felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

xfce, updates

Browse source
This commit is contained in:
nobody43 2025-01-22 22:50:59 +00:00
parent 0b3c49d26a
commit 4286b5330c
44 changed files with 190 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

7
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -30,6 +30,9 @@ profile dpkg-preconfigure @{exec_path} {
@{bin}/sort rix,
@{bin}/stty rix,
@{bin}/tr rix,
@{bin}/head rix,
@{bin}/readlink rix,
@{bin}/realpath rix,
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/apt-extracttemplates rPx,
@ -37,11 +40,14 @@ profile dpkg-preconfigure @{exec_path} {
@{lib}/apt/apt-extracttemplates rPx,
/usr/share/debconf/confmodule r,
/usr/share/dictionaries-common/{,*} r,
/etc/cloud/cloud.cfg.d/90_dpkg.cfg r,
/etc/debconf.conf r,
/etc/default/grub r,
/etc/inputrc r,
/etc/shadow r,
/etc/X11/Xwrapper.config r,
owner @{tmp}/*.template.* rw,
owner @{tmp}/*.config.* rwPUx,
@ -54,6 +60,7 @@ profile dpkg-preconfigure @{exec_path} {
owner /var/cache/debconf/tmp.ci/*.config.@{rand6} w,
owner /var/cache/debconf/tmp.ci/*.passwords.@{rand6} w,
owner /var/cache/debconf/tmp.ci/*.template.@{rand6} w,
owner /var/cache/dictionaries-common/flag-wordlist-new w,
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
@{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,

1
apparmor.d/groups/children/child-dpkg-divert
View file

@ -22,6 +22,7 @@ profile child-dpkg-divert {
/var/lib/dpkg/arch r,
/var/lib/dpkg/status r,
/var/lib/dpkg/updates/ r,
/var/lib/dpkg/updates/@{int} r,
/var/lib/dpkg/triggers/File r,
/var/lib/dpkg/triggers/Unincorp r,
/var/lib/dpkg/diversions r,

11
apparmor.d/groups/display-manager/lightdm
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/lightdm
profile lightdm @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/authentication>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
@ -36,6 +37,10 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term) peer=xfce-session,
signal (send) set=(term) peer=xorg,
unix (bind) type=stream addr="@@{hex}/bus/lightdm/system",
dbus (bind) bus=system name=org.freedesktop.DisplayManager,
@{exec_path} mrix,
@{bin}/rm rix,
@ -45,6 +50,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
@{bin}/Xorg rPx,
@{bin}/plymouth rPx,
@{bin}/gnome-keyring-daemon rPx,
@{bin}/lightdm-session rPx,
@{lib}/security-misc/* rPx, #aa:only whonix
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
@ -52,6 +58,10 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
/etc/lightdm/Xsession rPx,
/etc/X11/Xsession rPx,
@{sh_path} rix,
@{bin}/{,e,f}grep rix,
@{bin}/df rix,
/usr/share/lightdm/{,**} r,
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xgreeters/{,**} r,
@ -81,6 +91,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid rw,
owner @{PROC}/@{pid}/uid_map r,
owner @{PROC}/@{pid}/mountinfo r,
/dev/tty@{int} r,

8
apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent
View file

@ -12,11 +12,19 @@ include <tunables/global>
@{exec_path} += @{lib}/polkit-gnome/polkit-gnome-authentication-agent-1
profile polkit-gnome-authentication-agent @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-accessibility>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/dconf-write>
include <abstractions/gnome-strict>
signal (send) set=(term) peer=polkit-agent-helper,
@{exec_path} mr,
@{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
@{PROC}/@{pid}/cgroup r,
include if exists <local/polkit-gnome-authentication-agent>

1
apparmor.d/groups/freedesktop/polkitd
View file

@ -31,6 +31,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/pkla-check-authorization rPUx,
@{bin}/pkla-admin-identities rPx,
/etc/machine-id r,

2
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -36,7 +36,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{bin}/tr rix,
/usr/share/gnome-system-monitor/{,**} r,
/usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
/usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
/ r,

1
apparmor.d/groups/grub/grub-mkconfig
View file

@ -65,6 +65,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
@{lib}/grub/grub-sort-version rPx,
@{lib}/libostree/grub[0-9]-@{int}_ostree rix,
/usr/share/desktop-base/*/grub/* r,
/usr/share/grub/{,**} r,
/usr/share/terminfo/** r,

