felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

xfce, updates

Browse source
This commit is contained in:
nobody43 2025-01-22 22:50:59 +00:00
parent 0b3c49d26a
commit 4286b5330c
44 changed files with 190 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/xfce/startxfce
View file

@ -19,6 +19,7 @@ profile startxfce @{exec_path} {
@{bin}/mkdir rix,
@{bin}/id rix,
@{bin}/xdg-user-dirs-update rPx,
@{bin}/xfce4-session rPx,
@{bin}/xrdb rPx,
@{bin}/systemctl rCx -> systemctl,
@ -27,6 +28,8 @@ profile startxfce @{exec_path} {
/etc/X11/xinit/xinitrc.d/{,**} r,
/etc/xdg/xfce4/{,**} r,
owner @{HOME}/.Xdefaults r,
profile systemctl flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/systemctl>
@ -36,6 +39,7 @@ profile startxfce @{exec_path} {
profile dbus {
include <abstractions/base>
include <abstractions/bus-session>
@{bin}/dbus-update-activation-environment mr,

9
apparmor.d/groups/xfce/thunar
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/thunar
profile thunar @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/deny-sensitive-home>
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
@ -17,6 +19,10 @@ profile thunar @{exec_path} {
network netlink raw,
dbus (bind) bus=session name=org.xfce.Thunar,
dbus (bind) bus=session name=org.xfce.FileManager,
dbus (bind) bus=session name=org.freedesktop.FileManager1,
@{exec_path} mr,
@{bin}/thunar-volman rPx,
@ -30,6 +36,7 @@ profile thunar @{exec_path} {
/etc/fstab r,
/etc/timezone r,
/etc/xdg/{,xdg-xubuntu/}Thunar/{,**} r,
# Full access to user's data
/ r,
@ -50,6 +57,8 @@ profile thunar @{exec_path} {
deny /tmp/.* rw,
deny /tmp/.*/{,**} rw,
@{run}/mount/utab r,
owner @{PROC}/@{pid}/mountinfo r,
profile dbus {

2
apparmor.d/groups/xfce/thunar-volman
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/thunar-volman
profile thunar-volman @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/nameservice-strict>
include <abstractions/xfce>

15
apparmor.d/groups/xfce/tumblerd
View file

@ -9,18 +9,33 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}tumbler-1/tumblerd
profile tumblerd @{exec_path} {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>
include <abstractions/desktop>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/desktop>
include <abstractions/bus-session>
include <abstractions/gstreamer>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-write>
dbus (bind) bus=session name=org.freedesktop.thumbnails.Cache1,
dbus (bind) bus=session name=org.freedesktop.thumbnails.Manager1,
dbus (bind) bus=session name=org.freedesktop.thumbnails.Thumbnailer1,
@{exec_path} mr,
@{bin}/gdk-pixbuf-thumbnailer rPx,
/usr/share/backgrounds/xfce/{,**} r,
/usr/share/thumbnailers/{,**} r,
/etc/fstab r,
/etc/xdg/tumbler/* r,
owner /tmp/tumbler-@{rand6}.png r,
owner /tmp/tumbler-@{rand6}.??? w,
owner @{PROC}/@{pid}/mountinfo r,
/dev/ r,

4
apparmor.d/groups/xfce/xfce-clipman-settings
View file

@ -9,8 +9,12 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-clipman-settings
profile xfce-clipman-settings @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.clipman.settings,
@{exec_path} mr,
@{open_path} rPx -> child-open-help,

5
apparmor.d/groups/xfce/xfce-notifyd
View file

@ -10,6 +10,8 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}xfce4/notifyd/xfce4-notifyd
profile xfce-notifyd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
@ -22,6 +24,9 @@ profile xfce-notifyd @{exec_path} {
network inet6 stream,
network netlink raw,
dbus (bind) bus=session name=org.xfce.Notifyd,
dbus (bind) bus=session name=org.freedesktop.Notifications,
@{exec_path} mr,
owner @{user_cache_dirs}/xfce4/notifyd/ rw,

18
apparmor.d/groups/xfce/xfce-panel
View file

@ -9,12 +9,22 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-panel @{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0
profile xfce-panel @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-system>
include <abstractions/bus-session>
include <abstractions/fontconfig-cache-read>
include <abstractions/thumbnails-cache-read>
include <abstractions/app-launcher-user>
include <abstractions/audio-client>
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>
include <abstractions/xfce>
ptrace (read) peer=xfce-terminal,
dbus (bind) bus=session name=org.xfce.Panel,
dbus (bind) bus=session name=org.kde.StatusNotifierWatcher,
@{exec_path} mr,
@{bin}/exo-open rix,
@ -26,6 +36,7 @@ profile xfce-panel @{exec_path} {
@{bin}/sudo rCx -> root,
/usr/share/desktop-directories/{,**} r,
/usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
/usr/share/livecheck/** r,
/usr/share/xfce4/{,**} r,
@ -33,15 +44,20 @@ profile xfce-panel @{exec_path} {
/etc/machine-id r,
/etc/timezone r,
/etc/xdg/menus/{,**} r,
/etc/xdg/xfce4/{,**} r,
/etc/xdg/{,xdg-xubuntu/}xfce4/{,**} r,
owner @{user_cache_dirs}/xfce4/notifyd/icons/ rw,
owner @{user_cache_dirs}/xfce4-indicator-plugin.log w,
owner @{user_config_dirs}/xfce4/panel/{,**} rw,
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} w,
@{PROC}/cmdline r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mountinfo r,
deny @{user_share_dirs}/gvfs-metadata/{,*} r,
profile root {
include <abstractions/base>
include <abstractions/app/sudo>

