felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update ubuntu profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-11 23:21:34 +02:00
parent e549863d4a
commit 4317538747
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 22 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/ubuntu/software-properties-dbus
View file

@ -19,11 +19,16 @@ profile software-properties-dbus @{exec_path} {
dbus receive bus=session dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable interface=org.freedesktop.DBus.Introspectable
member=Introspect member=Introspect
peer=(name=:*, label=gnome-shell), peer=(name=@{busname}, label=gnome-shell),
dbus receive bus=system dbus receive bus=system
interface=org.freedesktop.DBus.Introspectable interface=org.freedesktop.DBus.Introspectable
member=Introspect member=Introspect
peer=(name=:*, label=software-properties-gtk), peer=(name=@{busname}, label=software-properties-gtk),
dbus receive bus=system path=/
interface=com.ubuntu.SoftwareProperties
member=Reload
peer=(name=@{busname}, label=software-properties-gtk),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/ubuntu/software-properties-gtk
View file

@ -44,12 +44,10 @@ profile software-properties-gtk @{exec_path} flags=(attach_disconnected) {
/usr/share/pixmaps/ r, /usr/share/pixmaps/ r,
/usr/share/python-apt/{,**} r, /usr/share/python-apt/{,**} r,
/usr/share/software-properties/{,**} r, /usr/share/software-properties/{,**} r,
/usr/share/themes/{,**} r,
/usr/share/ubuntu-drivers-common/detect/{,**} r, /usr/share/ubuntu-drivers-common/detect/{,**} r,
/usr/share/X11/xkb/{,**} r, /usr/share/X11/xkb/{,**} r,
/usr/share/xml/iso-codes/{,**} r, /usr/share/xml/iso-codes/{,**} r,
/usr/share/software-properties/gtkbuilder/* r, /usr/share/software-properties/gtkbuilder/* r,
/usr/share/xkeyboard-config-2/{,**} r,
/etc/apport/blacklist.d/{,*} r, /etc/apport/blacklist.d/{,*} r,
/etc/default/apport r, /etc/default/apport r,

3
apparmor.d/groups/ubuntu/ubuntu-advantage
View file

@ -60,9 +60,10 @@ profile ubuntu-advantage @{exec_path} {
@{run}/ubuntu-advantage/{,**} rw, @{run}/ubuntu-advantage/{,**} rw,
@{PROC}/version_signature r,
@{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/mountinfo r,
@{PROC}/@{pids}/mounts r, @{PROC}/@{pids}/mounts r,
@{PROC}/1/cgroup r,
@{PROC}/version_signature r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
profile systemctl { profile systemctl {

13
apparmor.d/groups/ubuntu/update-notifier
View file

@ -28,6 +28,11 @@ profile update-notifier @{exec_path} {
#aa:dbus talk bus=system name=org.debian.apt label=apt #aa:dbus talk bus=system name=org.debian.apt label=apt
#aa:dbus talk bus=session name=org.ayatana.NotificationItem interface+=org.kde.StatusNotifierItem label=gnome-shell #aa:dbus talk bus=session name=org.ayatana.NotificationItem interface+=org.kde.StatusNotifierItem label=gnome-shell
dbus receive bus=system path=/com/ubuntu/UnattendedUpgrade/Pending
interface=com.ubuntu.UnattendedUpgrade.Pending
member=Finished
peer=(name=@{busname}, label=unattended-upgrade),
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@ -49,6 +54,7 @@ profile update-notifier @{exec_path} {
@{lib}/update-notifier/package-system-locked rPx, @{lib}/update-notifier/package-system-locked rPx,
/usr/share/apport/apport-checkreports rPx, /usr/share/apport/apport-checkreports rPx,
/usr/share/apport/apport-gtk rPx, /usr/share/apport/apport-gtk rPx,
@{open_path} Cx -> open,
@{lib}/@{python_name}/dist-packages/{apt,gi}/**/__pycache__/{,**} rw, @{lib}/@{python_name}/dist-packages/{apt,gi}/**/__pycache__/{,**} rw,
@ -95,6 +101,13 @@ profile update-notifier @{exec_path} {
include if exists <local/update-notifier_systemctl> include if exists <local/update-notifier_systemctl>
} }
profile open {
include <abstractions/base>
include <abstractions/app/open>
include if exists <local/update-notifier_open>
}
include if exists <local/update-notifier> include if exists <local/update-notifier>
} }