diff --git a/apparmor.d/groups/lxqt/lximage-qt b/apparmor.d/groups/lxqt/lximage-qt new file mode 100644 index 000000000..ff5de9488 --- /dev/null +++ b/apparmor.d/groups/lxqt/lximage-qt @@ -0,0 +1,64 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathLXI} = @{bin}/lximage-qt +profile lximage-qt @{exec_pathLXI} { + include + include + include + include + include + include + include + include + include + include + + @{exec_pathLXI} mr, + @{lib}exec/menu-cache/menu-cached mr, + + /usr/share/icons/{,**} r, + /usr/share/desktop-directories/{,**} r, + /usr/share/lximage-qt/translations/{,**} r, + /usr/share/libfm-qt6/translations/libfm-qt_de.qm r, + /usr/share/thumbnailers/{,**} r, + /usr/share/gvfs/remote-volume-monitors/ r, + /usr/share/gvfs/remote-volume-monitors/udisks2.monitor r, + + /etc/fstab r, + /etc/nsswitch.conf r, + /etc/xdg/menus/lxqt-applications.menu r, + + owner @{user_cache_dirs}/thumbnails/normal/** rwk, + owner @{user_config_dirs}/#@{int} rwk, + owner @{user_config_dirs}/QtProject.conf rw, + owner @{user_config_dirs}/QtProject.conf.lock rwk, + owner @{user_config_dirs}/QtProject.conf.@{rand6} rwkl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/lximage-qt/settings.conf rw, + owner @{user_config_dirs}/lximage-qt/settings.conf.lock rwk, + owner @{user_config_dirs}/lximage-qt/QtProject.conf.@{rand6} rwkl -> @{user_config_dirs}/lximage-qt/#@{int}, + owner @{user_config_dirs}/lximage-qt/#@{int} rw, + + @{PROC}/sys/kernel/random/boot_id r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + + owner @{HOME}/.inputrc r, + owner @{HOME}/.bashrc r, + owner @{HOME}/.bash_profile r, + owner @{HOME}/.bash_logout r, + owner @{HOME}/.bash_history r, + owner @{HOME}/.xscreensaver r, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-about b/apparmor.d/groups/lxqt/lxqt-about new file mode 100644 index 000000000..d94c192a5 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-about @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx1} = @{bin}/lxqt-about +profile lxqt-about @{exec_pathlx1} { + include + include + include + include + include + + @{exec_pathlx1} mr, + + /usr/share/icons/{,**} r, + /usr/share/desktop-directories/{,**} r, + + /etc/xdg/menus/lxqt-applications.menu r, + + /dev/tty rw, + + owner /tmp/@{int} r, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-admin-time b/apparmor.d/groups/lxqt/lxqt-admin-time new file mode 100644 index 000000000..c363bbef8 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-admin-time @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx2} = @{bin}/lxqt-admin-time +profile lxqt-admin-time @{exec_pathlx2} { + include + include + include + include + include + include + include + include + + @{exec_pathlx2} mr, + + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-admin-user b/apparmor.d/groups/lxqt/lxqt-admin-user new file mode 100644 index 000000000..cc77562b4 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-admin-user @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx3} = @{bin}/lxqt-admin-user +profile lxqt-admin-user @{exec_pathlx3} { + include + include + include + include + include + include + include + include + include + + @{exec_pathlx3} mr, + + @{bin}/pkexec rPx, + @{bin}/usermod rPx, + + /etc/shells r, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-admin-user-helper b/apparmor.d/groups/lxqt/lxqt-admin-user-helper new file mode 100644 index 000000000..0f39b7d35 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-admin-user-helper @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx4} = @{bin}/lxqt-admin-user-helper +profile lxqt-admin-user-helper @{exec_pathlx4} { + include + include + include + include + include + include + include + include + + @{exec_pathlx4} mr, + + @{bin}/usermod rPx, + + owner @{sh_path} r, + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-archiver b/apparmor.d/groups/lxqt/lxqt-archiver new file mode 100644 index 000000000..9aaf3f32e --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-archiver @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path995} = @{bin}/lxqt-archiver +profile lxqt-archiver @{exec_path995} { + include + include + include + include + include + include + include + include + + @{exec_path995} mr, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-backlight_backend b/apparmor.d/groups/lxqt/lxqt-backlight_backend new file mode 100644 index 000000000..37a1be5de --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-backlight_backend @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path998} = @{bin}/lxqt-backlight_backend +profile lxqt-backlight_backend @{exec_path998} { + include + include + include + include + include + include + include + include + + @{exec_path998} mr, + + @{sys}/class/backlight/ r, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/ r, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/max_brightness r, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/bl_power r, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/actual_brightness r, + owner @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/brightness rw, + @{sys}/devices/@{pci_bus}/**/**/drm/card@{int}/card@{int}-eDP-1/amdgpu_bl@{int}/* r, + owner @{sys}/devices/@{pci_bus}/**/**/drm/card@{int}/card@{int}-eDP-1/amdgpu_bl@{int}/brightness rw, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config b/apparmor.d/groups/lxqt/lxqt-config new file mode 100644 index 000000000..b3f5d9e22 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config @@ -0,0 +1,60 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx5} = @{bin}/lxqt-config +profile lxqt-config @{exec_pathlx5} { + include + include + include + include + include + include + include + include + include + + @{exec_pathlx5} mr, + + @{bin}/lxqt-admin-user rPx, + @{bin}/ibus-setup rPx, + @{bin}/lxqt-config-monitor rPx, + @{bin}/pcmanfm-qt rPx, + @{bin}/lxqt-admin-time rPx, + @{bin}/lxqt-config-input rPx, + @{bin}/lxqt-config-locale rPx, + @{bin}/lxqt-config-brightness rPx, + @{bin}/lxqt-config-session rPx, + @{bin}/lxqt-config-file-associations rPx, + @{bin}/lxqt-config-powermanagement rPx, + @{bin}/lxqt-config-appearance rPx, + @{bin}/lxqt-config-globalkeyshortcuts rPx, + @{bin}/lxqt-config-notificationd rPx, + @{bin}/obconf-qt rPx, + @{bin}/nm-connection-editor rPx, + @{bin}/pavucontrol rPx, + @{bin}/pavucontrol-qt rPx, + @{bin}/system-config-printer rPx, + @{bin}/nm-connection-editor rPx, + @{bin}/ControlPanel rPx, + + /etc/xdg/menus/lxqt-config.menu r, + + /usr/share/desktop-directories/lxqt-* r, + + owner @{user_config_dirs}/lxqt/lxqt-config.conf.lock rwk, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + @{PROC}/sys/kernel/random/boot_id r, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-appearance b/apparmor.d/groups/lxqt/lxqt-config-appearance new file mode 100644 index 000000000..b21b357d8 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-appearance @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx6} = @{bin}/lxqt-config-appearance +profile lxqt-config-appearance @{exec_pathlx6} { + include + include + include + include + include + include + include + include + include + include + include + + @{exec_pathlx6} mr, + @{bin}/gsettings rPx, + @{bin}/pcmanfm-qt rPx, + + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/pcmanfm-qt/lxqt/settings.conf r, + + owner /tmp/#@{int} rw, + owner /tmp/lxqt-config-appearance.@{rand6} rwl -> /tmp/#@{int}, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-brightness b/apparmor.d/groups/lxqt/lxqt-config-brightness new file mode 100644 index 000000000..4f90c5d3d --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-brightness @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx7} = @{bin}/lxqt-config-brightness +profile lxqt-config-brightness @{exec_pathlx7} { + include + include + include + include + include + include + include + include + + @{exec_pathlx7} mr, + @{bin}/pkexec rpx, + + @{sh_path} rix, + + owner @{HOME}/ r, + + owner /tmp/{,**} r, + + @{sys}/class/backlight/ r, + @{sys}/devices/@{pci_bus}/**/**/drm/card@{int}/card@{int}-eDP-@{int}/amdgpu_bl@{int}/* rw, + @{sys}/devices/@{pci_bus}/**/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/* rw, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-file-associations