felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update and enforce a few profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-18 14:46:35 +02:00
parent 1fab846875
commit 658c054c47
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
17 changed files with 76 additions and 86 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/profiles-s-z/totem
View file

@ -14,6 +14,7 @@ profile totem @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/common/gnome>
include <abstractions/gstreamer>
include <abstractions/thumbnails-cache-write>
include <abstractions/user-download-strict>
network netlink raw,
@ -67,6 +68,10 @@ profile totem @{exec_path} flags=(attach_disconnected) {
include <abstractions/gstreamer>
capability dac_override,
capability sys_ptrace,
network inet dgram,
network inet6 dgram,
@{bin}/bwrap mr,
@{bin}/totem-video-thumbnailer rix,
@ -78,8 +83,11 @@ profile totem @{exec_path} flags=(attach_disconnected) {
owner @{tmp}/flatpak-seccomp-@{rand6} rw,
owner @{tmp}/gnome-desktop-file-to-thumbnail.* rw,
owner @{tmp}/gnome-desktop-thumbnailer-@{rand6}/{,**} rw,
owner @{tmp}/gnome-desktop-thumbnailer.png rw,
@{PROC}/sys/vm/mmap_min_addr r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/@{tid}/comm w,
/dev/ r,

18
apparmor.d/profiles-s-z/xsane-gimp
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Roman Beslik <me@beroal.in.ua>
# Copyright (C) 2024-2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
@ -10,27 +11,30 @@ include <tunables/global>
profile xsane-gimp @{exec_path} {
include <abstractions/base>
include <abstractions/devices-usb>
include <abstractions/gnome-strict>
signal (receive) set=(term, kill) peer=gimp,
include <abstractions/desktop>
network inet dgram,
network inet6 dgram,
network netlink raw,
signal receive set=(term, kill) peer=gimp,
@{exec_path} mr,
@{system_share_dirs}/gimp/{,**} r,
@{system_share_dirs}/sane/xsane/{,**} r,
@{system_share_dirs}/snmp/mibs/{,**} r, # network
@{system_share_dirs}/snmp/mibs/{,**} r,
/etc/sane.d/{,**} r,
owner @{HOME}/.sane/{,**} rw,
owner @{tmp}/xsane-*-@{rand6} rw,
@{sys}/devices/@{pci}/{model,type,vendor} r,
@{PROC}/sys/dev/parport/{,parport@{int}/{base-addr,irq}} r,
# SCSI
@{sys}/bus/scsi/devices/ r,
@{sys}/devices/@{pci}/{model,type,vendor} r,
@{PROC}/scsi/scsi r,
@{PROC}/sys/dev/parport/{,parport@{int}/{base-addr,irq}} r,
include if exists <local/xsane-gimp>
}