felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): add some core dbus rules.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-12 23:50:58 +01:00
parent 24056c8cd1
commit 50a18aac08
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
36 changed files with 343 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/groups/gnome/evolution-calendar-factory
View file

@ -23,9 +23,13 @@ profile evolution-calendar-factory @{exec_path} {
network inet6 dgram,
network netlink raw,
dbus receive bus=system path=/org/freedesktop/NetworkManager
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
member={PropertiesChanged,GetAll},
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member={CheckPermissions,StateChanged},
@{exec_path} mr,
@{exec_path}-subprocess rix,

7
apparmor.d/groups/gnome/gdm
View file

@ -27,7 +27,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term),
dbus (send,receive) bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User
interface=org.freedesktop.{DBus.Properties,Accounts.User}
member={Changed,GetAll,PropertiesChanged},
dbus send bus=system path=/org/freedesktop/Accounts
@ -40,7 +40,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser},
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName},
dbus receive bus=system path=/org/freedesktop/login[0-9]/seat/seat[0-9]
interface=org.freedesktop.DBus.Properties
@ -50,6 +50,9 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
interface={org.freedesktop.DBus.Properties,org.gnome.DisplayManager.Manager}
member={RegisterDisplay,Get,RegisterSession,GetAll,OpenReauthenticationChannel},
dbus bind bus=system
name=org.gnome.DisplayManager,
@{exec_path} mr,
/{usr/,}{s,}prime-switch rPx,

12
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -41,22 +41,14 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus send bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
interface={org.freedesktop.DBus.Properties,org.freedesktop.Accounts}
dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
interface=org.freedesktop.{DBus.Properties,Accounts*}
member={GetAll,FindUserByName,SetLanguage,Changed,PropertiesChanged},
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member=CreateSession,
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.Accounts.User
member=Changed,
@{exec_path} mrix,
/{usr/,}bin/gnome-keyring-daemon rPx,

51
apparmor.d/groups/gnome/gnome-control-center
View file

@ -10,6 +10,9 @@ include <tunables/global>
profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/dbus-network-manager-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
@ -32,6 +35,54 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
signal (send) set=(kill) peer=unconfined,
signal (send) set=(kill) peer=passwd,
dbus send bus=system path=/org/freedesktop{,ModemManager[0-9],UDisks2}
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus send bus=system path=/net/reactivated/Fprint/Manager
interface=net.reactivated.Fprint.Manager
member=GetDevices,
dbus send bus=system path=/net/reactivated/Fprint/Manager
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.PolicyKit[0-9].Authority
member=CheckAuthorization,
dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts
member=ListCachedUsers,
dbus send bus=system path=/net/hadess/SwitcherooControl
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/hostname[0-9]
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=GetPermissions,
dbus send bus=system path=/org/freedesktop/NetworkManager/Settings/[0-9]*
interface=org.freedesktop.NetworkManager.Settings.Connection
member=GetSettings,
dbus send bus=system path=/org/freedesktop/systemd[0-9]
interface=org.freedesktop.DBus.Properties
member={GetAll,Get},
@{exec_path} mr,
/{usr/,}bin/bash rUx,

2
apparmor.d/groups/gnome/gnome-extension-ding
View file

@ -26,7 +26,7 @@ profile gnome-extension-ding @{exec_path} {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus.Introspectable
member=Introspec,
member=Introspect,
dbus send bus=system path=/net/hadess/SwitcherooControl
interface=org.freedesktop.DBus.Properties

9
apparmor.d/groups/gnome/gnome-keyring-daemon
View file

@ -19,6 +19,15 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term) peer=gdm,
signal (send) set=(term) peer=ssh-agent,
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member=GetSession
peer=(name=org.freedesktop.login[0-9]),
dbus receive bus=system path=/org/freedesktop/login[0-9]/session/_[0-9]*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
@{exec_path} mr,
/{usr/,}bin/ssh-add rix,

6
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -30,7 +30,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member={CanPowerOff,GetSession},
member={CanPowerOff,GetSession,PowerOff,Inhibit},
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.DBus.Properties
@ -44,6 +44,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member={SessionNew,PrepareForShutdown,SessionRemoved},
@{exec_path} mr,
/{usr/,}bin/{,z,ba,da}sh rix,