b/apparmor.d/groups/lxqt/lxqt-config-file-associations new file mode 100644 index 000000000..637ec2a01 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-file-associations @@ -0,0 +1,35 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx18} = @{bin}/lxqt-config-file-associations +profile lxqt-config-file-associations @{exec_pathlx18} { + include + include + include + include + include + include + include + include + + @{exec_pathlx18} mr, + + owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/mimeapps* rwk, + owner @{user_config_dirs}/lxqt-* rwk, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/#@{int} rwk, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-globalkeyshortcuts b/apparmor.d/groups/lxqt/lxqt-config-globalkeyshortcuts new file mode 100644 index 000000000..77c3cadf2 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-globalkeyshortcuts @@ -0,0 +1,33 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx8} = @{bin}/lxqt-config-globalkeyshortcuts +profile lxqt-config-globalkeyshortcuts @{exec_pathlx8} { + include + include + include + include + include + include + include + include + include + + @{exec_pathlx8} mr, + + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-input b/apparmor.d/groups/lxqt/lxqt-config-input new file mode 100644 index 000000000..26ab48f75 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-input @@ -0,0 +1,64 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx9} = @{bin}/lxqt-config-input +profile lxqt-config-input @{exec_pathlx9} { + include + include + include + include + include + include + include + include + include + include + include + include + include + include + + signal (read) set=(kill,term) peer=lxqt-session, + + @{exec_pathlx9} mr, + + @{bin}/setxkbmap rix, + + /etc/udev/udev.conf r, + + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + @{run}/udev/data/c@{int}:* r, + @{run}/udev/data/b@{int}:* r, + @{run}/udev/data/+sound:card@{int} r, + @{run}/udev/data/+bluetooth:* r, + @{run}/udev/data/+platform:* r, + @{run}/udev/data/+acpi:* r, + @{run}/udev/data/+i2c:* r, + @{run}/udev/data/+backlight:* r, + @{run}/udev/data/+leds:* r, + @{run}/udev/data/n@{int} r, + @{run}/udev/data/+input:* r, + @{run}/udev/data/+dmi:* r, + @{run}/udev/data/+drm:* r, + @{run}/udev/data/+pci:* r, + @{run}/udev/data/+rfkill:* r, + + @{sys}/bus/** r, + @{sys}/class/** r, + @{sys}/devices/** r, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-locale b/apparmor.d/groups/lxqt/lxqt-config-locale new file mode 100644 index 000000000..616cd27eb --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-locale @@ -0,0 +1,33 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx10} = @{bin}/lxqt-config-locale +profile lxqt-config-locale @{exec_pathlx10} { + include + include + include + include + include + include + include + include + + @{exec_pathlx10} mr, + + owner @{user_config_dirs}/lxqt/* r, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-monitor b/apparmor.d/groups/lxqt/lxqt-config-monitor new file mode 100644 index 000000000..f519f5064 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-monitor @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx11} = @{bin}/lxqt-config-monitor +profile lxqt-config-monitor @{exec_pathlx11} { + include + include + include + include + include + include + include + include + + signal (read) set=(kill,term) peer=lxqt-session, + + @{exec_pathlx11} mr, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-notificationd b/apparmor.d/groups/lxqt/lxqt-config-notificationd new file mode 100644 index 000000000..5811d9258 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-notificationd @@ -0,0 +1,36 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx12} = @{bin}/lxqt-config-notificationd +profile lxqt-config-notificationd @{exec_pathlx12} { + include + include + include + include + include + include + include + + @{exec_pathlx12} mr, + + /etc/machine-id r, + + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/lxqt/ r, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/#@{int} r, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-powermanagement b/apparmor.d/groups/lxqt/lxqt-config-powermanagement new file mode 100644 index 000000000..770e65361 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-powermanagement @@ -0,0 +1,42 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx14} = @{bin}/lxqt-config-powermanagement +profile lxqt-config-powermanagement @{exec_pathlx14} { + include + include + include + include + include + include + include + include + include + + @{exec_pathlx14} mr, + + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + @{sys}/class/backlight/ r, + @{sys}/devices/@{pci_bus}/**/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/* rw, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/ r, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/max_brightness r, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/bl_power r, + @{sys}/devices/@{pci_bus}/0000:00:02.0/drm/card@{int}/card@{int}-eDP-@{int}/intel_backlight/actual_brightness r, + @{sys}/devices/@{pci_bus}/**/**/drm/card@{int}/card@{int}-eDP-1/amdgpu_bl@{int}/* r, + + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-printer b/apparmor.d/groups/lxqt/lxqt-config-printer new file mode 100644 index 000000000..07e1f6553 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-printer @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx15} = @{bin}/lxqt-config-printer +profile lxqt-config-printer @{exec_pathlx15} { + include + include + include + include + include + include + include + include + + @{exec_pathlx15} mr, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-config-session b/apparmor.d/groups/lxqt/lxqt-config-session new file mode 100644 index 000000000..07de7ac11 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-session @@ -0,0 +1,51 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx16} = @{bin}/lxqt-config-session +profile lxqt-config-session @{exec_pathlx16} { + include + include + include + include + include + include + include + include + include + include + include + include + + @{exec_pathlx16} mr, + + /usr/share/libfm-qt6/translations/libfm-qt_de.qm r, + /usr/share/gvfs/remote-volume-monitors/ r, + /usr/share/gvfs/remote-volume-monitors/udisks2.monitor r, + + /etc/fstab r, + /etc/xdg/autostart/ r, + /etc/xdg/autostart/** r, + + owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/QtProject.conf.@{rand6} rwkl, + owner @{user_config_dirs}/QtProject.conf.lock rwk, + owner @{user_config_dirs}/autostart/*.desktop r, + owner @{user_config_dirs}/autostart/lxqt-config-monitor-autostart.desktop r, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/user-dirs.dirs rw, + + owner /tmp/@{int} r, + + @{PROC}/sys/kernel/random/boot_id r, + owner @{PROC}/@{pid}/mountinfo r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-globalkeysd b/apparmor.d/groups/lxqt/lxqt-globalkeysd new file mode 100644 index 000000000..7ddfe5ba2 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-globalkeysd @@ -0,0 +1,43 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx20} = @{bin}/lxqt-globalkeysd +profile lxqt-globalkeysd @{exec_pathlx20} { + include + include + include + include + include + include + include + include + + @{exec_pathlx20} mr, + + @{bin}/screengrab rpx, + @{bin}/lxqt-config-brightness rpx, + + /usr/share/lxqt/globalkeyshortcuts.conf rw, + + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/lxqt/* rwk, + owner @{user_config_dirs}/lxqt/globalkeyshortcuts.conf.lock wrk, + owner @{user_config_dirs}/lxqt/#@{int} wr, + owner @{user_config_dirs}/lxqt/globalkeyshortcuts.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + /dev/tty rw, + + owner /tmp/@{int} r, + + @{PROC}/sys/kernel/random/boot_id r, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-leave b/apparmor.d/groups/lxqt/lxqt-leave new file mode 100644 index 000000000..59a6189f0 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-leave @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx21} = @{bin}/lxqt-leave +profile lxqt-leave @{exec_pathlx21} { + include + include + include + include + include + include + include + include + include + + @{exec_pathlx21} mr, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-notificationd b/apparmor.d/groups/lxqt/lxqt-notificationd new file mode 100644 index 000000000..eb2c3a20b --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-notificationd @@ -0,0 +1,58 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx112} = @{bin}/lxqt-notificationd +profile lxqt-notificationd @{exec_pathlx112} { + include + include + include + include + include + include + include + include + include + + dbus receive + bus=session + path="/org/freedesktop/Notifications" + interface="org.freedesktop.DBus.Introspectable" + peer=(name=":[0-9]*.