felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): improve gnome startup process.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-18 00:50:59 +00:00
parent 1f3da81d5a
commit 25c2dc3399
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
16 changed files with 189 additions and 98 deletions
Download patch file Download diff file Expand all files Collapse all files

118
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -50,57 +50,22 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/{,z,ba,da}sh rix,
@{bin}/env rix,
@{bin}/gnome-session rix,
@{bin}/grep rix,
@{bin}/gsettings rPx,
@{bin}/gsettings-data-convert rix,
@{bin}/mkdir rix,
@{bin}/session-migration rix,
@{bin}/touch rix,
@{bin}/xdg-user-dirs-gtk-update rix,
@{sh_path} rix,
@{bin}/dbus-daemon rPx -> dbus-session,
@{bin}/env rix,
@{bin}/gnome-session rPx,
@{bin}/gnome-shell rPx,
@{bin}/session-migration rPx,
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx -> dbus-accessibility,
@{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh rix,
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rix,
@{lib}/gnome-session-check-accelerated rix,
@{lib}/gnome-session-check-accelerated-gl-helper rix,
@{lib}/gnome-session-check-accelerated-gles-helper rix,
@{lib}/gnome-session-failed rix,
@{lib}/gsd-* rPx,
@{lib}/gio-launch-desktop rix,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
@{bin}/aa-notify rPx,
@{bin}/baloo_file rPx,
@{bin}/blueman-applet rPx,
@{bin}/firewall-applet rPUx,
@{bin}/gnome-keyring-daemon rPx,
@{bin}/gnome-shell rPx,
@{bin}/gnome-software rPUx,
@{bin}/im-launch rPx,
@{bin}/keepassxc rPx,
@{bin}/parcellite rPUx,
@{bin}/pkcs11-register rPx,
@{bin}/snap rPUx,
@{bin}/snapshot-detect rPUx,
@{bin}/spice-vdagent rPx,
@{bin}/start-pulseaudio-x11 rPx,
@{bin}/ubuntu-report rPx,
@{bin}/update-notifier rPx,
@{bin}/xbrlapi rPx,
@{bin}/xdg-user-dirs-update rPx,
@{lib}/@{multiarch}/libexec/kdeconnectd rPUx,
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
@{lib}/baloo_file rPx,
@{lib}/caribou/caribou rPUx,
@{lib}/deja-dup/deja-dup-monitor rPx,
@{lib}/evolution-data-server/{,evolution-data-server/}evolution-alarm-notify rPx,
@{lib}/gsd-disk-utility-notify rPx,
@{lib}/update-notifier/ubuntu-advantage-notification rPx,
@{lib}/xapps/sn-watcher/* rPUx,
@{thunderbird_path} rPx,
/usr/share/libpam-kwallet-common/pam_kwallet_init rPUx,
@{lib}/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
/usr/share/dconf/profile/gdm r,
/usr/share/gdm/greeter-dconf-defaults r,
@ -112,17 +77,13 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{etc_ro}/xdg/autostart/{,*.desktop} r,
/var/lib/gdm{3,}/.cache/gdm/Xauthority r,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
/var/lib/gdm{3,}/.config/dconf/user rw,
/var/lib/gdm{3,}/.config/gnome-session/ rw,
/var/lib/gdm{3,}/.config/gnome-session/saved-session/ rw,
/var/lib/gdm{3,}/.local/share/applications/{,**} r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/flatpak/exports/share/applications/{,**} r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
owner @{gdm_cache_dirs}/gdm/Xauthority r,
owner @{gdm_cache_dirs}/mesa_shader_cache/index rw,
owner @{gdm_config_dirs}/dconf/user rw,
owner @{gdm_config_dirs}/gnome-session/ rw,
owner @{gdm_config_dirs}/gnome-session/saved-session/ rw,
owner @{GDM_HOME}/greeter-dconf-defaults r,
owner @{gdm_share_dirs}/applications/{,**} r,
owner /tmp/dirs-@{rand6} rw,
@ -136,7 +97,9 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/sessions/*.ref rw,
@{run}/systemd/users/@{uid} r,
owner @{run}/user/@{uid}/gnome-session-leader-fifo rw,
owner @{run}/user/@{uid}/ICEauthority{,-[a-z]} rwl,
owner @{run}/user/@{uid}/ICEauthority rw,
owner @{run}/user/@{uid}/ICEauthority-c w,
owner @{run}/user/@{uid}/ICEauthority-l wl -> @{run}/user/@{uid}/ICEauthority-c,
owner @{run}/user/@{uid}/systemd/notify w,
@{sys}/devices/**/{vendor,device} r,
@ -150,6 +113,47 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/dev/tty rw,
/dev/tty@{int} rw,
profile open {
include <abstractions/base>
@{lib}/gio-launch-desktop mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
@{bin}/aa-notify rPx,
@{bin}/blueman-applet rPx,
@{bin}/firewall-applet rPx,
@{bin}/gnome-keyring-daemon rPx,
@{bin}/gnome-software rPx,
@{bin}/im-launch rPx,
@{bin}/keepassxc rPx,
@{bin}/opensuse-welcome rPx,
@{bin}/parcellite rPUx,
@{bin}/pkcs11-register rPx,
@{bin}/snap rPUx,
@{bin}/snapshot-detect rPUx,
@{bin}/spice-vdagent rPx,
@{bin}/start-pulseaudio-x11 rPx,
@{bin}/ubuntu-report rPx,
@{bin}/update-notifier rPx,
@{bin}/xbrlapi rPx,
@{bin}/xdg-user-dirs-gtk-update rPx,
@{bin}/xdg-user-dirs-update rPx,
@{lib}/@{multiarch}/libexec/kdeconnectd rPUx,
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
@{lib}/baloo_file rPx,
@{lib}/caribou/caribou rPUx,
@{lib}/deja-dup/deja-dup-monitor rPx,
@{lib}/evolution-data-server/{,evolution-data-server/}evolution-alarm-notify rPx,
@{lib}/gsd-disk-utility-notify rPx,
@{lib}/update-notifier/ubuntu-advantage-notification rPx,
@{lib}/xapps/sn-watcher/* rPUx,
@{thunderbird_path} rPx,
/usr/share/libpam-kwallet-common/pam_kwallet_init rPUx,
include if exists <usr/gnome-session-binary_open.d>
include if exists <local/gnome-session-binary_open>
}
include if exists <usr/gnome-session-binary.d>
include if exists <local/gnome-session-binary>