felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): reorganize the electron & chromium abs.

Browse source
This commit is contained in:
Alexandre Pujol 2025-08-16 19:23:33 +02:00
parent f5a4acd37e
commit 5ee999536c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
19 changed files with 46 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

32
apparmor.d/abstractions/app/chromium
View file

@ -33,6 +33,7 @@
include <abstractions/bus/org.gnome.ScreenSaver>
include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/bus/org.kde.kwalletd>
include <abstractions/common/chromium>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/devices-usb>
@ -46,14 +47,6 @@
include <abstractions/user-read-strict>
include <abstractions/video>
userns,
capability setgid,
capability setuid,
capability sys_admin,
capability sys_chroot,
capability sys_ptrace,
network inet dgram,
network inet6 dgram,
network inet stream,
@ -112,21 +105,12 @@
/etc/fstab r,
/etc/{,opensc/}opensc.conf r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/ r,
owner @{HOME}/ r,
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{user_cache_dirs}/gtk-3.0/**/*.cache r,
owner @{user_config_dirs}/gtk-3.0/servers r,
owner @{user_share_dirs}/.@{domain}.@{rand6} rw,
owner @{user_share_dirs}/icons/hicolor/.xdg-icon-resource-dummy w,
owner @{config_dirs}/ rw,
@ -151,10 +135,7 @@
/tmp/ r,
/var/tmp/ r,
owner @{tmp}/.@{domain}.@{rand6} rw,
owner @{tmp}/.@{domain}.@{rand6}/{,**} rw,
owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw,
owner @{tmp}/scoped_dir@{rand6}/{,**} rw,
owner @{tmp}/tmp.@{rand10} rw,
owner @{tmp}/tmp.@{rand6} rw,
owner @{tmp}/tmp.@{rand6}/ rw,
@ -163,9 +144,6 @@
owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw,
owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw,
/dev/shm/ r,
owner /dev/shm/.@{domain}.@{rand6} rw,
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
@{sys}/bus/ r,
@ -175,10 +153,7 @@
@{sys}/devices/@{pci}/boot_vga r,
@{sys}/devices/@{pci}/report_descriptor r,
@{sys}/devices/**/uevent r,
@{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/**/report_descriptor r,
@{sys}/devices/virtual/dmi/id/{sys_vendor,product_name} r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
@{PROC}/ r,
@{PROC}/@{pid}/fd/ r,
@ -192,18 +167,15 @@
owner @{PROC}/@{pid}/clear_refs w,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/environ r,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/limits r,
owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/oom_{,score_}adj rw,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/smaps_rollup r,
owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/uid_map w,
/dev/ r,
/dev/hidraw@{int} rw,

25
apparmor.d/abstractions/common/chromium
View file

@ -4,7 +4,13 @@
# SPDX-License-Identifier: GPL-2.0-only
# This abstraction is for chromium based application. Chromium based browsers
# need to use abstractions/chromium instead.
# need to use abstractions/app/chromium instead.
# It works as a *function* and requires a variable to be provided as *arguments*
# and set in the header of the calling profile. Example:
#
# @{domain} = org.chromium.Chromium
#
abi <abi/4.0>,
@ -22,19 +28,24 @@
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw,
owner @{user_share_dirs}/.@{domain}.@{rand6} rw,
/tmp/ r,
/var/tmp/ r,
owner @{tmp}/.org.chromium.Chromium.@{rand6} rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/{,**} rw,
owner @{tmp}/.@{domain}.@{rand6} rw,
owner @{tmp}/.@{domain}.@{rand6}/ rw,
owner @{tmp}/.@{domain}.@{rand6}/SingletonCookie w,
owner @{tmp}/.@{domain}.@{rand6}/SingletonSocket w,
owner @{tmp}/scoped_dir@{rand6}/ rw,
owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w,
owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w,
owner @{tmp}/scoped_dir@{rand6}/SS w,
/dev/shm/ r,
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
owner /dev/shm/.@{domain}.@{rand6} rw,
@{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
# If kernel.unprivileged_userns_clone = 1
owner @{PROC}/@{pid}/setgroups w,

39
apparmor.d/abstractions/common/electron
View file

@ -7,13 +7,15 @@
# in the header of the calling profile. Example:
#
# @{name} = spotify
# @{lib_dirs} = /opt/@{name}
# @{domain} = org.chromium.chromium
# @{lib_dirs} = /opt/@{name}/ /usr/share/@{name}/
# @{config_dirs} = @{user_config_dirs}/@{name}
# @{cache_dirs} = @{user_cache_dirs}/@{name}
#
abi <abi/4.0>,
include <abstractions/common/chromium>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
@ -21,14 +23,6 @@
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
userns,
capability setgid, # If kernel.unprivileged_userns_clone = 1
capability setuid, # If kernel.unprivileged_userns_clone = 1
capability sys_admin,
capability sys_chroot,
capability sys_ptrace,
@{bin}/electron rix,
@{bin}/electron@{int} rix,
@{lib}/electron@{int}/{,**} r,
@ -48,31 +42,7 @@
owner @{cache_dirs}/ rw,
owner @{cache_dirs}/** rwlk -> @{cache_dirs}/**,
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{user_config_dirs}/electron-flags.conf r,
owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6} rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonCookie w,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonSocket w,
owner @{tmp}/scoped_dir@{rand6}/ rw,
owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w,
owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w,
owner @{tmp}/scoped_dir@{rand6}/SS w,
/dev/shm/ r,
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
@{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
@{sys}/fs/cgroup/user.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
@ -89,15 +59,12 @@
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/gid_map w, # If kernel.unprivileged_userns_clone = 1
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/oom_score_adj rw,
owner @{PROC}/@{pid}/setgroups w, # If kernel.unprivileged_userns_clone = 1
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/statm r,
owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1
deny @{user_share_dirs}/gvfs-metadata/* r,

