felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-11 17:54:34 +01:00
parent c622f5de93
commit 6539b713fb
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
21 changed files with 66 additions and 86 deletions
Download patch file Download diff file Expand all files Collapse all files

16
apparmor.d/groups/freedesktop/polkit-mate-authentication-agent
View file

@ -11,13 +11,9 @@ include <tunables/global>
profile polkit-mate-authentication-agent @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
signal (send) set=(term, kill) peer=polkit-agent-helper,
@ -26,19 +22,15 @@ profile polkit-mate-authentication-agent @{exec_path} {
@{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
/usr/share/X11/xkb/** r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{HOME}/.Xauthority r,
owner /dev/tty@{int} rw,
@{PROC}/1/cgroup r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fd/ r,
owner /dev/tty@{int} rw,
include if exists <local/polkit-mate-authentication-agent>
}

2
apparmor.d/groups/freedesktop/xdg-dbus-proxy
View file

@ -23,7 +23,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Realtime
member=MakeThreadRealtimeWithPID
member=MakeThread*
peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal),
@{exec_path} mr,

2
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -78,8 +78,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm{,3}/greeter-dconf-defaults r,
owner @{user_config_dirs}/xdg-desktop-portal/* r,
@{user_config_dirs}/kioslaverc r,
owner @{user_config_dirs}/xdg-desktop-portal/* r,
owner @{tmp}/icon* rw,

9
apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 odomingao
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -26,10 +27,10 @@ profile xdg-desktop-portal-hyprland @{exec_path} {
owner /tmp/hypr/\#@{int} rwkl,
owner /tmp/hypr/hyprland-share-picker.conf* rwkl,
/sys/devices/virtual/dmi/id/bios_vendor r,
/sys/devices/virtual/dmi/id/board_vendor r,
/sys/devices/virtual/dmi/id/product_name r,
/sys/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/board_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
owner @{PROC}/@{pid}/cmdline r,

18
apparmor.d/groups/gpg/gpg-agent
View file

@ -27,54 +27,56 @@ profile gpg-agent @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/*.conf r,
owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key{,.tmp} rw,
owner @{HOME}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{HOME}/@{XDG_GPG_DIR}/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{HOME}/@{XDG_GPG_DIR}/sshcontrol r,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/*.conf r,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key{,.tmp} rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/sshcontrol r,
owner @{user_projects_dirs}/**/{.,}gnupg/ rw,
owner @{user_projects_dirs}/**/{.,}gnupg/*.conf r,
owner @{user_projects_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw,
owner @{user_projects_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw,
owner @{user_projects_dirs}/**/{.,}gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{user_projects_dirs}/**/{.,}gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{user_projects_dirs}/**/{.,}gnupg/sshcontrol r,
owner @{run}/user/@{uid}/gnupg/ rw,
owner @{run}/user/@{uid}/gnupg/*.conf r,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/ rw,
owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw,
owner @{run}/user/@{uid}/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{run}/user/@{uid}/gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{run}/user/@{uid}/gnupg/sshcontrol r,
owner @{user_tmp_dirs}/**/{.,}gnupg/ rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/*.conf r,
owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/sshcontrol r,
#aa:only pacman
owner /etc/pacman.d/gnupg/ rw,
owner /etc/pacman.d/gnupg/private-keys-v1.d/ rw,
owner /etc/pacman.d/gnupg/private-keys-v1.d/@{hex}.key rw,
owner /etc/pacman.d/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner /etc/pacman.d/gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner /etc/pacman.d/gnupg/sshcontrol r,
owner /var/lib/*/.gnupg/ rw,
owner /var/lib/*/.gnupg/private-keys-v1.d/ rw,
owner /var/lib/*/.gnupg/private-keys-v1.d/@{hex}.key rw,
owner /var/lib/*/.gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner /var/lib/*/.gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner /var/lib/*/.gnupg/sshcontrol r,
owner /var/lib/*/gnupg/ rw,
owner /var/lib/*/gnupg/private-keys-v1.d/ rw,
owner /var/lib/*/gnupg/private-keys-v1.d/@{hex}.key rw,
owner /var/lib/*/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner /var/lib/*/gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner /var/lib/*/gnupg/sshcontrol r,
#aa:only zypper

1
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -12,7 +12,6 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.UDisks2>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/dconf-write>
include <abstractions/devices-usb>

10
apparmor.d/groups/network/NetworkManager
View file

@ -43,6 +43,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=system name=org.freedesktop.NetworkManager
#aa:dbus talk bus=system name=org.fedoraproject.FirewallD1 label=firewalld
#aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher
#aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved
@ -61,11 +62,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
member=GetManagedObjects
peer=(name=:*, label=bluetoothd),
dbus send bus=system path=/org/fedoraproject/FirewallD1
interface=org.fedoraproject.FirewallD1.zone
member={changeZoneOfInterface,removeInterface}
peer=(name=org.freedesktop.DBus, label=firewalld),
dbus send bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=InterfacesAdded
@ -134,13 +130,13 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/@{pci}/net/*/{,**} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/{,**} r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/stat r,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/net/** rw,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
/dev/rfkill rw,

15
apparmor.d/groups/network/tailscaled
View file

@ -30,20 +30,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
ptrace (read),
dbus send bus=system path=/org/freedesktop/resolve1
interface=org.freedesktop.DBus.Peer
member=Ping
peer=(name=org.freedesktop.resolve1, label=systemd-resolved),
dbus send bus=system path=/org/freedesktop/resolve1
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.resolve1, label=systemd-resolved),
dbus send bus=system path=/org/freedesktop/resolve1
interface=org.freedesktop.resolve1.Manager
member={FlushCaches,SetLink*}
peer=(name=org.freedesktop.resolve1, label=systemd-resolved),
#aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved
@{exec_path} mr,

4
apparmor.d/groups/pacman/makepkg
View file

@ -11,6 +11,9 @@ profile makepkg @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
signal send set=winch peer=pacman,
signal send set=winch peer=pacman//systemctl,
network inet stream,
network inet6 stream,
network inet dgram,
@ -48,6 +51,7 @@ profile makepkg @{exec_path} {
owner @{run}/user/@{uid}/ r,
owner @{run}/user/@{uid}/gnupg/ r,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw,
owner @{run}/user/@{uid}/gnupg/S.scdaemon rw,

6
apparmor.d/groups/pacman/pacman
View file

@ -37,9 +37,10 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
network netlink raw,
network unix stream,
ptrace (read),
ptrace read,
signal (send) set=(usr1) peer=gvfsd,
signal send set=usr1 peer=gvfsd,
signal receive set=winch peer=makepkg//sudo,
@{exec_path} mrix,
@ -194,6 +195,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
capability sys_resource,
signal send set=cont peer=child-pager,
signal receive set=winch peer=makepkg//sudo,
@{pager_path} rPx -> child-pager,