felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): various profile fixes.

Browse source
This commit is contained in:
Alexandre Pujol 2023-08-19 14:01:50 +01:00
parent 1dbced42ed
commit 5704d1ba20
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
11 changed files with 38 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

27
apparmor.d/groups/freedesktop/xdg-document-portal
View file

@ -13,7 +13,9 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
capability sys_nice,
capability sys_resource,
# capability sys_admin,
capability sys_admin,
mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/,
ptrace (read) peer=xdg-desktop-portal,
@ -78,12 +80,12 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
/ r,
/etc/flatpak/remotes.d/{,*} r,
/var/lib/flatpak/{,**} rw,
owner @{user_cache_dirs}/flatpak/{,**} r,
owner @{user_config_dirs}/user-dirs.dirs r,
owner @{user_share_dirs}/flatpak/{,**} r,
/var/lib/flatpak/{,**} rw,
@{PROC}/sys/kernel/random/boot_id r,
/dev/tty rw,
@ -98,25 +100,22 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
capability sys_admin,
capability dac_read_search,
unix (send receive) type=stream peer=(label=xdg-document-portal),
# network inet stream,
# network inet6 stream,
@{bin}/fusermount{,3} mr,
/etc/fuse{,3}.conf r,
mount options=(rw, rprivate) -> /,
mount options=(rw, rbind) @{run}/user/@{uid}/ -> /,
mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/,
umount @{run}/user/@{uid}/doc/,
@{PROC}/@{pids}/mounts r,
unix (send receive) type=stream peer=(label=xdg-document-portal),
@{bin}/fusermount{,3} mr,
/etc/fuse{,3}.conf r,
owner @{run}/user/@{uid}/doc/ rw,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/xdg-document-portal_fusermount>

2
apparmor.d/groups/freedesktop/xkbcomp
View file

@ -31,6 +31,8 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm{3,}/.local/share/xorg/Xorg.@{int}.log w,
owner /var/log/lightdm/x-@{int}.log w,
owner @{run}/user/@{uid}/server-@{int}.xkm rwk,
owner /tmp/server-@{int}.xkm rwk,
/dev/dri/card@{int} rw,

1
apparmor.d/groups/freedesktop/xwayland
View file

@ -38,6 +38,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
owner /tmp/server-@{int}.xkm rwk,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw,
owner @{run}/user/@{uid}/server-@{int}.xkm rw,
owner @{run}/user/@{uid}/xwayland-shared-@{rand6} rw,
@{sys}/bus/pci/devices/ r,