felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-10-01 18:45:08 +01:00
parent 79cd5f09f7
commit 4681a495b3
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
22 changed files with 76 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/freedesktop/plymouth-set-default-theme
View file

@ -7,14 +7,15 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/plymouth-set-default-theme @{exec_path} = /{usr/,}bin/plymouth-set-default-theme
profile plymouth-set-default-theme @{exec_path} { profile plymouth-set-default-theme @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/{m,g,}awk rix, /{usr/,}bin/{m,g,}awk rix,
/{usr/,}bin/grep rix, /{usr/,}bin/grep rix,
/{usr/,}bin/plymouth rPx, /{usr/,}bin/plymouth rPx,
/{usr/,}bin/{,ba,da}sh rix,
/etc/plymouth/{,*} r, /etc/plymouth/{,*} r,

4
apparmor.d/groups/freedesktop/plymouthd
View file

@ -30,6 +30,10 @@ profile plymouthd @{exec_path} {
/etc/plymouth/plymouthd.conf r, /etc/plymouth/plymouthd.conf r,
/etc/vconsole.conf r, /etc/vconsole.conf r,
/var/lib/plymouth/{,**} rw,
@{run}/plymouth/{,**} rw,
@{run}/udev/data/+drm:* r, @{run}/udev/data/+drm:* r,
@{run}/udev/data/c226:* r, @{run}/udev/data/c226:* r,
@{run}/udev/data/c29:* r, @{run}/udev/data/c29:* r,

1
apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
View file

@ -18,6 +18,7 @@ profile xdg-desktop-portal-gnome @{exec_path} {
include <abstractions/gtk> include <abstractions/gtk>
include <abstractions/user-download> include <abstractions/user-download>
include <abstractions/user-read> include <abstractions/user-read>
include <abstractions/vulkan>
dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]* dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.DBus.Properties interface=org.freedesktop.DBus.Properties

1
apparmor.d/groups/gnome/gnome-control-center
View file

@ -123,6 +123,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{sys}/class/ r, @{sys}/class/ r,
@{sys}/class/input/ r, @{sys}/class/input/ r,
@{sys}/devices/**/{name,vendor,product,uevent} r, @{sys}/devices/**/{name,vendor,product,uevent} r,
@{sys}/devices/**/power_supply/{,**} r,
@{sys}/devices/platform/**/uevent r, @{sys}/devices/platform/**/uevent r,
@{sys}/devices/system/cpu/possible r, @{sys}/devices/system/cpu/possible r,
@{sys}/devices/virtual/**/uevent r, @{sys}/devices/virtual/**/uevent r,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -22,6 +22,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/ibus> include <abstractions/ibus>
include <abstractions/mesa> include <abstractions/mesa>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/opencl-intel>
include <abstractions/opencl-mesa>
include <abstractions/opencl-nvidia> include <abstractions/opencl-nvidia>
include <abstractions/p11-kit> include <abstractions/p11-kit>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>

2
apparmor.d/groups/gnome/tracker-extract
View file

@ -24,6 +24,7 @@ profile tracker-extract @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/usr/share/applications/*.desktop r, /usr/share/applications/*.desktop r,
/usr/share/applications/mimeinfo.cache r,
/usr/share/dconf/profile/gdm r, /usr/share/dconf/profile/gdm r,
/usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/hwdata/*.ids r, /usr/share/hwdata/*.ids r,
@ -40,6 +41,7 @@ profile tracker-extract @{exec_path} {
/var/lib/gdm{3,}/.cache/tracker3/{,**} rw, /var/lib/gdm{3,}/.cache/tracker3/{,**} rw,
/var/lib/gdm{3,}/greeter-dconf-defaults r, /var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/flatpak/exports/share/applications/mimeinfo.cache r,
/var/lib/snapd/desktop/applications/*.desktop r, /var/lib/snapd/desktop/applications/*.desktop r,
# Allow to search user files # Allow to search user files

5
apparmor.d/groups/network/networkd-dispatcher
View file

@ -13,6 +13,11 @@ profile networkd-dispatcher @{exec_path} {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/python> include <abstractions/python>
dbus receive bus=system path=/org/freedesktop/network1/link/*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*),
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/ r, /{usr/,}bin/ r,

3
apparmor.d/groups/pacman/pacman-conf
View file

@ -11,9 +11,6 @@ profile pacman-conf @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
network inet stream,
network inet6 stream,
@{exec_path} mr, @{exec_path} mr,
/etc/pacman.conf r, /etc/pacman.conf r,

