feat(profile): remove now automatically added internal dbus rules.

2025-03-23 13:40:45 +01:00 · 2025-03-23 13:40:45 +01:00 · 41757ec4e4
commit 41757ec4e4
parent 85be9316e1
20 changed files with 7 additions and 100 deletions
--- a/apparmor.d/groups/_full/systemd
+++ b/apparmor.d/groups/_full/systemd
@ -145,10 +145,11 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {

  #aa:dbus own bus=system name=org.freedesktop.systemd1

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member=GetConnectionUnixUser
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
+  # For stacked profiles
+  #aa:dbus own bus=system name=org.freedesktop.network1
+  #aa:dbus own bus=system name=org.freedesktop.oom1
+  #aa:dbus own bus=system name=org.freedesktop.resolve1
+  #aa:dbus own bus=system name=org.freedesktop.timesync1

  @{bin}/**                         Px,
  @{lib}/**                         Px,
--- a/apparmor.d/groups/apt/apt
+++ b/apparmor.d/groups/apt/apt
@ -52,11 +52,6 @@ profile apt @{exec_path} flags=(attach_disconnected) {
       member=StateHasChanged
       peer=(name=org.freedesktop.PackageKit),

-  dbus send bus=system path=/org/freedesktop/DBus/Bus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixProcessID,GetConnectionUnixUser}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  dbus send bus=system
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
--- a/apparmor.d/groups/filesystem/udisksd
+++ b/apparmor.d/groups/filesystem/udisksd
@ -67,11 +67,6 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
  #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
  #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{sh_path}             rix,
--- a/apparmor.d/groups/freedesktop/accounts-daemon
+++ b/apparmor.d/groups/freedesktop/accounts-daemon
@ -25,11 +25,6 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.Accounts

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{bin}/adduser     rPx,
--- a/apparmor.d/groups/freedesktop/colord
+++ b/apparmor.d/groups/freedesktop/colord
@ -22,11 +22,6 @@ profile colord @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.ColorManager

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mrix,

  /etc/machine-id r,
--- a/apparmor.d/groups/freedesktop/geoclue
+++ b/apparmor.d/groups/freedesktop/geoclue
@ -27,11 +27,6 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.GeoClue2

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  /usr/share/glib-2.0/schemas/gschemas.compiled r,
--- a/apparmor.d/groups/freedesktop/pipewire
+++ b/apparmor.d/groups/freedesktop/pipewire
@ -25,11 +25,6 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=session name=org.pulseaudio.Server

-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
-
  dbus receive bus=session
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
--- a/apparmor.d/groups/freedesktop/pipewire-media-session
+++ b/apparmor.d/groups/freedesktop/pipewire-media-session
@ -23,11 +23,6 @@ profile pipewire-media-session @{exec_path} {
  network bluetooth stream,
  network netlink raw,

-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member=GetConnectionUnixProcessID
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
-
  dbus receive bus=session
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
--- a/apparmor.d/groups/freedesktop/xdg-desktop-portal
+++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal
@ -44,11 +44,6 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {

  #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal

-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
-
  dbus receive bus=session
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
--- a/apparmor.d/groups/gnome/gdm
+++ b/apparmor.d/groups/gnome/gdm
@ -37,11 +37,6 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
  #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
  #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixProcessID,GetConnectionUnixUser}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{sh_path}                       rix,
--- a/apparmor.d/groups/gnome/gnome-session-binary
+++ b/apparmor.d/groups/gnome/gnome-session-binary
@ -36,7 +36,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {

  dbus send bus=session path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID,UpdateActivationEnvironment}
+       member=UpdateActivationEnvironment
       peer=(name=org.freedesktop.DBus label="@{p_dbus_session}"),

  dbus send bus=session path=/org/freedesktop/systemd1
--- a/apparmor.d/groups/gnome/gnome-shell
+++ b/apparmor.d/groups/gnome/gnome-shell
@ -111,24 +111,15 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
       member={RegisterWithCapabilities,Unregister}
       peer=(name=:*, label=NetworkManager),

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetNameOwner,ListNames}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  # Session bus

-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetNameOwner,ListNames}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
  dbus send bus=session path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
  dbus send bus=session path=/
       interface=org.freedesktop.DBus
-       member={GetConnectionUnixProcessID,GetNameOwner,ListNames}
+       member={GetNameOwner,ListNames}
       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),

  dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
--- a/apparmor.d/groups/network/NetworkManager
+++ b/apparmor.d/groups/network/NetworkManager
@ -72,11 +72,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
       member=InterfacesAdded
       peer=(name=org.freedesktop.DBus, label=nm-online),

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{sh_path}        rix,
--- a/apparmor.d/groups/polkit/polkitd
+++ b/apparmor.d/groups/polkit/polkitd
@ -23,11 +23,6 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.PolicyKit1

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{bin}/pkla-check-authorization rPUx,
--- a/apparmor.d/groups/systemd/systemd-hostnamed
+++ b/apparmor.d/groups/systemd/systemd-hostnamed
@ -22,11 +22,6 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.hostname1

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member=GetConnectionUnixUser
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{etc_rw}/.#hostname* rw,
--- a/apparmor.d/groups/systemd/systemd-logind
+++ b/apparmor.d/groups/systemd/systemd-logind
@ -41,11 +41,6 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
       member=Introspect
       peer=(label=ksmserver-logout-greeter),

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetConnectionCredentials}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  /etc/machine-id r,
--- a/apparmor.d/groups/systemd/systemd-resolved
+++ b/apparmor.d/groups/systemd/systemd-resolved
@ -31,11 +31,6 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.resolve1

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  /etc/systemd/resolved.conf r,
--- a/apparmor.d/profiles-a-f/fwupd
+++ b/apparmor.d/profiles-a-f/fwupd
@ -40,11 +40,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) {
  #aa:dbus own bus=system name=org.freedesktop.fwupd path=/
  #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{lib}/fwupd/fwupd-detect-cet rix,
--- a/apparmor.d/profiles-m-r/packagekitd
+++ b/apparmor.d/profiles-m-r/packagekitd
@ -40,11 +40,6 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.PackageKit

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  @{bin}/gpg{,2}  rCx -> gpg,
--- a/apparmor.d/profiles-m-r/rtkit-daemon
+++ b/apparmor.d/profiles-m-r/rtkit-daemon
@ -23,11 +23,6 @@ profile rtkit-daemon @{exec_path} flags=(attach_disconnected) {

  #aa:dbus own bus=system name=org.freedesktop.RealtimeKit1

-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
-
  @{exec_path} mr,

  # When applying policies to processes