felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): ensure compatibility with userspace tools.

Browse source
This commit is contained in:
Alexandre Pujol 2023-01-27 22:00:10 +00:00
parent 603491a02e
commit 23312c1640
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
23 changed files with 23 additions and 135 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/bus/ibus-portal
View file

@ -20,7 +20,7 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) {
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/freedesktop/xdg-document-portal
View file

@ -36,7 +36,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
member=GetMountPoint
peer=(name=:*, label="{snap,xdg-desktop-portal}"),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/freedesktop/xdg-permission-store
View file

@ -31,7 +31,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
member=Lookup
peer=(name=:*, label="{gnome-shell,xdg-desktop-portal}"),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gjs-console
View file

@ -61,7 +61,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
member={ActiveChanged,WakeUpScreen,GetActive}
peer=(name=:*, label="{gnome-shell,gnome-session-binary,xdg-desktop-portal-*}"),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -123,7 +123,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
member=GetAddress
peer=(name=org.a11y.Bus), # all peer's labels
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

4
apparmor.d/groups/gnome/gnome-shell
View file

@ -229,7 +229,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
member={GetAll,GetResources,Set}
peer=(name=:*, label="{gsd-power,gsd-color,xdg-desktop-portal-*}"),
dbus receive bus=session path={/org/gnome/Shell/Screenshot,/org/gnome/Shell/Introspect,/org/gtk/Notifications,/org/gnome/Mutter/RemoteDesktop,/org/gnome/Mutter/ScreenCast}
dbus receive bus=session path=/org/{gnome/Shell/Screenshot,gnome/Shell/Introspect,gtk/Notifications,gnome/Mutter/RemoteDesktop,gnome/Mutter/ScreenCast}
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:* label=xdg-desktop-portal-*),
@ -334,7 +334,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
member=Introspect
peer=(name=:*), # all paths and peer's labels
dbus receive bus=session path={/,/org,/StatusNotifierWatcher}
dbus receive bus=session path=/{,org,StatusNotifierWatcher}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell), # itself

2
apparmor.d/groups/gnome/goa-daemon
View file

@ -48,7 +48,7 @@ profile goa-daemon @{exec_path} {
member=GetManagedObjects
peer=(name=:*, label="{gvfs-goa-volume-monitor,goa-daemon,goa-identity-service,unconfined}"),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/goa-identity-service
View file

@ -27,7 +27,7 @@ profile goa-identity-service @{exec_path} {
member=GetManagedObjects
peer=(name=:*, label=goa-daemon),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-housekeeping
View file

@ -47,7 +47,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-rfkill
View file

@ -76,7 +76,7 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
member=PropertiesChanged
peer=(name=org.freedesktop.DBus, label=gnome-shell),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-screensaver-proxy
View file

@ -43,7 +43,7 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-sharing
View file

@ -91,7 +91,7 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
member=StopUnit
peer=(name=org.freedesktop.systemd[0-9]*), # all peer's labels
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/tracker-miner
View file

@ -66,7 +66,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
member=Query
peer=(name=:*, label=tracker-extract),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gvfs/gvfs-afc-volume-monitor
View file

@ -22,7 +22,7 @@ profile gvfs-afc-volume-monitor @{exec_path} {
member={List,IsSupported}
peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
dbus receive bus=session path={/,/org/gtk/Private/RemoteVolumeMonitor}
dbus receive bus=session path=/{,org/gtk/Private/RemoteVolumeMonitor}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gvfs/gvfs-goa-volume-monitor
View file

@ -22,7 +22,7 @@ profile gvfs-goa-volume-monitor @{exec_path} {
member={List,IsSupported}
peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
dbus receive bus=session path={/,/org/gtk/Private/RemoteVolumeMonitor}
dbus receive bus=session path=/{,org/gtk/Private/RemoteVolumeMonitor}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor
View file

@ -26,7 +26,7 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} {
member={List,IsSupported}
peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
dbus receive bus=session path={/,/org,/org/gtk/Private/RemoteVolumeMonitor}
dbus receive bus=session path=/{,org/,org/gtk/Private/RemoteVolumeMonitor}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor
View file

@ -25,7 +25,7 @@ profile gvfs-mtp-volume-monitor @{exec_path} {
member={List,IsSupported}
peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
dbus receive bus=session path={/,/org,/org/gtk/Private/RemoteVolumeMonitor}
dbus receive bus=session path=/{,org/,org/gtk/Private/RemoteVolumeMonitor}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -48,7 +48,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
member={List,IsSupported}
peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gvfs/gvfsd
View file

@ -43,7 +43,7 @@ profile gvfsd @{exec_path} {
member=Spawned
peer=(name=:*, label=gvfsd-*),
dbus receive bus=session path={/,/org}
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/network/mullvad-daemon
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/mullvad-daemon
@{exec_path} += "/opt/Mullvad VPN/resources/mullvad-daemon"
@{exec_path} += /opt/Mullvad*/resources/mullvad-daemon
profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>

2
apparmor.d/groups/network/mullvad-gui
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = "/opt/Mullvad VPN/mullvad-gui"
@{exec_path} = /opt/Mullvad*/mullvad-gui
profile mullvad-gui @{exec_path} {
include <abstractions/base>
include <abstractions/chromium-common>