diff --git a/apparmor.d/groups/bus/ibus-daemon b/apparmor.d/groups/bus/ibus-daemon new file mode 100644 index 000000000..4a6812eea --- /dev/null +++ b/apparmor.d/groups/bus/ibus-daemon @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/ibus-daemon +profile ibus-daemon @{exec_path} flags=(attach_disconnected) { + include + include + + signal (receive) set=(usr1) peer=gnome-shell, + signal (send) set=(term) peer=ibus*, + + @{exec_path} mr, + + /{usr/,}lib/ibus/ibus-* rPx, + + /usr/share/ibus/{,**} r, + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/ibus/{,**} rw, + owner @{user_cache_dirs}/ibus/{,**} rw, + /var/lib/gdm/.config/ibus/{,**} rw, + /var/lib/gdm/.cache/ibus/{,**} rw, + + owner @{PROC}/@{pids}/fd/ r, + + owner /dev/tty[0-9]* rw, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/groups/bus/ibus-dconf b/apparmor.d/groups/bus/ibus-dconf new file mode 100644 index 000000000..bb755ca5f --- /dev/null +++ b/apparmor.d/groups/bus/ibus-dconf @@ -0,0 +1,35 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}lib/ibus/ibus-dconf +profile ibus-dconf @{exec_path} flags=(attach_disconnected) { + include + + signal (receive) set=term peer=ibus-daemon, + + @{exec_path} mr, + + /usr/share/gdm/greeter-dconf-defaults r, + + /etc/dconf/profile/ibus r, + /etc/dconf/db/ibus r, + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + + include + owner @{run}/user/@{uid}/dconf/ rw, + owner @{run}/user/@{uid}/dconf/user rw, + /usr/share/dconf/profile/gdm r, + /var/lib/gdm/.config/dconf/user r, + + owner /dev/tty[0-9]* rw, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/groups/bus/ibus-engine-simple b/apparmor.d/groups/bus/ibus-engine-simple new file mode 100644 index 000000000..e1b551fd7 --- /dev/null +++ b/apparmor.d/groups/bus/ibus-engine-simple @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}lib/ibus/ibus-engine-simple +profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) { + include + + signal (receive) set=term peer=ibus-daemon, + + @{exec_path} mr, + + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + + owner /dev/tty[0-9]* rw, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/groups/bus/ibus-extension-gtk3 b/apparmor.d/groups/bus/ibus-extension-gtk3 new file mode 100644 index 000000000..0711605b7 --- /dev/null +++ b/apparmor.d/groups/bus/ibus-extension-gtk3 @@ -0,0 +1,42 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}lib/ibus/ibus-extension-gtk3 +profile ibus-extension-gtk3 @{exec_path} { + include + include + include + include + + signal (receive) set=term peer=ibus-daemon, + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + /usr/share/glib-2.0/schemas/gschemas.compiled r, + /usr/share/ibus/{,**} r, + /usr/share/icons/{,**} r, + /usr/share/X11/xkb/** r, + + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + + include + owner @{run}/user/@{uid}/dconf/ rw, + owner @{run}/user/@{uid}/dconf/user rw, + /usr/share/dconf/profile/gdm r, + /var/lib/gdm/.config/dconf/user r, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/groups/bus/ibus-portal b/apparmor.d/groups/bus/ibus-portal new file mode 100644 index 000000000..c1069f1af --- /dev/null +++ b/apparmor.d/groups/bus/ibus-portal @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}lib/ibus/ibus-portal +profile ibus-portal @{exec_path} flags=(attach_disconnected) { + include + + signal (receive) set=(term, hup) peer=gdm*, + + @{exec_path} mr, + + /{usr/,}lib/gio/modules/{,*} r, + /{usr/,}lib/locale/locale-archive r, + + /usr/share/locale/locale.alias r, + + /var/lib/dbus/machine-id r, + /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + + owner /dev/tty[0-9]* rw, + /dev/null rw, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 new file mode 100644 index 000000000..21a82fcaa --- /dev/null +++ b/apparmor.d/groups/bus/ibus-x11 @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}lib/ibus/ibus-x11 +profile ibus-x11 @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + + @{exec_path} mr, + + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + + owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r, + + owner /dev/tty[0-9]* rw, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 34664624e..5ca5f1a4f 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -31,6 +31,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { ptrace (read), signal (receive) set=(term, hup) peer=gdm*, + signal (send) set=(usr1) peer=ibus-daemon, signal (send) set=(term) peer=polkit*, @{exec_path} mr, @@ -66,6 +67,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/monitors.xml r, owner @{user_config_dirs}/ibus/* r, + owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, owner @{user_share_dirs}/gnome-shell/{,**} rw, owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,