felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Profiles update.

Browse source
This commit is contained in:
Alexandre Pujol 2021-12-12 12:41:50 +00:00
parent 16dddf16dc
commit 44aca3ba51
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
24 changed files with 88 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/browsers/firefox
View file

@ -25,8 +25,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/nvidia>
include <abstractions/opencl-intel>
include <abstractions/opencl-nvidia>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/user-download-strict>
@ -138,6 +138,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/comm r,
deny owner @{PROC}/@{pid}/stat r,
deny owner @{PROC}/@{pids}/cmdline r,
deny owner @{PROC}/@{pids}/environ r,

17
apparmor.d/groups/desktop/xwayland
View file

@ -13,6 +13,8 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/vulkan>
signal (receive) set=(term hup) peer=gdm*,
signal (receive) set=(term hup) peer=gnome-shell,
@ -22,20 +24,19 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/xkbcomp rPx,
/usr/share/glvnd/egl_vendor.d/{,*.json} r,
/usr/share/egl/{,**} r,
/usr/share/X11/xkb/rules/evdev r,
# TMP files
owner /tmp/server-[0-9]*.xkm rwk,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* rw,
@{sys}/bus/pci/devices/ r,
owner @{PROC}/@{pids}/cmdline r,
owner @{PROC}/@{pids}/comm r,
# Display Xserver on a specific TTY
/dev/tty[0-9]* rw,
/dev/tty rw,
# Needed for Mutter
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* rw,
owner @{PROC}/@{pids}/cmdline r,
include if exists <local/xwayland>
}

1
apparmor.d/groups/gnome/evolution-alarm-notify
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/evolution-data-server/evolution-alarm-notify
profile evolution-alarm-notify @{exec_path} {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>
include <abstractions/gnome>
include <abstractions/nameservice-strict>
include <abstractions/openssl>

3
apparmor.d/groups/gnome/gdm
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/gdm
profile gdm @{exec_path} {
profile gdm @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/wutmp>
include <abstractions/nameservice-strict>
@ -36,6 +36,7 @@ profile gdm @{exec_path} {
/var/{lib,log}/gdm/ rw,
@{run}/gdm/ rw,
@{run}/gdm/custom.conf r,
@{run}/gdm/gdm.pid rw,
@{run}/gdm/greeter/ rw,
@{run}/systemd/seats/seat[0-9]* r,

1
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -55,6 +55,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
/usr/share/wayland-sessions/*.desktop r,
@{run}/faillock/[a-zA-z0-9]* rwk,
@{run}/gdm/custom.conf r,
@{run}/systemd/sessions/[0-9]*.ref rw,
@{run}/systemd/users/@{uid} r,
@{run}/utmp rwk,

2
apparmor.d/groups/gnome/gdm-wayland-session
View file

@ -39,6 +39,8 @@ profile gdm-wayland-session @{exec_path} {
/usr/share/gdm/gdm.schemas r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
@{run}/gdm/custom.conf r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid r,

7
apparmor.d/groups/gnome/gdm-x-session
View file

@ -19,9 +19,10 @@ profile gdm-x-session @{exec_path} flags=(attach_disconnected) {
/etc/gdm/custom.conf r,
/usr/share/gdm/gdm.schemas r,
/var/lib/gdm/.cache/gdm/Xauthority rw,
@{run}/user/@{uid}/gdm/ w,
@{run}/user/@{uid}/gdm/Xauthority rw,
owner @{run}/user/@{uid}/gdm/ w,
owner @{run}/user/@{uid}/gdm/Xauthority rw,
@{run}/gdm/custom.conf r,
owner @{PROC}/@{pid}/fd/ r,

1
apparmor.d/groups/gnome/gdm-xsession
View file

@ -27,6 +27,7 @@ profile gdm-xsession @{exec_path} {
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/xhost rPx,
/{usr/,}lib/gnome-session-binary rPx,
/{usr/,}bin/flatpak rPUx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/etc/X11/{,**} r,

