felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2021-08-14 12:59:24 +01:00
parent 86215013d3
commit 33f99711a2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
21 changed files with 103 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/browsers/firefox-crashreporter
View file

@ -11,7 +11,7 @@ include <tunables/global>
@{MOZ_CACHEDIR} = @{user_cache_dirs}/mozilla
@{exec_path} = @{MOZ_LIBDIR}/crashreporter
profile firefox-crashreporter @{exec_path} {
profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/wayland>
include <abstractions/nameservice>
@ -65,6 +65,7 @@ profile firefox-crashreporter @{exec_path} {
owner @{MOZ_HOMEDIR}/firefox/*.*/.parentlock rw,
owner @{HOME}/.xsession-errors w,
/dev/dri/renderD128 rw,
/dev/dri/card[0-9]* rw,
include if exists <local/firefox-crashreporter>
}

2
apparmor.d/groups/desktop/at-spi2-registryd
View file

@ -16,7 +16,7 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
# Needed?
deny capability sys_nice,
signal (receive) set=term peer=gdm,
signal (receive) set=(term hup) peer=gdm*,
@{exec_path} mr,

1
apparmor.d/groups/desktop/dconf-service
View file

@ -27,6 +27,7 @@ profile dconf-service @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/dconf/ rw,
owner @{user_cache_dirs}/dconf/user rw,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm/.config/dconf/user.* rw,
@{PROC}/cmdline r,

2
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -25,7 +25,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
capability sys_tty_config,
signal (receive) set=term peer=gdm,
signal (send) set=hup peer=at-spi-bus-launcher,
signal (send) set=hup peer=at-spi*,
signal (send) set=hup peer=dbus-daemon,
signal (send) set=hup peer=gjs-console,
signal (send) set=hup peer=gnome-*,

2
apparmor.d/groups/gnome/gjs-console
View file

@ -19,7 +19,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
network netlink raw,
signal (receive) set=term peer=gdm,
signal (receive) set=(term hup) peer=gdm*,
@{exec_path} mr,
/{usr/,}bin/ r,

3
apparmor.d/groups/gnome/gnome-control-center
View file

@ -52,6 +52,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{HOME}/.cat_installer/ca.pem r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_cache_dirs}/gnome-control-center/{,**} rw,
owner @{user_cache_dirs}/mesa_shader_cache/index rw,
@ -69,6 +70,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
owner @{run}/user/@{uid}/webkitgtk/{,**} rw,
@{run}/systemd/users/@{uid} r,
@{run}/systemd/sessions/ r,
@ -77,6 +79,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+pci* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c235:[0-9]* r,
@{run}/udev/data/n[0-9]* r,
@{sys}/bus/ r,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -70,7 +70,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/.goutputstream{,*} rw,
owner @{user_config_dirs}/ibus/* r,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_config_dirs}/monitors.xml rw,
owner @{user_config_dirs}/monitors.xml{,~} rwl,
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_share_dirs}/backgrounds/{,**} rw,

4
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -23,12 +23,14 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
/etc/machine-id r,
/var/lib/dbus/machine-id r,
/usr/share/sounds/freedesktop/stereo/*.oga r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icons/{,**} r,
/usr/share/mime/mime.cache r,
/usr/share/sounds/freedesktop/stereo/*.oga r,
/usr/share/X11/xkb/** r,
owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/event-sound-cache.tdb.* rwk,
owner @{user_share_dirs}/recently-used.xbel{,.*} rw,

3
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -23,7 +23,8 @@ profile gsd-xsettings @{exec_path} {
network netlink raw,
@{exec_path} mr,
/{usr/,}bin/xrdb rPx,
/{usr/,}bin/xrdb rPx,
/{usr/,}bin/pactl rPx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,

10
apparmor.d/groups/gnome/tracker-extract
View file

@ -16,11 +16,12 @@ profile tracker-extract @{exec_path} {
@{exec_path} mr,
/usr/share/tracker3/{,**} r,
/usr/share/tracker3-miners/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/applications/*.desktop r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/mime/mime.cache r,
/usr/share/osinfo/{,**} r,
/usr/share/tracker3-miners/{,**} r,
/usr/share/tracker3/{,**} r,
owner /tmp/tracker-extract-3-files.*/{,*} rw,
owner @{user_cache_dirs}/tracker3/files/{,**} rwk,
@ -37,7 +38,10 @@ profile tracker-extract @{exec_path} {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/udev/data/c235:* r,
@{run}/udev/data/c236:* r,
/dev/video[0-9]* rw,
include if exists <local/tracker-extract>
}

2
apparmor.d/groups/systemd/systemd-detect-virt
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/systemd-detect-virt
profile systemd-detect-virt @{exec_path} {
profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/systemd-common>

5
apparmor.d/groups/systemd/systemd-journald
View file

@ -51,9 +51,10 @@ profile systemd-journald @{exec_path} {
@{run}/udev/data/+scsi:* r,
@{run}/udev/data/+bluetooth:* r,
@{run}/udev/data/+usb-serial:* r,
@{run}/udev/data/+platform:regulatory.[0-9]* r,
@{run}/udev/data/+platform:simple-framebuffer.[0-9]* r,
@{run}/udev/data/+platform:iTCO_wdt r,
@{run}/udev/data/+platform:regulatory.[0-9]* r,
@{run}/udev/data/+platform:rtsx_pci_sdmmc.[0-9]* r,
@{run}/udev/data/+platform:simple-framebuffer.[0-9]* r,
@{sys}/devices/**/uevent r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,

1
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -20,6 +20,7 @@ profile systemd-timesyncd @{exec_path} {
@{exec_path} mr,
/etc/adjtime r,
/etc/systemd/timesyncd.conf r,
owner /var/lib/systemd/timesync/clock rw,