5
apparmor.d/groups/network/mullvad-gui
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = Mullvad?VPN
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/@{name}
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}
@ -31,10 +32,6 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) {
@{bin}/gsettings rPx,
@{open_path} rPx -> child-open-browsers,
owner @{user_cache_dirs}/dconf/user rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/mullvad-vpn rw,

8
apparmor.d/groups/steam/steam
View file

@ -21,10 +21,12 @@ abi <abi/4.0>,
include <tunables/global>
@{runtime} = SteamLinuxRuntime_{sniper,soldier}
@{domain} = org.chromium.Chromium
@{runtime_name} = sniper soldier
@{runtime} = SteamLinuxRuntime_@{runtime_name} steam-runtime-steamrt
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} steamrt64
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} @{lib_dirs}/steam-runtime-steamrt
@{app_dirs} = @{share_dirs}/steamapps/common/
@{exec_path} = @{share_dirs}/steam.sh

1
apparmor.d/profiles-a-f/deltachat-desktop
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{domain} = org.chromium.Chromium
@{lib_dirs} = @{lib}/deltachat-desktop @{lib}/deltachat /opt/DeltaChat/
@{exec_path} = @{bin}/deltachat-desktop @{lib_dirs}/deltachat-desktop

4
apparmor.d/profiles-a-f/discord
View file

@ -8,6 +8,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = discord
@{domain} = org.chromium.Chromium
@{lib_dirs} = /usr/share/@{name} /opt/@{name}
@{config_dirs} = @{user_config_dirs}/@{name} @{user_config_dirs}/discordptb
@{cache_dirs} = @{user_cache_dirs}/@{name}
@ -48,7 +49,6 @@ profile discord @{exec_path} flags=(attach_disconnected) {
owner @{config_dirs}/@{version}/modules/** m,
owner "@{tmp}/Discord Crashes/" rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw,
owner @{tmp}/discord.sock rw,
owner @{tmp}/net-export/ rw,
@ -57,6 +57,8 @@ profile discord @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/task/@{tid}/comm r,
deny ptrace read,
include if exists <local/discord>
}

2
apparmor.d/profiles-a-f/freetube
View file

@ -8,6 +8,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = {F,f}ree{T,t}ube{,-vue}
@{domain} = org.chromium.Chromium
@{lib_dirs} = @{lib}/@{name} /opt/@{name}
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}
@ -39,7 +40,6 @@ profile freetube @{exec_path} flags=(attach_disconnected) {
@{open_path} rPx -> child-open-strict,
deny @{sys}/devices/@{pci}/usb@{int}/** r,
deny /dev/ r,
include if exists <local/freetube>
}

1
apparmor.d/profiles-g-l/linuxqq
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = QQ
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/QQ/
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}

1
apparmor.d/profiles-m-r/protonmail
View file

@ -8,6 +8,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = proton-mail "Proton Mail"
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/@{name}
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}

1
apparmor.d/profiles-s-z/session-desktop
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = {S,s}ession
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/@{name}
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}

1
apparmor.d/profiles-s-z/signal-desktop
View file

@ -8,6 +8,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = signal-desktop{,-beta}
@{domain} = org.chromium.Chromium
@{lib_dirs} = @{lib}/signal-desktop /opt/Signal{,?Beta}
@{config_dirs} = @{user_config_dirs}/Signal{,?Beta}
@{cache_dirs} = @{user_cache_dirs}/@{name}

3
apparmor.d/profiles-s-z/spotify
View file

@ -8,6 +8,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = spotify
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/@{name}/ /usr/share/@{name}/
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}
@ -57,8 +58,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) {
owner @{cache_dirs}/WidevineCdm/**/libwidevinecdm.so rm,
owner @{config_dirs}/*/WidevineCdm/**/libwidevinecdm.so rm,
owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw,
@{PROC}/@{pid}/net/unix r,
@{PROC}/pressure/* r,
owner @{PROC}/@{pid}/clear_refs w,

1
apparmor.d/profiles-s-z/superproductivity
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = super{p,P}roductivity
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/@{name}
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}

2
apparmor.d/profiles-s-z/vesktop
View file

@ -8,6 +8,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = vesktop
@{domain} = org.chromium.Chromium
@{lib_dirs} = @{lib}/@{name}
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}
@ -33,7 +34,6 @@ profile vesktop @{exec_path} flags=(attach_disconnected) {
@{bin}/speech-dispatcher rPx,
@{open_path} rPx -> child-open,
owner /tmp/.org.chromium.Chromium.@{rand6} mr,
owner @{run}/user/@{uid}/discord-ipc-@{int} rw,
@{sys}/devices/@{pci}/usb@{int}/**/interface r,

1
apparmor.d/profiles-s-z/wechat
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = wechat
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/wechat/
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}

1
apparmor.d/profiles-s-z/wechat-appimage
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = wechat-appimage
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/wechat-appimage/
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}

1
apparmor.d/profiles-s-z/wechat-universal
View file

@ -7,6 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{name} = wechat-universal
@{domain} = org.chromium.Chromium
@{lib_dirs} = /opt/wechat-universal/
@{config_dirs} = @{user_config_dirs}/@{name}
@{cache_dirs} = @{user_cache_dirs}/@{name}

2
apparmor.d/profiles-s-z/wemeet
View file

@ -6,6 +6,8 @@ abi <abi/4.0>,
include <tunables/global>
@{domain} = org.chromium.Chromium
@{exec_path} = @{bin}/wemeet
@{exec_path} += /opt/wemeet/bin/wemeetapp
@{exec_path} += /opt/wemeet/bin/QtWebEngineProcess