General update
Signed-off-by: Jeroen Rijken <jeroen.rijken@xs4all.nl>
This commit is contained in:
Jeroen Rijken
Alex
parent
0a468caff2
commit
5ccd92e12f
13 changed files with 127 additions and 16 deletions
|
|
@ -37,16 +37,31 @@ profile pulseaudio @{exec_path} {
|
|||
network bluetooth stream,
|
||||
network bluetooth seqpacket,
|
||||
|
||||
dbus send bus=session path=/Client0/EntryGroup[0-9]*
|
||||
dbus send bus=session path=/Client[0-9]*/EntryGroup[0-9]*
|
||||
interface=org.freedesktop.Avahi.EntryGroup
|
||||
member={GetState,AddService,AddServiceSubtype,Commit}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus receive bus=system path=/Client0/EntryGroup[0-9]*
|
||||
dbus receive bus=system path=/Client[0-9]*/EntryGroup[0-9]*
|
||||
interface=org.freedesktop.Avahi.EntryGroup
|
||||
member={AddService,AddServiceSubtype,Commit,GetState,StateChanged}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus receive bus=system path=/Client[0-9]*/ServiceBrowser[0-9]*
|
||||
interface=org.freedesktop.Avahi.ServiceBrowser
|
||||
member={ItemNew,ItemRemove}
|
||||
peer=(name=org.freedesktop.Avahi), # no peer's label
|
||||
|
||||
dbus receive bus=system path=/Client[0-9]*/ServiceResolver[0-9]*
|
||||
interface=org.freedesktop.Avahi.ServiceResolver
|
||||
member=Found
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus send bus=system path=/Client[0-9]*/ServiceResolver[0-9]*
|
||||
interface=org.freedesktop.Avahi.ServiceResolver
|
||||
member=Free
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
|
|
|
|||
|
|
@ -9,10 +9,41 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/xdg-dbus-proxy
|
||||
profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dbus-session-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
dbus (send,receive) bus=system path=/
|
||||
interface=org.freedesktop.DBus
|
||||
member={AddMatch,GetNameOwner}
|
||||
peer=(label=dbus-daemon),
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={AddMatch,RemoveMatch,NameHasOwner,GetNameOwner}
|
||||
peer=(label=dbus-daemon),
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.NetworkManager
|
||||
member=GetDevices
|
||||
peer=(label=NetworkManager),
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager{/Devices/[0-9]*,/ActiveConnection/[0-9]*}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(label=NetworkManager),
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager/Settings
|
||||
interface=org.freedesktop.NetworkManager.Settings
|
||||
member=ListConnections
|
||||
peer=(label=NetworkManager),
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager/Settings/[0-9]*
|
||||
interface=org.freedesktop.NetworkManager.Settings.Connection
|
||||
member=GetSettings
|
||||
peer=(label=NetworkManager),
|
||||
|
||||
owner @{run}/firejail/dbus/[0-9]*/[0-9]*-{system,user} rw,
|
||||
owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-[0-9A-Z]* rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-[0-9A-Z]* rw,
|
||||
|
|
|
|||
|
|
@ -43,8 +43,8 @@ profile xdg-settings @{exec_path} {
|
|||
/var/lib/snapd/desktop/applications/{,*} r,
|
||||
|
||||
# freedesktop.org-strict
|
||||
/usr/share/applications/{,*} r,
|
||||
/usr/share/ubuntu/applications/ r,
|
||||
/usr/{,local/}share/applications/{,*} r,
|
||||
/usr/{,local/}share/ubuntu/applications/ r,
|
||||
owner @{user_share_dirs}/applications/ r,
|
||||
owner @{user_share_dirs}/applications/*.desktop r,
|
||||
|
||||
|
|
|
|||
|
|
@ -84,6 +84,8 @@ profile kded5 @{exec_path} {
|
|||
owner @{user_share_dirs}/kded5/{,**} r,
|
||||
owner @{user_share_dirs}/kscreen/{,**} rw,
|
||||
owner @{user_share_dirs}/ktp/cache.db rwk,
|
||||
owner @{user_share_dirs}/kcookiejar/#@{hex}* rw,
|
||||
owner @{user_share_dirs}/kcookiejar/cookies.* rwkl,
|
||||
|
||||
owner @{run}/user/@{uid}/#[0-9]* rw,
|
||||
owner @{run}/user/@{uid}/kded5*kioworker.socket rwl,
|
||||
|
|
@ -120,4 +122,4 @@ profile kded5 @{exec_path} {
|
|||
}
|
||||
|
||||
include if exists <local/kded5>
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
profile plasmashell @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app-launcher-user>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
|
|
@ -30,6 +31,11 @@ profile plasmashell @{exec_path} {
|
|||
|
||||
signal (send),
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/UPower/devices/{,DisplayDevice,battery_BAT[0-9]*,mouse_hidpp_battery_[0-9]*}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member={GetAll,PropertiesChanged}
|
||||
peer=(label=upowerd),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{libexec}/libheif/ r,
|
||||
|
|
|
|||
|
|
@ -40,10 +40,17 @@ profile ssh @{exec_path} {
|
|||
owner @{user_projects_dirs}/**/ssh/{,*} r,
|
||||
owner @{user_projects_dirs}/**/config r,
|
||||
|
||||
/etc/ssh/ssh_config r,
|
||||
/etc/ssh/ssh_config.d/{,*} r,
|
||||
# Needed to work for systemd-homed users
|
||||
/etc/machine-id r,
|
||||
@{run}/systemd/userdb/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/keyring/ssh rw,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
owner /tmp/ssh-*/{,agent.[0-9]*} rwkl,
|
||||
|
||||
include if exists <local/ssh>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -19,6 +19,7 @@ profile ssh-agent @{exec_path} {
|
|||
|
||||
/{usr/,}bin/enlightenment_start rPUx,
|
||||
/{usr/,}bin/gpg-agent rPx,
|
||||
/{usr/,}bin/im-launch rPUx,
|
||||
/{usr/,}bin/kwalletaskpass rPUx,
|
||||
/{usr/,}bin/openbox-session rPx,
|
||||
/{usr/,}bin/startkde rPUx,
|
||||
|
|
|
|||
|
|
@ -22,6 +22,8 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) {
|
|||
ptrace (read) peer=containerd,
|
||||
ptrace (read) peer=unconfined,
|
||||
|
||||
signal (send) set=kill peer=cri-containerd.apparmor.d,
|
||||
|
||||
mount -> /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/,
|
||||
umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/,
|
||||
|
||||
|
|
|
|||
|
|
@ -28,12 +28,15 @@ profile k3s @{exec_path} flags=(attach_disconnected) {
|
|||
ptrace peer=@{profile_name},
|
||||
ptrace (read) peer={cni-calico-node,cri-containerd.apparmor.d,cni-xtables-nft,ip,kmod,kubernetes-pause,mount,unconfined},
|
||||
|
||||
# k3s requires ptrace to all AppArmor profiles loaded in Kubernetes
|
||||
# k3s requires ptrace to all AppArmor profiles loaded in Kubernetes.
|
||||
# For simplification, let's assume for now all AppArmor profiles start with a predefined prefix.
|
||||
ptrace (read) peer=container-*,
|
||||
ptrace (read) peer=docker-*,
|
||||
ptrace (read) peer=k3s-*,
|
||||
ptrace (read) peer=kubernetes-*,
|
||||
# When using ZFS as storage provider instead of the default overlay2.
|
||||
ptrace (read) peer=zfs,
|
||||
ptrace (read) peer=zpool,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue