felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Profiles update.

Browse source
This commit is contained in:
Alexandre Pujol 2021-12-12 12:41:50 +00:00
parent 16dddf16dc
commit 44aca3ba51
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
24 changed files with 88 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/gnome/evolution-alarm-notify
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/evolution-data-server/evolution-alarm-notify
profile evolution-alarm-notify @{exec_path} {
include <abstractions/base>
include <abstractions/fontconfig-cache-read>
include <abstractions/gnome>
include <abstractions/nameservice-strict>
include <abstractions/openssl>

3
apparmor.d/groups/gnome/gdm
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/gdm
profile gdm @{exec_path} {
profile gdm @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/wutmp>
include <abstractions/nameservice-strict>
@ -36,6 +36,7 @@ profile gdm @{exec_path} {
/var/{lib,log}/gdm/ rw,
@{run}/gdm/ rw,
@{run}/gdm/custom.conf r,
@{run}/gdm/gdm.pid rw,
@{run}/gdm/greeter/ rw,
@{run}/systemd/seats/seat[0-9]* r,

1
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -55,6 +55,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
/usr/share/wayland-sessions/*.desktop r,
@{run}/faillock/[a-zA-z0-9]* rwk,
@{run}/gdm/custom.conf r,
@{run}/systemd/sessions/[0-9]*.ref rw,
@{run}/systemd/users/@{uid} r,
@{run}/utmp rwk,

2
apparmor.d/groups/gnome/gdm-wayland-session
View file

@ -39,6 +39,8 @@ profile gdm-wayland-session @{exec_path} {
/usr/share/gdm/gdm.schemas r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
@{run}/gdm/custom.conf r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid r,

7
apparmor.d/groups/gnome/gdm-x-session
View file

@ -19,9 +19,10 @@ profile gdm-x-session @{exec_path} flags=(attach_disconnected) {
/etc/gdm/custom.conf r,
/usr/share/gdm/gdm.schemas r,
/var/lib/gdm/.cache/gdm/Xauthority rw,
@{run}/user/@{uid}/gdm/ w,
@{run}/user/@{uid}/gdm/Xauthority rw,
owner @{run}/user/@{uid}/gdm/ w,
owner @{run}/user/@{uid}/gdm/Xauthority rw,
@{run}/gdm/custom.conf r,
owner @{PROC}/@{pid}/fd/ r,

1
apparmor.d/groups/gnome/gdm-xsession
View file

@ -27,6 +27,7 @@ profile gdm-xsession @{exec_path} {
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/xhost rPx,
/{usr/,}lib/gnome-session-binary rPx,
/{usr/,}bin/flatpak rPUx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/etc/X11/{,**} r,

2
apparmor.d/groups/gnome/gnome-control-center
View file

@ -15,6 +15,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
include <abstractions/gnome>
include <abstractions/gstreamer>
include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/openssl>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
@ -98,6 +99,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/stat r,

4
apparmor.d/groups/gnome/gnome-control-center-print-renderer
View file

@ -11,8 +11,9 @@ profile gnome-control-center-print-renderer @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/gtk>
include <abstractions/opencl-nvidia>
@{exec_path} mr,
@ -32,6 +33,7 @@ profile gnome-control-center-print-renderer @{exec_path} {
owner @{run}/user/@{uid}/dconf/user rw,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
include if exists <local/gnome-control-center-print-renderer>

15
apparmor.d/groups/gnome/gnome-shell
View file

@ -16,8 +16,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/gnome>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
capability sys_nice,
capability sys_ptrace,
@ -41,6 +43,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/usr/share/backgrounds/{,**} r,
/usr/share/desktop-directories/{,*.directory} r,
/usr/share/egl/{,**} r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/gdm/greeter/applications/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
@ -65,8 +68,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm/.local/share/gnome-shell/ rw,
/var/lib/gdm/.local/share/applications/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
owner @{HOME}/@{XDG_MUSIC_DIR}/**/*.jpg r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_config_dirs}/.goutputstream{,*} rw,
owner @{user_config_dirs}/ibus/* r,
@ -139,11 +143,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
@{sys}/devices/pci[0-9]*/**/drm/ r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/attr/current r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/@{tid}/stat r,
@{PROC}/@{pid}/net/* r,

1
apparmor.d/groups/gnome/gsd-color
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-color @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/gtk>
signal (receive) set=(term, hup) peer=gdm*,

1
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/gtk>
signal (receive) set=(term, hup) peer=gdm*,