4
apparmor.d/groups/systemd/systemd-hwdb
View file

@ -13,8 +13,8 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
/usr/lib/udev/.#hwdb.bin[0-9a-zA-Z]* w, /{usr/,}lib/udev/.#hwdb.bin[0-9a-zA-Z]* w,
/usr/lib/udev/hwdb.bin w, /{usr/,}lib/udev/hwdb.bin w,
/etc/udev/hwdb.d/{,*} r, /etc/udev/hwdb.d/{,*} r,

11
apparmor.d/groups/systemd/systemd-rfkill
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov # Copyright (C) 2020-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -19,15 +19,14 @@ profile systemd-rfkill @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/dev/rfkill rw,
@{sys}/devices/**/rfkill[0-9]*/{uevent,name} r,
/var/lib/systemd/rfkill/* rw, /var/lib/systemd/rfkill/* rw,
@{run}/systemd/notify rw, @{run}/systemd/notify rw,
@{run}/udev/data/+rfkill:* r, @{run}/udev/data/+rfkill:* r,
@{sys}/devices/**/rfkill[0-9]*/{uevent,name} r,
/dev/rfkill rw,
include if exists <local/systemd-rfkill> include if exists <local/systemd-rfkill>
} }

5
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -21,6 +21,11 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=RequestName
peer=(name=org.freedesktop.DBus),
dbus bind bus=system dbus bind bus=system
name=org.freedesktop.timesync1, name=org.freedesktop.timesync1,

10
apparmor.d/groups/systemd/systemd-udevd
View file

@ -37,15 +37,17 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/perl rix, /{usr/,}bin/{,e}grep rix,
/{usr/,}bin/chgrp rix, /{usr/,}bin/chgrp rix,
/{usr/,}bin/chmod rix, /{usr/,}bin/chmod rix,
/{usr/,}bin/setfacl rix, /{usr/,}bin/ln rix,
/{usr/,}bin/logger rix, /{usr/,}bin/logger rix,
/{usr/,}bin/nohup rix, /{usr/,}bin/nohup rix,
/{usr/,}bin/{,e}grep rix, /{usr/,}bin/perl rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/readlink rix, /{usr/,}bin/readlink rix,
/{usr/,}bin/setfacl rix,
/{usr/,}bin/unshare rix,
/{usr/,}bin/snap rPx,
/{usr/,}{s,}bin/* rPUx, /{usr/,}{s,}bin/* rPUx,

15
apparmor.d/profiles-a-f/blkdeactivate
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken # Copyright (C) 2022 Jeroen Rijken
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -12,12 +13,14 @@ profile blkdeactivate @{exec_path} flags=(complain) {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@{exec_path} rm, @{exec_path} rm,
/{usr/,}{s,}bin/dmsetup rPUx,
/{usr/,}bin/grep rix, /{usr/,}{s,}bin/multipathd rPx,
/{usr/,}bin/lsblk rPx, /{usr/,}{s,}bin/dmsetup rPUx,
/{usr/,}{s,}bin/lvm rPx, /{usr/,}{s,}bin/lvm rPx,
/{usr/,}bin/sort rix, /{usr/,}bin/grep rix,
/{usr/,}bin/umount rPx, /{usr/,}bin/lsblk rPx,
/{usr/,}bin/sort rix,
/{usr/,}bin/umount rPx,
@{sys}/devices/virtual/block/*/holders/ r, @{sys}/devices/virtual/block/*/holders/ r,

4
apparmor.d/profiles-a-f/flatpak-system-helper
View file

@ -19,6 +19,9 @@ profile flatpak-system-helper @{exec_path} {
capability setgid, capability setgid,
capability setuid, capability setuid,
capability sys_nice, capability sys_nice,
capability sys_ptrace,
ptrace (read),
@{exec_path} mr, @{exec_path} mr,
@ -40,6 +43,7 @@ profile flatpak-system-helper @{exec_path} {
owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/stat r,
profile gpg { profile gpg {
include <abstractions/base> include <abstractions/base>

1
apparmor.d/profiles-a-f/losetup
View file

@ -17,6 +17,7 @@ profile losetup @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{sys}/devices/**/usb[0-9]/{,**} r,
@{sys}/devices/system/cpu/possible r, @{sys}/devices/system/cpu/possible r,
/dev/loop-control rw, /dev/loop-control rw,