[0-9]*"), + dbus send + bus=session + path="/org/freedesktop/Notifications" + interface="org.freedesktop.Notifications" + peer=(name="org.freedesktop.DBus"), + dbus receive + bus=session + path="/org/freedesktop/Notifications" + interface="org.freedesktop.Notifications" + peer=(name=":[0-9]*.[0-9]*"), + + @{exec_pathlx112} mr, + + /etc/nsswitch.conf r, + + /var/lib/dpkg/info/lxqt-notifications.conffiles r, + + owner @{user_cache_dirs}/lxqt-notificationd/** rwk, + owner @{user_cache_dirs}/lxqt-notificationd/#@{int} rw, + owner @{user_cache_dirs}/lxqt-notificationd/unattended.list.@{rand6} rwkl -> @{user_cache_dirs}/lxqt-notificationd/#@{int}, + owner @{user_cache_dirs}/mesa_shader_cache/index rwk, + + owner @{user_config_dirs}/lxqt/globalkeyshortcuts.conf.@{rand6} rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/{,**} r, + + @{PROC}/sys/kernel/random/boot_id r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-openssh-askpass b/apparmor.d/groups/lxqt/lxqt-openssh-askpass new file mode 100644 index 000000000..4a7e0b39a --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-openssh-askpass @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx23} = @{bin}/lxqt-openssh-askpass +profile lxqt-openssh-askpass @{exec_pathlx23} { + include + include + include + include + include + include + include + include + + @{exec_pathlx23} mr, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-panel b/apparmor.d/groups/lxqt/lxqt-panel new file mode 100644 index 000000000..b501afbab --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-panel @@ -0,0 +1,89 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx24} = @{bin}/lxqt-panel +profile lxqt-panel @{exec_pathlx24} { + include + include + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network inet dgram, + network inet stream, + network netlink raw, + network packet dgram, + + @{exec_pathlx24} mr, + + @{bin}/exo-open rix, + @{bin}/nm-connection-editor rPx, + @{bin}/xdg-open rPx, + + @{bin}/ControlPanel rPx, + + /usr/lib{,32,64}/lxqt-panel/*.so mr, # LXQT-Plugins + /usr/lib{,32,64}/lxqt-config/*.so mr, # LXQT-Plugins + + /usr/share/lxqt/helpers/*.desktop r, + /usr/share/lxqt/panel/plugins/{,*.desktop} r, + /usr/share/desktop-directories/{,**} r, + /usr/share/X11/locale/locale.alias r, + /usr/share/lxqt/themes/{,**} r, + + /etc/fstab r, + /etc/udev/udev.conf r, + /etc/machine-id r, + /etc/xdg/lxqt-qtxdg.conf r, + /etc/xdg/menus/**.menu r, + /etc/xdg/menus/applications-merged/ r, + /etc/xdg/ui/uistandards.rc r, + + /var/lib/dbus/machine-id r, + + /opt/tor/tor-browser/Browser/browser/chrome/icons/default/*.png r, + /opt/tormedium/tor-browser/Browser/browser/chrome/icons/default/*.png r, + + owner @{HOME}/.config/menus/**.menu rw, + owner @{HOME}/.config/menus/applications-merged/ r, + owner @{HOME}/Desktop/** r, + owner @{HOME}/.local/share/desktop-directories/*.directory r, + owner @{HOME}/.local/share/gvfs-metadata/{,*} r, + + owner @{user_config_dirs}/lxqt/{,**} rw, + owner @{user_config_dirs}/lxqt/panel.conf.lock rwk, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/pulse/{,**} rwk, + owner @{user_config_dirs}/lxqt/globalkeyshortcuts.conf.