felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-05-30 21:03:39 +01:00
parent 16f30007e7
commit 3f688be7a0
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
11 changed files with 122 additions and 96 deletions
Download patch file Download diff file Expand all files Collapse all files

84
apparmor.d/profiles-a-f/anyremote
View file

@ -22,31 +22,32 @@ profile anyremote @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/cat rix,
@{bin}/rm rix,
@{bin}/{,e}grep rix,
@{bin}/cut rix,
@{bin}/id rix,
@{bin}/mv rix,
@{bin}/expr rix,
@{bin}/which{,.debianutils} rix,
@{bin}/head rix,
@{bin}/wc rix,
@{bin}/tr rix,
@{bin}/mkdir rix,
@{bin}/tail rix,
@{bin}/{m,g,}awk rix,
@{bin}/sed rix,
@{bin}/md5sum rix,
@{bin}/basename rix,
@{bin}/sleep rix,
@{bin}/cat rix,
@{bin}/curl rix,
@{bin}/cut rix,
@{bin}/expr rix,
@{bin}/find rix,
@{bin}/head rix,
@{bin}/id rix,
@{bin}/md5sum rix,
@{bin}/mkdir rix,
@{bin}/mv rix,
@{bin}/rm rix,
@{bin}/sed rix,
@{bin}/sleep rix,
@{bin}/tail rix,
@{bin}/tr rix,
@{bin}/wc rix,
@{bin}/which{,.debianutils} rix,
@{bin}/convert-im6.q16 rCx -> imagemagic,
@{bin}/killall rCx -> killall,
@{bin}/pgrep rCx -> pgrep,
@{lib}/qt5/bin/qdbus rCx -> qdbus,
@{bin}/curl rCx -> curl,
@{bin}/pacmd rPx,
@{bin}/pactl rPx,
@ -61,34 +62,30 @@ profile anyremote @{exec_path} {
@{bin}/mpv rPx,
@{bin}/strawberry rPx,
owner @{tmp}/amarok_covers/ rw,
owner @{tmp}/*.png rw,
# For shell pwd
owner @{HOME}/ r,
owner @{HOME}/.anyRemote/{,**} rw,
owner @{HOME}/.anyRemote/imdb-mf.sh rix,
/usr/share/anyremote/{,**} r,
/usr/share/anyremote/cfg-data/Utils/*.sh rix,
deny @{PROC}/sys/kernel/osrelease r,
owner @{HOME}/ r,
owner @{HOME}/.Xauthority r,
owner @{HOME}/.anyRemote/{,**} rw,
owner @{HOME}/.anyRemote/imdb-mf.sh rix,
owner @{tmp}/amarok_covers/ rw,
owner @{tmp}/*.png rw,
deny @{PROC}/sys/kernel/osrelease r,
profile imagemagic {
include <abstractions/base>
@{bin}/convert-im6.q16 mr,
/usr/share/anyremote/cfg-data/Icons/common/*.png r,
/usr/share/ImageMagick-[0-9]/*.xml rw,
/etc/ImageMagick-[0-9]/*.xml r,
/usr/share/anyremote/cfg-data/Icons/common/*.png r,
owner @{HOME}/.anyRemote/*.png rw,
owner @{HOME}/.kde/share/apps/amarok/albumcovers/cache/* r,
/tmp/ r,
@ -96,6 +93,7 @@ profile anyremote @{exec_path} {
owner @{tmp}/amarok_covers/* rw,
owner @{tmp}/magick-* rw,
include if exists <local/anyremote_imagemagic>
}
profile killall {
@ -118,40 +116,24 @@ profile anyremote @{exec_path} {
# file_inherit
owner @{HOME}/.anyRemote/anyremote.stdout w,
include if exists <local/anyremote_killall>
}
profile pgrep {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/app/pgrep>
signal (send) set=(term, kill),
@{bin}/pgrep mr,
# The /proc/ dir and the cmdline have to be radable to avoid pgrep segfault.
@{PROC}/ r,
@{PROC}/@{pids}/cmdline r,
deny @{PROC}/sys/kernel/osrelease r,
# file_inherit
owner @{HOME}/.anyRemote/anyremote.stdout w,
include if exists <local/anyremote_pgrep>
}
profile curl {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
@{bin}/curl mr,
}
profile qdbus {
profile qdbus {
include <abstractions/base>
@{lib}/qt5/bin/qdbus mr,
include if exists <local/anyremote_qdbus>
}
include if exists <local/anyremote>