felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-05-03 18:16:12 +01:00
parent b636b4b3e9
commit 40abc98201
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
17 changed files with 31 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -48,7 +48,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
unix (bind) type=stream addr=@@{hex}/bus/gdm-session-wor/system,
#aa:dbus talk bus=system name=org.freedesktop.Accounts.User label=accounts-daemon
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager

5
apparmor.d/groups/gnome/gjs-console
View file

@ -39,11 +39,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
member=GetActive
peer=(name=org.gnome.Shell.ScreenShield, label=gnome-shell),
dbus send bus=session path=/org/gnome/Shell
interface=org.freedesktop.DBus.Properties
member=GetAll

2
apparmor.d/groups/gnome/gnome-remote-desktop-daemon
View file

@ -11,6 +11,7 @@ profile gnome-remote-desktop-daemon @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.PolicyKit1>
include <abstractions/dconf-write>
include <abstractions/gnome-strict>
include <abstractions/graphics>
@ -19,6 +20,7 @@ profile gnome-remote-desktop-daemon @{exec_path} {
network inet6 stream,
#aa:dbus own bus=session name=org.gnome.RemoteDesktop.User
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
@{exec_path} mr,

7
apparmor.d/groups/gnome/gnome-shell
View file

@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = @{bin}/gnome-shell
profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio-client>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
@ -20,13 +19,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/bus/org.a11y>
include <abstractions/bus/org.freedesktop.Accounts>
include <abstractions/bus/org.freedesktop.background.Monitor>
include <abstractions/bus/org.freedesktop.ColorManager>
include <abstractions/bus/org.freedesktop.FileManager1>
include <abstractions/bus/org.freedesktop.GeoClue2>
include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore>
include <abstractions/bus/org.freedesktop.locale1>
include <abstractions/bus/org.freedesktop.login1.Session>
include <abstractions/bus/org.freedesktop.login1>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/bus/org.freedesktop.Notifications>
include <abstractions/bus/org.freedesktop.PackageKit>
@ -89,10 +86,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
# Talk with gnome-shell
#aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord
#aa:dbus talk bus=system name=org.freedesktop.login1.Manager label=systemd-logind
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
#aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding
#aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console
#aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary
#aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-*
@ -208,6 +206,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xml/iso-codes/{,**} r,
/ r,
/.flatpak-info r,
/etc/fstab r,
/etc/timezone r,

4
apparmor.d/groups/gnome/gnome-software
View file

@ -29,7 +29,7 @@ profile gnome-software @{exec_path} {
@{exec_path} mr,
@{bin}/baobab rPUx,
@{bin}/bwrap rPUx,
@{bin}/bwrap rPx -> flatpak-app,
@{bin}/fusermount{,3} rCx -> fusermount,
@{bin}/gpg{,2} rCx -> gpg,
@{bin}/gpgconf rCx -> gpg,
@ -61,7 +61,7 @@ profile gnome-software @{exec_path} {
/var/lib/flatpak/appstream/{,**} r,
/var/lib/flatpak/repo/{,**} r,
/var/lib/flatpak/runtime/{,**} r,
/var/lib/PackageKit/offline-update-competed r,
/var/lib/PackageKit/prepared-update r,
/var/lib/swcatalog/icons/**.png r,

2
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -25,7 +25,7 @@ profile gnome-terminal-server @{exec_path} {
ptrace (read) peer=htop,
ptrace (read) peer=unconfined,
#aa:dbus own bus=session name=org.gnome.Terminal
#aa:dbus own bus=session name=org.gnome.Terminal interface=org.gtk.Actions
dbus receive bus=session path=/org/gnome/Terminal/SearchProvider
interface=org.gnome.Shell.SearchProvider2

2
apparmor.d/groups/gnome/mutter-x11-frames
View file

@ -18,7 +18,7 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
include <abstractions/graphics>
include <abstractions/nameservice-strict>
signal (receive) set=(term) peer=gdm,
signal (receive) set=(hup term) peer=gdm{,-session-worker},
@{exec_path} mr,

2
apparmor.d/groups/gvfs/gvfsd-trash
View file

@ -24,7 +24,7 @@ profile gvfsd-trash @{exec_path} {
dbus receive bus=session path=/org/gtk/vfs/Daemon
interface=org.gtk.vfs.Daemon
member=GetConnection
peer=(name=:*, label=gnome-shell),
peer=(name=:*, label="{gnome-shell,nautilus}"),
dbus receive bus=session path=/org/gtk/vfs/mountable
interface=org.gtk.vfs.Mountable

4
apparmor.d/groups/pacman/archlinux-keyring-wkd-sync
View file

@ -20,11 +20,11 @@ profile archlinux-keyring-wkd-sync @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,
@{bin}/bash rix,
@{bin}/dirmngr rix,
@{bin}/gpg{,2} rix,
@{bin}/gpg-agent rix,
@{bin}/gpg{,2} rix,
@{bin}/pacman-conf rix,
/etc/pacman.conf r,