felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): rewrite some dbus rules (3).

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-02 16:05:40 +00:00
parent 92ebab604a
commit 2af165403a
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
26 changed files with 117 additions and 191 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/authentication>
include <abstractions/bus/account-daemon>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
@ -46,18 +47,15 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
interface=org.freedesktop.{DBus.Properties,Accounts*}
member={GetAll,FindUserByName,SetLanguage,Changed,PropertiesChanged},
dbus receive bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts
member=UserAdded
peer=(name=:*, label=accounts-daemon),
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={CreateSession,ReleaseSession},
member=*Session
peer=(name=org.freedesktop.login1, label=systemd-logind),
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User
member=SetLanguage
peer=(name=:*, label=accounts-daemon),
@{exec_path} mrix,

3
apparmor.d/groups/gnome/gjs-console
View file

@ -44,6 +44,9 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
peer=(name=:*), # all members
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
peer=(name=org.freedesktop.DBus),
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.freedesktop.DBus.Properties
peer=(name=:*), # all members

4
apparmor.d/groups/gnome/gnome-extension-ding
View file

@ -75,8 +75,8 @@ profile gnome-extension-ding @{exec_path} {
member=Introspect
peer=(name=:*, label=nautilus),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
dbus send bus={systemd,session} path=/org/freedesktop/DBus
interface=org.freedesktop.DBus{,.Properties}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -11,7 +11,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/bus/upower>
include <abstractions/bus/network-manager>
include <abstractions/bus/polkit>
include <abstractions/bus/vfs>

9
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -23,6 +23,15 @@ profile gnome-terminal-server @{exec_path} {
ptrace (read) peer=unconfined,
dbus bind bus=session name=org.gnome.Terminal,
dbus receive bus=session path=/org/gnome/Terminal{,/**}
interface=org.gnome.Terminal.*
peer=(name=:*),
dbus receive bus=session path=/org/gnome/Terminal{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=unconfined),
dbus receive bus=session path=/org/gnome/Terminal{,/**}
interface=org.gtk.Actions
peer=(name=:*),
@{exec_path} mr,

18
apparmor.d/groups/gnome/goa-daemon
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/goa-daemon
profile goa-daemon @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-network-manager-strict>
include <abstractions/bus/network-manager>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -25,10 +25,10 @@ profile goa-daemon @{exec_path} {
network inet6 dgram,
network netlink raw,
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus bind bus=session name=org.gnome.OnlineAccounts,
dbus receive bus=session path=/org/gnome/OnlineAccounts
interface=org.freedesktop.DBus.ObjectManager
peer=(name=:*),
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
@ -52,14 +52,6 @@ profile goa-daemon @{exec_path} {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gnome/Identity/Manager
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=goa-identity-service),
dbus bind bus=session
name=org.gnome.OnlineAccounts,
@{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r,

1
apparmor.d/groups/gnome/gsd-power
View file

@ -11,6 +11,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bus/atspi>
include <abstractions/bus/upower>
include <abstractions/bus/vfs>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>

6
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-xsettings
profile gsd-xsettings @{exec_path} {
include <abstractions/base>
include <abstractions/bus/account-daemon>
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
@ -38,11 +39,6 @@ profile gsd-xsettings @{exec_path} {
member=GetAll
peer=(name=:*), # many peer's labels
dbus receive bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts
member={UserAdded,UserRemoved}
peer=(name=:*, label=accounts-daemon),
dbus receive bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={ClientAdded,ClientRemoved,SessionRunning}

7
apparmor.d/groups/gnome/tracker-miner
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/tracker-miner-fs-{,control-}3
profile tracker-miner @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus/upower>
include <abstractions/bus/vfs>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -27,15 +28,11 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
dbus (send, receive) bus=session path=/org/freedesktop/Tracker3/**
interface=org.freedesktop.Tracker3.*
peer=(name=:*), # all members
peer=(name="{:*,org.freedesktop.DBus}"), # all members
dbus receive bus=session path=/org/freedesktop/Tracker3/**
interface=org.freedesktop.DBus.{Peer,Properties}
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member={ListMonitorImplementations,ListMountableInfo}