feat(profiles): general update.
This commit is contained in:
Alexandre Pujol
parent
79cd5f09f7
commit
4681a495b3
22 changed files with 76 additions and 33 deletions
|
|
@ -7,14 +7,15 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/plymouth-set-default-theme
|
||||
profile plymouth-set-default-theme @{exec_path} {
|
||||
profile plymouth-set-default-theme @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/grep rix,
|
||||
/{usr/,}bin/plymouth rPx,
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/grep rix,
|
||||
/{usr/,}bin/plymouth rPx,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/etc/plymouth/{,*} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -30,6 +30,10 @@ profile plymouthd @{exec_path} {
|
|||
/etc/plymouth/plymouthd.conf r,
|
||||
/etc/vconsole.conf r,
|
||||
|
||||
/var/lib/plymouth/{,**} rw,
|
||||
|
||||
@{run}/plymouth/{,**} rw,
|
||||
|
||||
@{run}/udev/data/+drm:* r,
|
||||
@{run}/udev/data/c226:* r,
|
||||
@{run}/udev/data/c29:* r,
|
||||
|
|
|
|||
|
|
@ -18,6 +18,7 @@ profile xdg-desktop-portal-gnome @{exec_path} {
|
|||
include <abstractions/gtk>
|
||||
include <abstractions/user-download>
|
||||
include <abstractions/user-read>
|
||||
include <abstractions/vulkan>
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
|
|
|
|||
|
|
@ -123,6 +123,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
|
|||
@{sys}/class/ r,
|
||||
@{sys}/class/input/ r,
|
||||
@{sys}/devices/**/{name,vendor,product,uevent} r,
|
||||
@{sys}/devices/**/power_supply/{,**} r,
|
||||
@{sys}/devices/platform/**/uevent r,
|
||||
@{sys}/devices/system/cpu/possible r,
|
||||
@{sys}/devices/virtual/**/uevent r,
|
||||
|
|
|
|||
|
|
@ -22,6 +22,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/ibus>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/opencl-mesa>
|
||||
include <abstractions/opencl-nvidia>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
|
|
|
|||
|
|
@ -24,6 +24,7 @@ profile tracker-extract @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
/usr/share/applications/*.desktop r,
|
||||
/usr/share/applications/mimeinfo.cache r,
|
||||
/usr/share/dconf/profile/gdm r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/hwdata/*.ids r,
|
||||
|
|
@ -40,6 +41,7 @@ profile tracker-extract @{exec_path} {
|
|||
/var/lib/gdm{3,}/.cache/tracker3/{,**} rw,
|
||||
/var/lib/gdm{3,}/greeter-dconf-defaults r,
|
||||
|
||||
/var/lib/flatpak/exports/share/applications/mimeinfo.cache r,
|
||||
/var/lib/snapd/desktop/applications/*.desktop r,
|
||||
|
||||
# Allow to search user files
|
||||
|
|
|
|||
|
|
@ -13,6 +13,11 @@ profile networkd-dispatcher @{exec_path} {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/network1/link/*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged
|
||||
peer=(name=:*),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
|
|
|
|||
|
|
@ -11,9 +11,6 @@ profile pacman-conf @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/pacman.conf r,
|
||||
|
|
|
|||
|
|
@ -13,8 +13,8 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/lib/udev/.#hwdb.bin[0-9a-zA-Z]* w,
|
||||
/usr/lib/udev/hwdb.bin w,
|
||||
/{usr/,}lib/udev/.#hwdb.bin[0-9a-zA-Z]* w,
|
||||
/{usr/,}lib/udev/hwdb.bin w,
|
||||
|
||||
/etc/udev/hwdb.d/{,*} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -19,15 +19,14 @@ profile systemd-rfkill @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/dev/rfkill rw,
|
||||
|
||||
@{sys}/devices/**/rfkill[0-9]*/{uevent,name} r,
|
||||
|
||||
/var/lib/systemd/rfkill/* rw,
|
||||
|
||||
@{run}/systemd/notify rw,
|
||||
|
||||
@{run}/udev/data/+rfkill:* r,
|
||||
|
||||
@{sys}/devices/**/rfkill[0-9]*/{uevent,name} r,
|
||||
|
||||
/dev/rfkill rw,
|
||||
|
||||
include if exists <local/systemd-rfkill>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -21,6 +21,11 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
|
|||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member=RequestName
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.timesync1,
|
||||
|
||||
|
|
|
|||
|
|
@ -37,15 +37,17 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
|
|||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/perl rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/chgrp rix,
|
||||
/{usr/,}bin/chmod rix,
|
||||
/{usr/,}bin/setfacl rix,
|
||||
/{usr/,}bin/ln rix,
|
||||
/{usr/,}bin/logger rix,
|
||||
/{usr/,}bin/nohup rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/ln rix,
|
||||
/{usr/,}bin/perl rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/setfacl rix,
|
||||
/{usr/,}bin/unshare rix,
|
||||
/{usr/,}bin/snap rPx,
|
||||
|
||||
/{usr/,}{s,}bin/* rPUx,
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue