felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-01-21 11:56:02 +00:00
parent 05b47adb13
commit 42fc4622ed
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
42 changed files with 154 additions and 94 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/browsers/firefox-glxtest
View file

@ -11,7 +11,7 @@ include <tunables/global>
@{config_dirs} = @{HOME}/.mozilla/
@{exec_path} = @{lib_dirs}/glxtest
profile firefox-glxtest @{exec_path} {
profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/graphics>
include <abstractions/nameservice-strict>

2
apparmor.d/groups/browsers/firefox-vaapitest
View file

@ -11,7 +11,7 @@ include <tunables/global>
@{config_dirs} = @{HOME}/.mozilla/
@{exec_path} = @{lib_dirs}/vaapitest
profile firefox-vaapitest @{exec_path} {
profile firefox-vaapitest @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/graphics>

2
apparmor.d/groups/freedesktop/polkitd
View file

@ -64,6 +64,8 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
# Silencer
deny /.cache/ rw,

2
apparmor.d/groups/freedesktop/update-desktop-database
View file

@ -37,6 +37,8 @@ profile update-desktop-database @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/.mimeinfo.cache.* rw,
owner @{user_share_dirs}/{,**/} r,
owner @{user_share_dirs}/**.desktop r,
owner @{user_share_dirs}/applications/.mimeinfo.cache.* rw,
owner @{user_share_dirs}/applications/mimeinfo.cache w,
owner @{user_share_dirs}/mimeinfo.cache w,
# Inherit silencer

3
apparmor.d/groups/freedesktop/xdg-icon-resource
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -7,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/xdg-icon-resource
profile xdg-icon-resource @{exec_path} flags=(complain) {
profile xdg-icon-resource @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>

2
apparmor.d/groups/freedesktop/xdg-user-dir
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/xdg-user-dir
profile xdg-user-dir @{exec_path} {
profile xdg-user-dir @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,

1
apparmor.d/groups/gnome/epiphany-search-provider
View file

@ -36,6 +36,7 @@ profile epiphany-search-provider @{exec_path} {
owner /tmp/Serialized* rw,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.Epiphany.SearchProvider.slice/*/memory.* r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
@{PROC}/driver/nvidia/params r,

3
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -60,12 +60,13 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
@{exec_path} mrix,
@{bin}/gnome-keyring-daemon rPx,
@{bin}/unix_chkpwd rPx,
@{etc_ro}/X11/xdm/Xstartup rPUx,
@{lib}/{,gdm/}gdm-wayland-session rPx,
@{lib}/{,gdm/}gdm-x-session rPx,
/etc/gdm{3,}/{Pre,Post}Session/Default rix,
/etc/gdm{3,}/PostLogin/Default rix,
/etc/gdm{3,}/PrimeOff/Default rix,
@{etc_ro}/X11/xdm/Xstartup rPUx,
/usr/share/gdm/gdm.schemas r,
/usr/share/wayland-sessions/*.desktop r,

1
apparmor.d/groups/gnome/gjs-console
View file

@ -72,6 +72,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/gstreamer-1.0/ rw,
owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r,

3
apparmor.d/groups/gnome/gnome-contacts-search-provider
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gnome-contacts-search-provider
profile gnome-contacts-search-provider @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/dconf-write>
include <abstractions/gnome-strict>
include <abstractions/graphics>
@ -16,6 +17,8 @@ profile gnome-contacts-search-provider @{exec_path} {
signal (send) set=(term) peer=unconfined,
# dbus own bus=session name=org.gnome.Contacts.SearchProvider
@{exec_path} mr,
owner @{user_share_dirs}/folks/{,**/} rw,

1
apparmor.d/groups/gnome/gnome-control-center
View file

@ -145,6 +145,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/loginuid r,
owner @{PROC}/@{pid}/maps r,
owner @{PROC}/@{pid}/mountinfo r,

1
apparmor.d/groups/gnome/gnome-control-center-goa-helper
View file

@ -44,6 +44,7 @@ profile gnome-control-center-goa-helper @{exec_path} {
@{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKitNetworkProcess rix,
/usr/share/cracklib/* r,
/usr/share/publicsuffix/public_suffix_list.dafsa r,
/var/lib/flatpak/exports/share/icons/{,**} r,

1
apparmor.d/groups/gnome/gnome-shell
View file

@ -373,6 +373,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/task/@{pid}/cmdline r,

1
apparmor.d/groups/gnome/org.gnome.NautilusPreviewer
View file

@ -38,6 +38,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/a*org.gnome.NautilusPreviewer.slice/*/memory.* r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
@{PROC}/@{pid}/cgroup r,

5
apparmor.d/groups/gvfs/gvfsd-smb-browse
View file

@ -39,8 +39,9 @@ profile gvfsd-smb-browse @{exec_path} {
/etc/samba/* r,
/var/cache/samba/ rw,
/var/lib/samba/** rwk,
/var/cache/samba/ rw,
/var/lib/samba/** rwk,
owner /var/cache/samba/gencache.tdb w,
owner @{run}/samba/ rw,
owner @{run}/samba/gencache.tdb rwk,

