diff --git a/apparmor.d/groups/lxqt/lxqt-config-input b/apparmor.d/groups/lxqt/lxqt-config-input index 0736f18b4..3cc7ea6eb 100644 --- a/apparmor.d/groups/lxqt/lxqt-config-input +++ b/apparmor.d/groups/lxqt/lxqt-config-input @@ -10,13 +10,17 @@ include @{exec_path} = @{bin}/lxqt-config-input profile lxqt-config-input @{exec_path} flags=(complain) { include - include - include - include - include + include + include + include + include include include + include include + include + include + include @{exec_path} mr, @@ -26,37 +30,16 @@ profile lxqt-config-input @{exec_path} flags=(complain) { owner /tmp/@{int} r, - @{run}/udev/data/ r, - @{run}/udev/data/+acpi:* r, - @{run}/udev/data/+bluetooth:* r, - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+pci:* r, - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+scsi:* r, - @{run}/udev/data/+sdio:* r, - @{run}/udev/data/+thunderbolt:* r, - @{run}/udev/data/+usb-serial:* r, - @{run}/udev/data/+usb:* r, - @{run}/udev/data/+virtio:* r, - @{run}/udev/data/b254:@{int} r, # for /dev/zram* - @{run}/udev/data/b259:@{int} r, - @{run}/udev/data/c1:@{int} r, # For RAM disk - @{run}/udev/data/c4:@{int} r, # For TTY devices - @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features - @{run}/udev/data/c108:@{int} r, # For /dev/ppp - @{run}/udev/data/c18[8-9]:@{int} r, # USB devices & USB serial converters - @{run}/udev/data/c203:@{int} r, # CPU CPUID information - @{run}/udev/data/c239:@{int} r, # CPU CPUID information - @{run}/udev/data/c29:@{int} r, # For CD-ROM - @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - - @{sys}/devices/ r, - @{sys}/class/ r, - @{sys}/bus/ r, + # There are hundreds of files to be accessed - Question: better to deny the few not to be accessed?? + @{run}/udev/data/** r, + @{sys}/devices/** r, + @{sys}/class/** r, + @{sys}/bus/** r, + @{sys}/devices/** r, @{PROC}/sys/kernel/random/boot_id r, + /dev/tty rw, include if exists