@{rand6} rwk, + owner @{user_config_dirs}/ibus/bus/{,**} rw, + + @{run}/udev/data/* r, + + @{sys}/class/i2c-adapter/ r, + @{sys}/devices/@{pci_bus}/0000:00:*/ata@{int}/host@{int}/**/**/**/**/**/* r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{cur,min,max}_freq r, + @{sys}/devices/@{pci_bus}/**/**/nvme/nvme0/nvme0n1/nvme0n1p4/uevent r, + @{sys}/devices/@{pci_bus}/**/**/usb@{int}/** r, + + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/net/dev r, + owner @{PROC}/@{pid}/mounts r, + + /dev/tty rw, + /dev/tty@{int} rw, + /dev/pts/[0-9]* rw, + /dev/snd/controlC[0-9]* rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-policykit-agent b/apparmor.d/groups/lxqt/lxqt-policykit-agent new file mode 100644 index 000000000..ec0f7bb28 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-policykit-agent @@ -0,0 +1,54 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx25} = @{lib}/@{multiarch}/lxqt-policykit-agent-[0-9] +@{exec_pathlx25} += @{bin}/lxqt-policykit-agent +profile lxqt-policykit-agent @{exec_pathlx25} { + include + include + include + include + include + include + include + include + include + + signal (send) set=(term, kill) peer=polkit-agent-helper, + + @{exec_pathlx25} mr, + + @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx, + + /usr/share/lxqt/translations/lxqt-policykit-agent/lxqt-policykit-agent_de.qm r, + + /etc/machine-id r, + + /var/lib/dbus/machine-id r, + + owner @{user_cache_dirs}/icon-cache.kcache rw, + owner @{user_config_dirs}/qt5ct/{,**} r, + + owner /tmp/#@{int} rw, + owner /tmp/lxqt-policykit-agent-[0-9].* rwl -> /tmp/#@{int}, + + @{run}/systemd/users/@{uid} r, + + @{sys}/devices/system/node/ r, + @{sys}/devices/system/node/node@{int}/meminfo r, + + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/sys/kernel/core_pattern r, + + /dev/shm/#@{int} rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-powermanagement b/apparmor.d/groups/lxqt/lxqt-powermanagement new file mode 100644 index 000000000..9a102bad9 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-powermanagement @@ -0,0 +1,38 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx266} = @{bin}/lxqt-powermanagement +profile lxqt-powermanagement @{exec_pathlx266} flags=(attach_disconnected) { + include + include + include + include + include + include + include + + network netlink raw, + + @{exec_pathlx266} mr, + + @{bin}/xset rPx, + + /etc/udev/udev.conf r, + /etc/fstab r, + + owner /tmp/@{int} r, + + @{run}/systemd/inhibit/* rw, + + owner @{PROC}/@{pid}/mounts r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-runner b/apparmor.d/groups/lxqt/lxqt-runner new file mode 100644 index 000000000..04b9b6a2a --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-runner @@ -0,0 +1,41 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx27} = @{bin}/lxqt-runner +profile lxqt-runner @{exec_pathlx27} { + include + include + include + include + include + include + include + + @{exec_pathlx27} mr, + + /usr/share/icons/ r, + /usr/share/icons/{,**} r, + /usr/share/desktop-directories/ r, + /usr/share/desktop-directories/{,**} r, + + /etc/xdg/menus/lxqt-applications.menu r, + + owner @{user_config_dirs}/lxqt/lxqt-runner.conf.lock rwk, + owner @{user_config_dirs}/lxqt/#@{int} rw, + owner @{user_config_dirs}/lxqt/lxqt-runner.conf.@{rand6} rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + # only needed if tor is installed on /opt + owner /opt/*/**/*.png r, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/groups/lxqt/lxqt-session b/apparmor.d/groups/lxqt/lxqt-session new file mode 100644 index 000000000..9216c24ca --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-session @@ -0,0 +1,130 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathlx771} = @{bin}/lxqt-session +profile lxqt-session @{exec_pathlx771} { + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + + signal (send), + signal (receive) set=(kill, term) peer=startlxqt, + signal (receive) set=(kill, term) peer=sddm, + + ptrace (read), + + network netlink raw, + + @{exec_pathlx771} mr, + + @{sh_path} rix, + @{bin}/sed rix, + @{bin}/readlink rix, + @{bin}/dirname rix, + @{bin}/system-config-printer-applet rPx, + @{bin}/lxqt-config-input rPx, + @{bin}/lxqt-session-settings rPx, + @{bin}/lxqt-globalkeysd rPx, + @{bin}/lxqt-panel rPx, + @{bin}/lxqt-policykit-agent rPx, + @{bin}/lxqt-runner rPx, + @{bin}/lxqt-notificationd rPx, + @{bin}/lxqt-powermanagement rPx, + @{bin}/lxqt-config rPx, + @{bin}/lxqt-leave rPx, + @{bin}/lxqt-about rPx, + @{bin}/dbus-send rPUx, + @{bin}/dbus-update-activation-environment rCx -> dbus, + @{bin}/systemctl rCx -> systemctl, + + @{bin}/pavucontrol rPx, + @{bin}/pulseaudio rPx, + @{bin}/python3.