felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): use the new bus/atspi abstraction in the profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2023-11-30 00:22:34 +00:00
parent fe0cb4b48d
commit 459fe7c905
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
26 changed files with 59 additions and 380 deletions
Download patch file Download diff file Expand all files Collapse all files

52
apparmor.d/profiles-m-r/qbittorrent
View file

@ -12,32 +12,31 @@ include <tunables/global>
@{exec_path} = @{bin}/qbittorrent
profile qbittorrent @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/X-strict>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/user-download-strict>
include <abstractions/private-files-strict>
include <abstractions/qt5>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write>
include <abstractions/ibus>
include <abstractions/dconf-write>
include <abstractions/dbus-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-network-manager-strict>
include <abstractions/dbus-gtk>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/wayland>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/ibus>
include <abstractions/mesa>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/nameservice-strict>
include <abstractions/nvidia>
include <abstractions/openssl>
include <abstractions/private-files-strict>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write>
include <abstractions/qt5>
include <abstractions/ssl_certs>
include <abstractions/user-download-strict>
include <abstractions/wayland>
include <abstractions/X-strict>
signal send set=(term, kill) peer=qbittorrent//python3,
@ -93,18 +92,7 @@ profile qbittorrent @{exec_path} {
member={GetLayout,GetGroupProperties,AboutToShow,AboutToShowGroup,EventGroup,Event}
peer=(name=:*),
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=org.a11y.atspi.Registry),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*),
dbus bind bus=session
name=org.kde.StatusNotifierItem-*,
dbus bind bus=session name=org.kde.StatusNotifierItem-*,
@{exec_path} mr,

26
apparmor.d/profiles-m-r/remmina
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/remmina
profile remmina @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-gtk>
include <abstractions/dbus-session-strict>
@ -49,26 +50,6 @@ profile remmina @{exec_path} {
dbus (send, receive) bus=session path=/org/ayatana/NotificationItem/remmina_icon{,/**}
peer=(name="{:*,org.freedesktop.DBus}"), # all interfaces and members
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=org.a11y.atspi.Registry),
dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=GetRegisteredEvents
peer=(name=org.a11y.atspi.Registry),
dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=EventListenerDeregistered
peer=(name=:*),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/secrets/collection/session
interface=org.freedesktop.DBus.Properties
member=GetAll
@ -84,11 +65,6 @@ profile remmina @{exec_path} {
member=RegisterStatusNotifierItem
peer=(name=:*),
dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=org.a11y.atspi.Registry),
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
interface=org.gtk.Private.RemoteVolumeMonitor
member={IsSupported,List}

34
apparmor.d/profiles-m-r/rustdesk
View file

@ -8,16 +8,16 @@ include <tunables/global>
@{exec_path} = /{,usr/}{,local/}bin/rustdesk
profile rustdesk @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/audio>
include <abstractions/bus/atspi>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/X-strict>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-gtk>
capability dac_read_search,
capability dac_override,
@ -28,26 +28,6 @@ profile rustdesk @{exec_path} {
network inet6 stream,
network netlink raw, # discovery
dbus (send) bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=org.a11y.atspi.Registry),
dbus (send) bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=GetRegisteredEvents
peer=(name=org.a11y.atspi.Registry),
dbus (send) bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=org.a11y.atspi.Registry),
dbus (receive) bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*),
@{exec_path} mrix,
@{bin}/w rPx,