1
apparmor.d/groups/grub/grub-probe
View file

@ -27,6 +27,7 @@ profile grub-probe @{exec_path} {
/ r,
/boot/ r,
/boot/grub/ r,
/boot/grub/themes/{,**} r,
@{PROC}/@{pids}/mountinfo r,

3
apparmor.d/groups/gvfs/gvfsd-computer
View file

@ -10,6 +10,9 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-computer
profile gvfsd-computer @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
dbus (bind) bus=session name=org.gtk.vfs.mountpoint_@{int},
@{exec_path} mr,

3
apparmor.d/groups/gvfs/gvfsd-wsdd
View file

@ -9,9 +9,12 @@ include <tunables/global>
@{exec_path} = @{lib}/{,gvfs/}gvfsd-wsdd
profile gvfsd-wsdd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
network netlink raw,
dbus (bind) bus=session name=org.gtk.vfs.mountpoint_wsdd,
@{exec_path} mr,
@{bin}/env r,

1
apparmor.d/groups/network/NetworkManager
View file

@ -105,6 +105,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
/etc/ r,
/etc/iproute2/* r,
/etc/machine-id r,
/etc/netplan/90-NM-@{uuid}.yaml w,
/etc/network/interfaces r,
/etc/network/interfaces.d/{,*} r,
/etc/NetworkManager/{,**} r,

1
apparmor.d/groups/network/wg
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/wg
profile wg @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability net_admin,
capability net_bind_service,

1
apparmor.d/groups/network/wg-quick
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/wg-quick
profile wg-quick @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability dac_read_search,
capability net_admin,

4
apparmor.d/groups/systemd/systemd-hwdb
View file

@ -16,10 +16,10 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{exec_path} mr,
@{lib}/udev/#@{int} rwl,
@{lib}/udev/.#hwdb.bin@{hex16} wl -> @{lib}/udev/#@{int},
@{lib}/udev/.#hwdb.bin{@{hex16},@{rand6}} wl -> @{lib}/udev/#@{int},
@{lib}/udev/hwdb.bin w,
/etc/udev/.#hwdb.bin@{hex16} wl -> /etc/udev/#@{int},
/etc/udev/.#hwdb.bin{@{hex16},@{rand6}} wl -> /etc/udev/#@{int},
/etc/udev/hwdb.bin w,
/etc/udev/hwdb.d/{,*} r,

2
apparmor.d/groups/systemd/systemd-udevd
View file

@ -79,7 +79,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
/etc/nfs.conf rk,
/etc/udev/{,**} r,
/etc/udev/.#hwdb.bin* rw,
/etc/udev/.#hwdb.bin{@{hex16},@{rand6}} rw,
/etc/udev/hwdb.bin rw,
/etc/modprobe.d/ r,

4
apparmor.d/groups/xfce/startxfce
View file

@ -19,6 +19,7 @@ profile startxfce @{exec_path} {
@{bin}/mkdir rix,
@{bin}/id rix,
@{bin}/xdg-user-dirs-update rPx,
@{bin}/xfce4-session rPx,
@{bin}/xrdb rPx,
@{bin}/systemctl rCx -> systemctl,
@ -27,6 +28,8 @@ profile startxfce @{exec_path} {
/etc/X11/xinit/xinitrc.d/{,**} r,
/etc/xdg/xfce4/{,**} r,
owner @{HOME}/.Xdefaults r,
profile systemctl flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/systemctl>
@ -36,6 +39,7 @@ profile startxfce @{exec_path} {
profile dbus {
include <abstractions/base>
include <abstractions/bus-session>
@{bin}/dbus-update-activation-environment mr,

9
apparmor.d/groups/xfce/thunar
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/thunar
profile thunar @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/deny-sensitive-home>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
@ -17,6 +19,10 @@ profile thunar @{exec_path} {
network netlink raw,
dbus (bind) bus=session name=org.xfce.Thunar,
dbus (bind) bus=session name=org.xfce.FileManager,
dbus (bind) bus=session name=org.freedesktop.FileManager1,
@{exec_path} mr,
@{bin}/thunar-volman rPx,
@ -30,6 +36,7 @@ profile thunar @{exec_path} {
/etc/fstab r,
/etc/timezone r,
/etc/xdg/{,xdg-xubuntu/}Thunar/{,**} r,
# Full access to user's data
/ r,
@ -50,6 +57,8 @@ profile thunar @{exec_path} {
deny /tmp/.* rw,
deny /tmp/.*/{,**} rw,
@{run}/mount/utab r,
owner @{PROC}/@{pid}/mountinfo r,
profile dbus {