@{int} rPx, + @{lib}/python3.@{int} rPx, + @{bin}/xfe rPx, + @{bin}/nm-connection-editor rPx, + @{bin}/nm-applet rPx, + @{bin}/nm-tray rPx, + @{bin}/pcmanfm-qt rPx, + @{bin}/openbox rix, + @{bin}/dconf-editor rPx, + @{bin}/setxkbmap rix, + @{bin}/start-pulseaudio-x11 rPx, + @{bin}/xrdb rPx, + @{bin}/xdg-user-dirs-update rPx, + /usr/lib/{/,x86_64-linux-gnu/}tumbler-1/tumblerd rPx, + + /usr/share/ r, + /usr/share/mime/ r, + /usr/share/cursors/ r, + /usr/share/backintime/common/* r, + /usr/share/desktop-directories/* r, + /usr/share/system-config-printer/* r, + + /etc/xdg/ r, + /etc/xdg/autostart/ r, + /etc/xdg/autostart/*.desktop r, + /etc/xdg/menus/lxqt-* r, + /etc/xdg/openbox/* r, + /etc/udev/udev.conf r, + + owner @{HOME}/.local/share/ r, + owner @{HOME}/.config/ r, + owner @{HOME}/.config/autostart/ r, + owner @{HOME}/.config/autostart/* rw, + owner @{user_cache_dirs}/openbox/openbox.log rwk, + owner @{user_config_dirs}/mimeapps.list{,.@{rand6}} rw, + owner @{user_config_dirs}/dconf/user r, + owner @{user_config_dirs}/openbox/rc.xml r, + owner @{user_share_dirs}/sddm/xorg-session.log rw, + + @{PROC}/ r, + @{PROC}/uptime r, + @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/stat r, + + @{run}/systemd/inhibit/** rw, + + include if exists + + profile systemctl { + include + include + + include if exists + } + + profile dbus { + include + include + + @{bin}/dbus-update-activation-environment mr, + + owner @{user_share_dirs}/sddm/xorg-session.log rw, + + include if exists + } + +} + diff --git a/apparmor.d/groups/lxqt/startlxqt b/apparmor.d/groups/lxqt/startlxqt new file mode 100644 index 000000000..86938ba03 --- /dev/null +++ b/apparmor.d/groups/lxqt/startlxqt @@ -0,0 +1,87 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_pathstlx} = @{bin}/startlxqt +profile startlxqt @{exec_pathstlx} { + include + include + include + include + + signal (receive) set=(term) peer=sddm, + + @{exec_pathstlx} mr, + + @{bin}/xrdb rPx, + @{bin}/xsetroot rPx, + @{bin}/xprop rpx, + @{bin}/mkdir rix, + @{bin}/dbus-launch rPx, + @{bin}/lxqt-session rPx, + @{sh_path} rix, + + /usr/share/color-schemes/{,**} r, + /usr/share/desktop-directories/{,**} r, + /usr/share/icu/@{int}.@{int}/*.dat r, + /usr/share/knotifications5/{,**} r, + /usr/share/kservices5/{,**} r, + /usr/share/kservicetypes5/{,**} r, + /usr/share/mime/{,**} r, + /usr/share/plasma/{,**} r, + + /etc/locale.alias r, + /etc/machine-id r, + /etc/xdg/kcminputrc r, + /etc/xdg/kdeglobals r, + /etc/xdg/menus/{,**} r, + + @{HOME}/ r, + owner @{HOME}/.Xauthority r, + + owner @{user_cache_dirs}/ rw, + owner @{user_cache_dirs}/#@{int} rw, + owner @{user_cache_dirs}/kcrash-metadata/ rw, + @{user_cache_dirs}/ksycoca5_* rwkl -> @{user_cache_dirs}/#@{int}, + owner @{user_cache_dirs}/plasma-svgelements rw, + + owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/gtkrc rl, + owner @{user_config_dirs}/gtkrc-2.0 rl, + owner @{user_config_dirs}/kcminputrc r, + owner @{user_config_dirs}/lxqt/ rw, + owner @{user_config_dirs}/lxqt/** rwkl -> @{user_config_dirs}/kdedefaults/**, + owner @{user_config_dirs}/kdeglobals.lock rwk, + owner @{user_config_dirs}/kdeglobals{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/ksplashrc r, + owner @{user_config_dirs}/kwinkdeglobalsrc.lock rwk, + owner @{user_config_dirs}/menus/{,**} r, + owner @{user_config_dirs}/plasma-localerc rwl, + owner @{user_config_dirs}/plasma-localerc.lock rwk, + owner @{user_config_dirs}/plasma-workspace/env/ r, + owner @{user_config_dirs}/startkderc r, + owner @{user_config_dirs}/Trolltech.conf rwl, + owner @{user_config_dirs}/Trolltech.conf.lock rwk, + + owner @{user_share_dirs}/kservices5/{,**} r, + owner @{user_share_dirs}/sddm/wayland-session.log rw, + owner @{user_share_dirs}/sddm/xorg-session.log rw, + + owner /tmp/#@{int} rw, + owner /tmp/startlxqt.@{rand6} rwl -> /tmp/#@{int}, + + owner @{run}/user/@{uid}/ r, + @{run}/user/@{uid}/xauth_@{rand6} rl, + + @{PROC}/sys/kernel/core_pattern r, + @{PROC}/sys/kernel/random/boot_id r, + owner @{PROC}/@{pid}/maps r, + + + /dev/tty rw, + /dev/tty@{int} rw, +}