felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): use the new bus/atspi abstraction in the profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2023-11-30 00:22:34 +00:00
parent fe0cb4b48d
commit 459fe7c905
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
26 changed files with 59 additions and 380 deletions
Download patch file Download diff file Expand all files Collapse all files

32
apparmor.d/profiles-a-f/atril
View file

@ -10,45 +10,21 @@ include <tunables/global>
@{exec_path} = @{bin}/atril{,-*}
profile atril @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/ibus>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/X-strict>
include <abstractions/ibus>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-accessibility-strict>
network netlink raw,
dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd),
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*, label=at-spi2-registryd),
dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=GetRegisteredEvents
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd),
dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=EventListenerDeregistered
peer=(name=:*, label=at-spi2-registryd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo

12
apparmor.d/profiles-a-f/engrampa
View file

@ -10,8 +10,8 @@ include <tunables/global>
@{exec_path} = @{bin}/engrampa
profile engrampa @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-gtk>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read>
@ -34,16 +34,6 @@ profile engrampa @{exec_path} {
member={IsSupported,List}
peer=(name=:*),
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=org.a11y.atspi.Registry),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member={ListMounts2,LookupMount}

29
apparmor.d/profiles-a-f/evince
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/evince @{lib}/evinced
profile evince @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
@ -52,33 +53,7 @@ profile evince @{exec_path} {
dbus (send, receive) bus=session path=/org/gnome/evince/{,**}
peer=(name="{org.gnome.evince.Daemon,org.freedesktop.DBus,:*}", label=@{profile_name}), # all interfaces and members
dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd),
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*, label=at-spi2-registryd),
dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=GetRegisteredEvents
peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd),
dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=EventListenerDeregistered
peer=(name=:*, label=at-spi2-registryd),
dbus bind bus=session
name=org.gnome.evince.Daemon,
dbus bind bus=session name=org.gnome.evince.Daemon,
@{exec_path} rix,