2
apparmor.d/groups/xfce/thunar-volman
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/thunar-volman
profile thunar-volman @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/nameservice-strict>
include <abstractions/xfce>

15
apparmor.d/groups/xfce/tumblerd
View file

@ -9,18 +9,33 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}tumbler-1/tumblerd
profile tumblerd @{exec_path} {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>
include <abstractions/desktop>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/desktop>
include <abstractions/bus-session>
include <abstractions/gstreamer>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-write>
dbus (bind) bus=session name=org.freedesktop.thumbnails.Cache1,
dbus (bind) bus=session name=org.freedesktop.thumbnails.Manager1,
dbus (bind) bus=session name=org.freedesktop.thumbnails.Thumbnailer1,
@{exec_path} mr,
@{bin}/gdk-pixbuf-thumbnailer rPx,
/usr/share/backgrounds/xfce/{,**} r,
/usr/share/thumbnailers/{,**} r,
/etc/fstab r,
/etc/xdg/tumbler/* r,
owner /tmp/tumbler-@{rand6}.png r,
owner /tmp/tumbler-@{rand6}.??? w,
owner @{PROC}/@{pid}/mountinfo r,
/dev/ r,

4
apparmor.d/groups/xfce/xfce-clipman-settings
View file

@ -9,8 +9,12 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-clipman-settings
profile xfce-clipman-settings @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.clipman.settings,
@{exec_path} mr,
@{open_path} rPx -> child-open-help,

5
apparmor.d/groups/xfce/xfce-notifyd
View file

@ -10,6 +10,8 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}xfce4/notifyd/xfce4-notifyd
profile xfce-notifyd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
@ -22,6 +24,9 @@ profile xfce-notifyd @{exec_path} {
network inet6 stream,
network netlink raw,
dbus (bind) bus=session name=org.xfce.Notifyd,
dbus (bind) bus=session name=org.freedesktop.Notifications,
@{exec_path} mr,
owner @{user_cache_dirs}/xfce4/notifyd/ rw,

18
apparmor.d/groups/xfce/xfce-panel
View file

@ -9,12 +9,22 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-panel @{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0
profile xfce-panel @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-system>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/thumbnails-cache-read>
include <abstractions/app-launcher-user>
include <abstractions/audio-client>
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>
include <abstractions/xfce>
ptrace (read) peer=xfce-terminal,
dbus (bind) bus=session name=org.xfce.Panel,
dbus (bind) bus=session name=org.kde.StatusNotifierWatcher,
@{exec_path} mr,
@{bin}/exo-open rix,
@ -26,6 +36,7 @@ profile xfce-panel @{exec_path} {
@{bin}/sudo rCx -> root,
/usr/share/desktop-directories/{,**} r,
/usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
/usr/share/livecheck/** r,
/usr/share/xfce4/{,**} r,
@ -33,15 +44,20 @@ profile xfce-panel @{exec_path} {
/etc/machine-id r,
/etc/timezone r,
/etc/xdg/menus/{,**} r,
/etc/xdg/xfce4/{,**} r,
/etc/xdg/{,xdg-xubuntu/}xfce4/{,**} r,
owner @{user_cache_dirs}/xfce4/notifyd/icons/ rw,
owner @{user_cache_dirs}/xfce4-indicator-plugin.log w,
owner @{user_config_dirs}/xfce4/panel/{,**} rw,
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} w,
@{PROC}/cmdline r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mountinfo r,
deny @{user_share_dirs}/gvfs-metadata/{,*} r,
profile root {
include <abstractions/base>
include <abstractions/app/sudo>

7
apparmor.d/groups/xfce/xfce-power-manager
View file

@ -9,9 +9,16 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-power-manager
profile xfce-power-manager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/xfce>
include <abstractions/nameservice-strict>
dbus (bind) bus=session name=org.xfce.PowerManager,
dbus (bind) bus=session name=org.freedesktop.PowerManagement,
@{exec_path} mr,
@{bin}/xfpm-power-backlight-helper rPx,

4
apparmor.d/groups/xfce/xfce-screensaver
View file

@ -9,11 +9,15 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-screensaver
profile xfce-screensaver @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/authentication>
include <abstractions/graphics>
include <abstractions/xfce>
include <abstractions/nameservice-strict>
dbus (bind) bus=session name=org.xfce.ScreenSaver,
@{exec_path} mr,
@{sh_path} rix,

