felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(tunable): add the new version variable.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-05 14:05:35 +01:00
parent a93400280e
commit 35dcde9d90
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
13 changed files with 25 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/gnome/gio-launch-desktop
View file

@ -14,7 +14,7 @@ include <tunables/global>
@{exec_path} = @{bin}/gio
@{exec_path} += @{bin}/gio-launch-desktop @{lib}/gio-launch-desktop
@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop
@{exec_path} += @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop
profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-launcher-user>

6
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -59,8 +59,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{lib}/gnome-session-check-accelerated-gles-helper rix,
@{lib}/gnome-session-failed rix,
@{lib}/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
@{lib}/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open,
/usr/share/dconf/profile/gdm r,
/usr/share/gdm/greeter-dconf-defaults r,
@ -112,7 +112,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{bin}/env rix,
@{sh_path} r,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr,
@{lib}/gio-launch-desktop mr,
@{lib}/** PUx,

8
apparmor.d/groups/gnome/gnome-shell
View file

@ -184,9 +184,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{lib}/mutter-x11-frames rPx,
#aa:exec polkit-agent-helper
@{sh_path} rCx -> shell,
@{lib}/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
@{sh_path} rCx -> shell,
@{lib}/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open,
# nm-openvpn-auth-dialog
@{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx,
@ -409,7 +409,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
network inet stream,
network unix stream,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr,
@{lib}/gio-launch-desktop mr,
@{lib}/** PUx,

2
apparmor.d/groups/xfce/xfce-panel
View file

@ -20,7 +20,7 @@ profile xfce-panel @{exec_path} {
@{bin}/exo-open rix,
@{bin}/xfce4-mime-helper rix,
@{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0 rix,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rix,
@{lib}/gio-launch-desktop rix,
@{bin}/sudo rCx -> root,

4
apparmor.d/profiles-a-f/exo-open
View file

@ -19,10 +19,10 @@ profile exo-open @{exec_path} {
@{exec_path} mr,
@{lib}/@{multiarch}/xfce4/exo-[0-9]/exo-helper-[0-9] rPx,
@{lib}/@{multiarch}/xfce4/exo-@{version}/exo-helper-@{version} rPx,
# It looks like gio-launch-desktop decides what app should be opened
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rPx,
owner @{PROC}/@{pid}/fd/ r,

2
apparmor.d/profiles-g-l/gsmartcontrol
View file

@ -63,7 +63,7 @@ profile gsmartcontrol @{exec_path} {
# The Help menu (and links in it) requires access to a web browser. Since gsmartcontrol is run as
# root (even when used sudo or gsmartcontrol-root), the web browser will also be run as root and
# hence this behavior should be blocked.
deny @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rx,
deny @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rx,
profile dbus {

4
apparmor.d/profiles-g-l/gtk-youtube-viewer
View file

@ -40,8 +40,8 @@ profile gtk-youtube-viewer @{exec_path} {
@{lib}/firefox/firefox rPx,
@{bin}/xdg-open rCx -> open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
@{bin}/xdg-open rCx -> open,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open,
owner @{user_config_dirs}/youtube-viewer/{,*} rw,

4
apparmor.d/profiles-g-l/jdownloader
View file

@ -95,7 +95,7 @@ profile jdownloader @{exec_path} {
# To open a web browser for CAPTCHA
@{bin}/xdg-open rCx -> open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open,
profile open {
@ -103,7 +103,7 @@ profile jdownloader @{exec_path} {
include <abstractions/xdg-open>
@{bin}/xdg-open mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,

2
apparmor.d/profiles-m-r/orage
View file

@ -23,7 +23,7 @@ profile orage @{exec_path} {
@{bin}/xdg-open rCx -> open,
@{bin}/exo-open rCx -> open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open,
owner @{user_config_dirs}/orage/ rw,
owner @{user_config_dirs}/orage/* rw,

2
apparmor.d/tunables/multiarch.d/paths
View file

@ -33,7 +33,7 @@
# Open
@{open_path} = @{bin}/exo-open @{bin}/xdg-open @{bin}/gio @{bin}/kde-open
@{open_path} += @{bin}/gio-launch-desktop @{lib}/gio-launch-desktop
@{open_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop
@{open_path} += @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop
# File explorers
@{file_explorers_path} = @{bin}/@{file_explorers_names}

3
apparmor.d/tunables/multiarch.d/system
View file

@ -61,6 +61,9 @@
@{user}=[a-zA-Z_]{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}
@{group}=@{user}
# Semantic version
@{version}=@{int}{.@{int},}{.@{int},}{-@{rand},}
# Shortcut for PCI device
@{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h}
@{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h}