5
apparmor.d/groups/pacman/pacman
View file

@ -77,6 +77,7 @@ profile pacman @{exec_path} {
@{bin}/grep rix,
@{bin}/groupadd rPx,
@{bin}/gtk-query-immodules-{2,3}.0 rPx,
@{bin}/gtk{,4}-update-icon-cache rPx,
@{bin}/head rix,
@{bin}/install-catalog rPx,
@{bin}/install-info rPx,
@ -86,6 +87,7 @@ profile pacman @{exec_path} {
@{bin}/ldconfig rix,
@{bin}/ln rix,
@{bin}/locale-gen rPx,
@{bin}/mkdir rix,
@{bin}/mkinitcpio rPx,
@{bin}/needrestart rPx,
@{bin}/pacdiff rPx,
@ -93,14 +95,13 @@ profile pacman @{exec_path} {
@{bin}/perl rix,
@{bin}/pkgfile rPUx,
@{bin}/pkill rix,
@{bin}/mkdir rix,
@{bin}/setfacl rix,
@{bin}/pwd rix,
@{bin}/rm rix,
@{bin}/rsync rix,
@{bin}/sbctl rPx,
@{bin}/sed rix,
@{bin}/setcap rix,
@{bin}/setfacl rix,
@{bin}/sync rix,
@{bin}/sysctl rPx,
@{bin}/systemctl rPx -> child-systemctl,

3
apparmor.d/groups/pacman/pacman-hook-dkms
View file

@ -7,8 +7,9 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dkms
profile pacman-hook-dkms @{exec_path} {
profile pacman-hook-dkms @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability mknod,

28
apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gtk4-querymodules
profile pacman-hook-gtk4-querymodules @{exec_path} {
include <abstractions/base>
capability dac_read_search,
@{exec_path} mr,
@{bin}/{,ba,da}sh r,
@{bin}/rmdir rix,
@{bin}/gio-querymodules rPx,
@{lib}/gtk-4.0/*/*/ w,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-gtk4-querymodules>
}

2
apparmor.d/groups/pacman/pacman-hook-mkinitcpio
View file

@ -14,8 +14,6 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) {
capability dac_read_search,
capability mknod,
audit deny unix (receive) type=stream,
@{exec_path} mr,
@{bin}/bash rix,

4
apparmor.d/groups/pacman/pacman-key
View file

@ -33,8 +33,8 @@ profile pacman-key @{exec_path} {
/usr/share/pacman/keyrings/{,*} r,
/usr/share/terminfo/** r,
/etc/pacman.d/gnupg/gpg.conf r,
/etc/pacman.d/gnupg/* rw,
/dev/tty rw,
profile gpg {

1
apparmor.d/groups/ssh/sshd
View file

@ -66,6 +66,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
@{bin}/false rix,
@{bin}/nologin rPx,
@{bin}/passwd rPx,
@{bin}/unix_chkpwd rPx,
@{lib}/openssh/sftp-server rPx,
@{etc_ro}/environment r,

4
apparmor.d/groups/systemd/busctl
View file

@ -10,6 +10,10 @@ include <tunables/global>
profile busctl @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/systemd-common>
capability net_admin,
capability sys_ptrace,
ptrace (read),

2
apparmor.d/groups/systemd/systemd-generator-environment-flatpak
View file

@ -15,6 +15,8 @@ profile systemd-generator-environment-flatpak @{exec_path} {
@{bin}/flatpak rix,
/usr/{local/,}share/gvfs/remote-volume-monitors/{,*} r,
/dev/tty rw,
include if exists <local/systemd-generator-environment-flatpak>

1
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -23,6 +23,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
@{etc_rw}/.#hostname* rw,
@{etc_rw}/hostname rw,
/etc/.#machine-info@{rand6} rw,
/etc/machine-id r,
/etc/machine-info rw,
@{run}/systemd/default-hostname rw,

1
apparmor.d/groups/systemd/systemd-journald
View file

@ -55,6 +55,7 @@ profile systemd-journald @{exec_path} {
@{run}/udev/data/+usb:* r,
@{run}/udev/data/+virtio:* r,
@{run}/udev/data/b254:@{int} r, # for /dev/zram*
@{run}/udev/data/b259:@{int} r,
@{run}/udev/data/c1:@{int} r, # For RAM disk
@{run}/udev/data/c4:@{int} r, # For TTY devices
@{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features

1
apparmor.d/groups/systemd/systemd-vconsole-setup
View file

@ -34,6 +34,7 @@ profile systemd-vconsole-setup @{exec_path} {
@{sys}/module/vt/parameters/default_utf8 w,
/dev/console k,
/dev/tty@{int} rwk,
include if exists <local/systemd-vconsole-setup>