felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): rewrite some electron based profiles using the new electron abs.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-30 14:54:21 +00:00
parent 89def65a17
commit 534b10b261
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
5 changed files with 44 additions and 324 deletions
Download patch file Download diff file Expand all files Collapse all files

49
apparmor.d/profiles-a-f/element-desktop
View file

@ -6,21 +6,19 @@ abi <abi/3.0>,
include <tunables/global>
@{name} = {E,e}lement
@{lib_dirs} = @{lib}/@{name}
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}
@{exec_path} = @{bin}/element-desktop
profile element-desktop @{exec_path} {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/common/chromium>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/common/electron>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
include <abstractions/video>
capability sys_ptrace,
network inet dgram,
network inet6 dgram,
network inet stream,
@ -29,50 +27,19 @@ profile element-desktop @{exec_path} {
@{exec_path} mr,
@{sh_path} r,
@{bin}/electron@{int} rix,
@{lib}/electron@{int}/{,**} r,
@{lib}/electron@{int}/electron rix,
@{lib}/element/{,**} r,
@{lib}/element/app.asar.unpacked/node_modules/**.node mr,
@{open_path} rPx -> child-open,
/opt/intel/oneapi/{compiler,lib,mkl}/**/ r,
/opt/intel/oneapi/{compiler,lib,mkl}/**.so* mr,
@{open_path} rPx -> child-open-strict,
/usr/share/webapps/element/{,**} r,
/etc/element/{,**} r,
/etc/webapps/element/{,**} r,
owner @{user_config_dirs}/Element/ rw,
owner @{user_config_dirs}/Element/** rwkl -> @{user_config_dirs}/Element/**,
@{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
@{PROC}/ r,
@{PROC}/sys/fs/inotify/max_user_watches r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/oom_score_adj w,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/statm r,
owner @{PROC}/@{pid}/status r,
owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/@{tid}/status r,
/dev/tty rw,
deny / r,
deny @{HOME}/ r,
deny @{user_share_dirs}/gvfs-metadata/* r,
deny /etc/machine-id r,
deny /var/lib/dbus/machine-id r,
include if exists <local/element-desktop>
}