groups/browsers/chromium-chromium
View file

@ -1,7 +1,10 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Warning: Such a profile is limitted as it gives access to a lot of resources.
abi <abi/3.0>,
include <tunables/global>
@ -164,14 +167,12 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
deny @{sys}/devices/virtual/tty/tty[0-9]/active r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
# To remove the following error:
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
# The irq file is needed to render pages.
@{sys}/devices/pci[0-9]*/**/irq r,
@{sys}/devices/pci[0-9]*/**/usb[0-9]*/**/report_descriptor r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
@{sys}/devices/virtual/**/report_descriptor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
/var/tmp/ r,
/tmp/ r,