58
apparmor.d/groups/gnome/gnome-shell
View file

@ -11,6 +11,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/audio>
include <abstractions/dbus-network-manager-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -18,6 +19,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-write>
include <abstractions/gnome>
include <abstractions/ibus>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl-nvidia>
@ -43,36 +45,39 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
unix (send,receive) type=stream addr=none peer=(label=gnome-extension-ding),
dbus (send,receive) bus=system path=/org/freedesktop/login[0-9]/session/_[0-9]*
interface=org.freedesktop.login[0-9].Session
member={ReleaseDevice,TakeControl,TakeDevice,PauseDevice},
dbus (send,receive) bus=system path=/org/freedesktop/login[0-9]{,/**}
interface=org.freedesktop.{DBus.Properties,login[0-9].*},
dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.PolicyKit[0-9].Authority
member={CheckAuthorization,RegisterAuthenticationAgent,Changed},
interface=org.freedesktop.{DBus.Properties,PolicyKit[0-9].Authority}
member={CheckAuthorization,RegisterAuthenticationAgent,Changed,GetAll},
dbus send bus=system path=/org/gnome/DisplayManager/Manager
interface=org.gnome.DisplayManager.Manager
member=RegisterSession
peer=(name=org.gnome.DisplayManager),
dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
interface=org.freedesktop.{DBus.Properties,Accounts*}
member={GetAll,FindUserByName,Changed,PropertiesChanged},
dbus (send,receive) bus=system path=/org/freedesktop/UPower/{,devices/DisplayDevice}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged},
dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
interface=org.freedesktop.{DBus.Properties,GeoClue2.Manager}
member={PropertiesChanged,AddAgent,GetAll},
dbus send bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member={CanSuspend,CanRebootToBootLoaderMenu,GetSession,Inhibit},
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetConnectionUnixUser,
dbus send bus=system path=/net/hadess/SwitcherooControl
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/gnome/DisplayManager/Manager
interface=org.gnome.{DBus.Properties,DisplayManager.Manager}
member={RegisterSession,Get,GetAll,OpenReauthenticationChannel}
peer=(name=org.gnome.DisplayManager),
dbus send bus=system path=/net/hadess/PowerProfiles
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/UPower/{,devices/DisplayDevice}
dbus send bus=system path=/net/hadess/{PackageKit,PowerProfiles,SwitcherooControl}
interface=org.freedesktop.DBus.Properties
member=GetAll,
@ -80,16 +85,20 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
interface=net.reactivated.Fprint.Manager
member=GetDefaultDevice,
dbus send bus=system path=/org/freedesktop/NetworkManager{,/AgentManager}
interface=org.freedesktop.NetworkManager{,.AgentManager}
member={Unregister,RegisterWithCapabilities,GetPermissions},
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=CheckPermissions,
dbus receive bus=system path=/org/freedesktop/NetworkManager
dbus receive bus=system path=/org/freedesktop/NetworkManager/{Devices,DHCP{4,6}Config,IP{4,6}Config}/[0-9]*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
@{exec_path} mr,
@ -150,9 +159,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_config_dirs}/.goutputstream{,*} rw,
owner @{user_config_dirs}/ibus/ rw,
owner @{user_config_dirs}/ibus/bus/ rw,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-{,wayland-}[0-9] r,
owner @{user_config_dirs}/monitors.xml{,~} rwl,
owner @{user_share_dirs}/backgrounds/{,**} rw,

8
apparmor.d/groups/gnome/goa-daemon
View file

@ -25,9 +25,13 @@ profile goa-daemon @{exec_path} {
network inet6 dgram,
network netlink raw,
dbus receive bus=system path=/org/freedesktop/NetworkManager
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
member={PropertiesChanged,GetAll},
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member={CheckPermissions,StateChanged},
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-color
View file

@ -18,7 +18,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=system path=/org/freedesktop/ColorManager/devices/xrandr_*
dbus send bus=system path=/org/freedesktop/ColorManager{,/devices/xrandr_*}
interface=org.freedesktop.DBus.Properties
member=GetAll,

7
apparmor.d/groups/gnome/gsd-disk-utility-notify
View file

@ -12,14 +12,13 @@ profile gsd-disk-utility-notify @{exec_path} {
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
interface=org.freedesktop.DBus.{Properties,ObjectManager},
dbus send bus=system path=/org/freedesktop/UDisks2
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus receive bus=system path=/org/freedesktop/UDisks2/**
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
@{exec_path} mr,
include if exists <local/gsd-disk-utility-notify>

4
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -18,6 +18,10 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=system path=/org/freedesktop/locale[0-9]
interface=org.freedesktop.DBus.Properties
member=GetAll,
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

8
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -37,6 +37,14 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus send bus=system path=/org/freedesktop/hostname[0-9]
interface=org.freedesktop.DBus.Properties
member=Get,
dbus receive bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member={SessionNew,SessionRemoved,PrepareForShutdown},
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

8
apparmor.d/groups/gnome/gsd-power
View file

@ -24,6 +24,10 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
dbus (send,receive) bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.{DBus.Properties,UPower*},
dbus send bus=system path=/org/freedesktop/systemd[0-9]
interface=org.freedesktop.DBus.Properties
member=Get,
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.DBus.Properties
member=GetAll,
@ -48,6 +52,10 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member={SessionNew,SessionRemoved,PrepareForShutdown},
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

2
apparmor.d/groups/gnome/gsd-printer
View file

@ -17,7 +17,7 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=ReleaseName,
member={ReleaseName,RequestName},
dbus bind bus=system
name=com.redhat.NewPrinterNotification,

20
apparmor.d/groups/gnome/gsd-sharing
View file

@ -15,11 +15,27 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
include <abstractions/dconf-write>
signal (receive) set=(term, hup) peer=gdm*,
dbus receive bus=system path=/org/freedesktop/NetworkManager
dbus send bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=GetPermissions,
dbus send bus=system path=/org/freedesktop/NetworkManager/Settings/[0-9]
interface=org.freedesktop.NetworkManager.Settings.Connection
member=GetSettings,
dbus receive bus=system path=/org/freedesktop/NetworkManager{,/{Devices,DHCP{4,6}Config,IP{4,6}Config}/[0-9]*}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=CheckPermissions,
@{exec_path} mr,
/usr/share/dconf/profile/gdm r,

5
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -30,6 +30,10 @@ profile gsd-xsettings @{exec_path} {
interface=org.freedesktop.Accounts.User
member={SetInputSources,Changed,GetAll},
dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged},
dbus send bus=system path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts
member=FindUserByName,
@ -59,7 +63,6 @@ profile gsd-xsettings @{exec_path} {
owner @{user_cache_dirs}/mesa_shader_cache/index rw,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* r,
owner @{run}/user/@{uid}/at-spi/bus rw,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/wayland-[0-9]* rw,
@{run}/systemd/sessions/* r,

2
apparmor.d/groups/gnome/tracker-miner
View file

@ -18,7 +18,7 @@ profile tracker-miner @{exec_path} {
include <abstractions/private-files-strict>
include <abstractions/private-files>
dbus send bus=system path=/org/freedesktop/UPower/{,devices/DisplayDevice}
dbus send bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
interface=org.freedesktop.DBus.Properties
member=GetAll,