11
apparmor.d/groups/xfce/xfce-session
View file

@ -9,6 +9,10 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-session
profile xfce-session @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/bus-session>
include <abstractions/bus-accessibility>
include <abstractions/fontconfig-cache-read>
include <abstractions/app-launcher-user>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
@ -16,6 +20,8 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term) peer=lightdm,
dbus (bind) bus=session name=org.xfce.SessionManager,
@{exec_path} mr,
@{sh_path} rix,
@ -33,6 +39,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
@{lib}/msgcollector/msgdispatcher_xdg_autostart rPx,
@{lib}/sdwdate-gui/start-maybe rPx,
@{lib}/setup-wizard-dist/setup-dist_check_for_start rPx,
@{lib}/xapps/sn-watcher/xapp-sn-watcher rPUx,
/usr/share/kde-power-savings-disable-in-vms/{,**} r,
/usr/share/kde-screen-locker-disable-in-vms/{,**} r,
@ -48,11 +55,15 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
/etc/xdg/autostart/*.desktop r,
owner @{user_cache_dirs}/sessions/{,**} rw,
owner @{user_config_dirs}/autostart/ r,
owner @{user_config_dirs}/autostart/*.desktop r,
owner @{tmp}/.xfsm-ICE-@{rand6} rw,
owner @{PROC}/@{pid}/stat r,
@{sys}/class/i2c-adapter/ r,
/dev/tty rw,
profile systemctl flags=(attach_disconnected) {

11
apparmor.d/groups/xfce/xfce-terminal
View file

@ -9,6 +9,9 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-terminal
profile xfce-terminal @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/audio-client>
include <abstractions/consoles>
include <abstractions/dconf-write>
@ -16,6 +19,10 @@ profile xfce-terminal @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/xfce>
signal (send),
dbus (bind) bus=session name=org.xfce.Terminal5,
@{exec_path} mr,
@{open_path} rPx -> child-open-help,
@ -28,7 +35,10 @@ profile xfce-terminal @{exec_path} {
@{bin}/micro rPUx,
@{bin}/nvtop rPx,
@{bin}/vim{,.basic} rPUx,
/usr/share/ r,
/usr/share/desktop-base/profiles/xdg-config/ r,
/usr/share/xfce4/ r,
/usr/share/xfce4/terminal/{,**} r,
@ -36,6 +46,7 @@ profile xfce-terminal @{exec_path} {
/etc/xdg/ r,
/etc/xdg/xfce4/ r,
owner @{user_config_dirs}/xfce4/ r,
owner @{user_config_dirs}/xfce4/terminal/{,**} r,
owner @{tmp}/#@{int} rw,

5
apparmor.d/groups/xfce/xfconfd
View file

@ -10,11 +10,14 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}xfce4/xfconf/xfconfd
profile xfconfd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.Xfconf,
@{exec_path} mr,
/etc/xdg/xfce4/xfconf/** r,
/etc/xdg/{,xdg-xubuntu/}xfce4/xfconf/** r,
owner @{HOME}/ r,

10
apparmor.d/groups/xfce/xfdesktop
View file

@ -9,15 +9,25 @@ include <tunables/global>
@{exec_path} = @{bin}/xfdesktop
profile xfdesktop @{exec_path} {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/app-launcher-user>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.xfdesktop,
@{exec_path} mr,
@{bin}/xfce4-mime-helper rix,
/etc/xdg/{,xdg-xubuntu/}xfce4/helpers.rc r,
/etc/xdg/menus/{,*.menu} r,
/usr/share/xfce4/helpers/{,*.desktop} r,
/usr/share/desktop-directories/{,*.directory} r,
/usr/share/backgrounds/xfce/{,**} r,
/etc/fstab r,

6
apparmor.d/groups/xfce/xfsettingsd
View file

@ -10,8 +10,14 @@ include <tunables/global>
profile xfsettingsd @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/fontconfig-cache-read>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.SettingsDaemon,
@{exec_path} mr,
/etc/xdg/autostart/xfsettingsd.desktop r,

2
apparmor.d/groups/xfce/xfwm
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/xfwm4
profile xfwm @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/audio-client>
include <abstractions/fontconfig-cache-write>
include <abstractions/graphics>