7
apparmor.d/groups/xfce/xfce-power-manager
View file

@ -9,9 +9,16 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-power-manager
profile xfce-power-manager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/xfce>
include <abstractions/nameservice-strict>
dbus (bind) bus=session name=org.xfce.PowerManager,
dbus (bind) bus=session name=org.freedesktop.PowerManagement,
@{exec_path} mr,
@{bin}/xfpm-power-backlight-helper rPx,

4
apparmor.d/groups/xfce/xfce-screensaver
View file

@ -9,11 +9,15 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-screensaver
profile xfce-screensaver @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/authentication>
include <abstractions/graphics>
include <abstractions/xfce>
include <abstractions/nameservice-strict>
dbus (bind) bus=session name=org.xfce.ScreenSaver,
@{exec_path} mr,
@{sh_path} rix,

11
apparmor.d/groups/xfce/xfce-session
View file

@ -9,6 +9,10 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-session
profile xfce-session @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/bus-session>
include <abstractions/bus-accessibility>
include <abstractions/fontconfig-cache-read>
include <abstractions/app-launcher-user>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
@ -16,6 +20,8 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term) peer=lightdm,
dbus (bind) bus=session name=org.xfce.SessionManager,
@{exec_path} mr,
@{sh_path} rix,
@ -33,6 +39,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
@{lib}/msgcollector/msgdispatcher_xdg_autostart rPx,
@{lib}/sdwdate-gui/start-maybe rPx,
@{lib}/setup-wizard-dist/setup-dist_check_for_start rPx,
@{lib}/xapps/sn-watcher/xapp-sn-watcher rPUx,
/usr/share/kde-power-savings-disable-in-vms/{,**} r,
/usr/share/kde-screen-locker-disable-in-vms/{,**} r,
@ -48,11 +55,15 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
/etc/xdg/autostart/*.desktop r,
owner @{user_cache_dirs}/sessions/{,**} rw,
owner @{user_config_dirs}/autostart/ r,
owner @{user_config_dirs}/autostart/*.desktop r,
owner @{tmp}/.xfsm-ICE-@{rand6} rw,
owner @{PROC}/@{pid}/stat r,
@{sys}/class/i2c-adapter/ r,
/dev/tty rw,
profile systemctl flags=(attach_disconnected) {

11
apparmor.d/groups/xfce/xfce-terminal
View file

@ -9,6 +9,9 @@ include <tunables/global>
@{exec_path} = @{bin}/xfce4-terminal
profile xfce-terminal @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/audio-client>
include <abstractions/consoles>
include <abstractions/dconf-write>
@ -16,6 +19,10 @@ profile xfce-terminal @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/xfce>
signal (send),
dbus (bind) bus=session name=org.xfce.Terminal5,
@{exec_path} mr,
@{open_path} rPx -> child-open-help,
@ -28,7 +35,10 @@ profile xfce-terminal @{exec_path} {
@{bin}/micro rPUx,
@{bin}/nvtop rPx,
@{bin}/vim{,.basic} rPUx,
/usr/share/ r,
/usr/share/desktop-base/profiles/xdg-config/ r,
/usr/share/xfce4/ r,
/usr/share/xfce4/terminal/{,**} r,
@ -36,6 +46,7 @@ profile xfce-terminal @{exec_path} {
/etc/xdg/ r,
/etc/xdg/xfce4/ r,
owner @{user_config_dirs}/xfce4/ r,
owner @{user_config_dirs}/xfce4/terminal/{,**} r,
owner @{tmp}/#@{int} rw,

5
apparmor.d/groups/xfce/xfconfd
View file

@ -10,11 +10,14 @@ include <tunables/global>
@{exec_path} = @{lib}/{,@{multiarch}/}xfce4/xfconf/xfconfd
profile xfconfd @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.Xfconf,
@{exec_path} mr,
/etc/xdg/xfce4/xfconf/** r,
/etc/xdg/{,xdg-xubuntu/}xfce4/xfconf/** r,
owner @{HOME}/ r,

10
apparmor.d/groups/xfce/xfdesktop
View file

@ -9,15 +9,25 @@ include <tunables/global>
@{exec_path} = @{bin}/xfdesktop
profile xfdesktop @{exec_path} {
include <abstractions/base>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/app-launcher-user>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.xfdesktop,
@{exec_path} mr,
@{bin}/xfce4-mime-helper rix,
/etc/xdg/{,xdg-xubuntu/}xfce4/helpers.rc r,
/etc/xdg/menus/{,*.menu} r,
/usr/share/xfce4/helpers/{,*.desktop} r,
/usr/share/desktop-directories/{,*.directory} r,
/usr/share/backgrounds/xfce/{,**} r,
/etc/fstab r,

6
apparmor.d/groups/xfce/xfsettingsd
View file

@ -10,8 +10,14 @@ include <tunables/global>
profile xfsettingsd @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/fontconfig-cache-read>
include <abstractions/xfce>
dbus (bind) bus=session name=org.xfce.SettingsDaemon,
@{exec_path} mr,
/etc/xdg/autostart/xfsettingsd.desktop r,

2
apparmor.d/groups/xfce/xfwm
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = @{bin}/xfwm4
profile xfwm @{exec_path} {
include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/audio-client>
include <abstractions/fontconfig-cache-write>
include <abstractions/graphics>