4
apparmor.d/profiles-m-r/mandb
View file

@ -27,8 +27,8 @@ profile mandb @{exec_path} flags=(complain) {
/usr/local/man/{,**} r, /usr/local/man/{,**} r,
/usr/local/share/man/{,**} r, /usr/local/share/man/{,**} r,
/usr/{,/share}/man/{,**} r, /usr/{,share/}man/{,**} r,
/usr/local/{,/share/}/man/{,**} r, /usr/local/{,share/}man/{,**} r,
/usr/share/**/man/man[0-9]*/*.[0-9]*.gz r, /usr/share/**/man/man[0-9]*/*.[0-9]*.gz r,

4
apparmor.d/profiles-m-r/mtools
View file

@ -28,8 +28,8 @@ profile mtools @{exec_path} {
owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk, owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk, owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk, owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
owner /dev/shm/*/**.{iso,img,bin,mdf,nrg} rwk, /dev/shm/*/**.{iso,img,bin,mdf,nrg} rwk,
owner /dev/shm/*/**.{ISO,IMG,BIN,MDF,NRG} rwk, /dev/shm/*/**.{ISO,IMG,BIN,MDF,NRG} rwk,
include if exists <local/mtools> include if exists <local/mtools>
} }

6
apparmor.d/profiles-m-r/pacmd
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -13,12 +14,15 @@ profile pacmd @{exec_path} {
include <abstractions/audio> include <abstractions/audio>
#capability sys_ptrace, #capability sys_ptrace,
ptrace peer=pulseaudio, ptrace peer=pulseaudio,
ptrace (read) peer=pipewire, ptrace (read) peer=pipewire,
signal (send) peer=pulseaudio, signal (send) peer=pulseaudio,
/{usr/,}bin/pacmd mr, @{exec_path} mr,
/app/lib/libzypak*.so* mr,
owner @{PROC}/@{pids}/stat r, owner @{PROC}/@{pids}/stat r,

7
apparmor.d/profiles-m-r/pactl
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -9,16 +10,18 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pactl @{exec_path} = /{usr/,}bin/pactl
profile pactl @{exec_path} { profile pactl @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/audio> include <abstractions/audio>
include <abstractions/consoles>
@{exec_path} mr, @{exec_path} mr,
owner @{HOME}/.Xauthority r, /app/lib/libzypak*.so* mr,
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
/etc/machine-id r, /etc/machine-id r,
owner @{HOME}/.Xauthority r,
owner @{user_config_dirs}/pulse/ rw, owner @{user_config_dirs}/pulse/ rw,
# file_inherit # file_inherit

6
apparmor.d/profiles-m-r/pass-import
View file

@ -11,6 +11,12 @@ profile pass-import @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/python> include <abstractions/python>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
@{exec_path} mr, @{exec_path} mr,

4
apparmor.d/profiles-m-r/run-parts
View file

@ -15,7 +15,8 @@ profile run-parts @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/usr/share/update-notifier/notify-reboot-required rPx, /usr/share/update-notifier/notify-reboot-required rPx,
/usr/share/update-notifier/notify-updates-outdated rPx,
# Crontrab # Crontrab
/etc/cron.{hourly,daily,weekly,monthly}/ r, /etc/cron.{hourly,daily,weekly,monthly}/ r,
@ -133,6 +134,7 @@ profile run-parts @{exec_path} {
/{usr/,}lib/update-notifier/update-motd-fsck-at-reboot rPx, /{usr/,}lib/update-notifier/update-motd-fsck-at-reboot rPx,
/{usr/,}lib/update-notifier/update-motd-reboot-required rix, /{usr/,}lib/update-notifier/update-motd-reboot-required rix,
/usr/share/unattended-upgrades/update-motd-unattended-upgrades rix, /usr/share/unattended-upgrades/update-motd-unattended-upgrades rix,
/usr/share/update-notifier/notify-updates-outdated rPx,
/ r, / r,
/etc/default/motd-news r, /etc/default/motd-news r,

1
apparmor.d/profiles-s-z/steam-gameoverlayui
View file

@ -36,6 +36,7 @@ profile steam-gameoverlayui @{exec_path} {
owner @{user_share_dirs}/Steam/config/DialogConfigOverlay*.vdf rw, owner @{user_share_dirs}/Steam/config/DialogConfigOverlay*.vdf rw,
owner @{user_share_dirs}/Steam/public/* rk, owner @{user_share_dirs}/Steam/public/* rk,
owner @{user_share_dirs}/Steam/resource/{,**} rk, owner @{user_share_dirs}/Steam/resource/{,**} rk,
owner @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/fontconfig/{,**} rw,
owner @{user_share_dirs}/Steam/userdata/[0-9]*/{,**} rk, owner @{user_share_dirs}/Steam/userdata/[0-9]*/{,**} rk,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw, owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,