2
apparmor.d/groups/gnome/gnome-control-center
View file

@ -15,6 +15,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
include <abstractions/gnome>
include <abstractions/gstreamer>
include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/openssl>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
@ -98,6 +99,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/stat r,

4
apparmor.d/groups/gnome/gnome-control-center-print-renderer
View file

@ -11,8 +11,9 @@ profile gnome-control-center-print-renderer @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/gtk>
include <abstractions/opencl-nvidia>
@{exec_path} mr,
@ -32,6 +33,7 @@ profile gnome-control-center-print-renderer @{exec_path} {
owner @{run}/user/@{uid}/dconf/user rw,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
include if exists <local/gnome-control-center-print-renderer>

15
apparmor.d/groups/gnome/gnome-shell
View file

@ -16,8 +16,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/gnome>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
capability sys_nice,
capability sys_ptrace,
@ -41,6 +43,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/usr/share/backgrounds/{,**} r,
/usr/share/desktop-directories/{,*.directory} r,
/usr/share/egl/{,**} r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/gdm/greeter/applications/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
@ -65,8 +68,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm/.local/share/gnome-shell/ rw,
/var/lib/gdm/.local/share/applications/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
owner @{HOME}/@{XDG_MUSIC_DIR}/**/*.jpg r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_config_dirs}/.goutputstream{,*} rw,
owner @{user_config_dirs}/ibus/* r,
@ -139,11 +143,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
@{sys}/devices/pci[0-9]*/**/drm/ r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/attr/current r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/@{tid}/stat r,
@{PROC}/@{pid}/net/* r,

1
apparmor.d/groups/gnome/gsd-color
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-color @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/gtk>
signal (receive) set=(term, hup) peer=gdm*,

1
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/gtk>
signal (receive) set=(term, hup) peer=gdm*,

4
apparmor.d/groups/pacman/pacman
View file

@ -21,6 +21,7 @@ profile pacman @{exec_path} {
capability dac_read_search,
capability fowner,
capability fsetid,
capability mknod,
capability net_admin,
capability setfcap,
capability setgid,
@ -98,7 +99,8 @@ profile pacman @{exec_path} {
owner /var/lib/pacman/{,**} rwl,
owner /tmp/alpm_*/{,**} rw,
owner /tmp/checkup-db-[0-9]*/sync/*.db.part rw,
owner /tmp/checkup-db-[0-9]*/sync/{,*.db.part} rw,
owner /tmp/checkup-db-[0-9]*/db.lck rw,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/stat r,

6
apparmor.d/groups/pacman/pacman-hook-dkms
View file

@ -11,15 +11,17 @@ profile pacman-hook-dkms @{exec_path} {
include <abstractions/base>
capability dac_read_search,
capability mknod,
unix (receive) type=stream,
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/kmod rPx,
/{usr/,}bin/dkms rPx,
/{usr/,}bin/kmod rPx,
/{usr/,}bin/nproc rix,
/usr/src/ r,
/usr/src/**.conf r,

2
apparmor.d/groups/systemd/bootctl
View file

@ -12,6 +12,8 @@ profile bootctl @{exec_path} {
include <abstractions/systemd-common>
include <abstractions/disks-read>
capability mknod,
signal (send) peer=child-pager,
ptrace (read) peer=unconfined,

9
apparmor.d/groups/systemd/systemd-sleep
View file

@ -12,14 +12,23 @@ profile systemd-sleep @{exec_path} {
include <abstractions/systemd-common>
capability net_admin,
capability sys_admin,
capability sys_resource,
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/nvidia-sleep.sh rix,
/{usr/,}lib/systemd/system-sleep/nvidia rix,
/etc/systemd/sleep.conf r,
/etc/systemd/sleep.conf.d/{,*} r,
@{sys}/power/state rw,
@{PROC}/driver/nvidia/suspend w,
/dev/tty rw,
include if exists <local/systemd-sleep>
}

3
apparmor.d/groups/systemd/systemd-udevd
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -92,6 +92,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
owner @{PROC}/@{pid}/oom_score_adj rw,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/devices r,
@{PROC}/sys/kernel/random/boot_id r,
# file_inherit