feat(profile): modernise some profiles.
This commit is contained in:
Alexandre Pujol
parent
40abc98201
commit
683bfed4ad
15 changed files with 197 additions and 631 deletions
|
|
@ -11,19 +11,14 @@ include <tunables/global>
|
|||
profile megasync @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/X>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -40,71 +35,29 @@ profile megasync @{exec_path} {
|
|||
@{bin}/xrdb rPx,
|
||||
@{bin}/xdg-mime rPx,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
|
||||
# Megasync home files
|
||||
owner @{HOME}/ r,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/" rw,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/**" rwkl -> "@{user_share_dirs}/data/Mega Limited/MEGAsync/#@{int}",
|
||||
|
||||
owner @{user_config_dirs}/QtProject.conf r,
|
||||
|
||||
# Sync folder
|
||||
owner @{user_sync_dirs}/ r,
|
||||
owner @{user_sync_dirs}/** rwl -> @{user_sync_dirs}/**,
|
||||
|
||||
# Proc filesystem
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# Autostart
|
||||
owner @{user_config_dirs}/autostart/#@{int} rw,
|
||||
owner @{user_config_dirs}/autostart/megasync.desktop rwl -> @{user_config_dirs}/autostart/#@{int},
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner @{HOME}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/spacefm rPx,
|
||||
owner @{user_config_dirs}/autostart/#@{int} rw,
|
||||
owner @{user_config_dirs}/autostart/megasync.desktop rwl -> @{user_config_dirs}/autostart/#@{int},
|
||||
|
||||
# file_inherit
|
||||
owner "@{user_share_dirs}/data/Mega Limited/" rw,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/**" rwkl -> "@{user_share_dirs}/data/Mega Limited/MEGAsync/#@{int}",
|
||||
|
||||
owner @{user_sync_dirs}/ r,
|
||||
owner @{user_sync_dirs}/** rwl -> @{user_sync_dirs}/**,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner "@{user_share_dirs}/data/Mega Limited/MEGAsync/" r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
@{bin}/spacefm rPx,
|
||||
|
||||
# file_inherit
|
||||
owner "@{user_share_dirs}/data/Mega Limited/MEGAsync/logs/MEGAsync.log" rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/megasync>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,18 +10,14 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/minitube
|
||||
profile minitube @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
|
|
@ -34,18 +30,33 @@ profile minitube @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
# Minitube home files
|
||||
# Be able to turn off the screensaver while playing movies
|
||||
@{bin}/xdg-screensaver rCx -> xdg-screensaver,
|
||||
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/usr/share/minitube/{,**} r,
|
||||
|
||||
/etc/vdpau_wrapper.cfg r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner @{HOME}/vlcsnap-.png rw,
|
||||
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/**" rwl -> "@{user_cache_dirs}/Flavio Tordini/Minitube/**",
|
||||
|
||||
owner "@{user_config_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_config_dirs}/Flavio Tordini/*" rwkl -> "@{user_config_dirs}/Flavio Tordini/#@{int}",
|
||||
owner "@{user_share_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_share_dirs}/Flavio Tordini/Minitube/" rw,
|
||||
owner "@{user_share_dirs}/Flavio Tordini/Minitube/*" rwk,
|
||||
|
||||
# Snapshot
|
||||
owner @{user_pictures_dirs}/*.png rw,
|
||||
owner @{HOME}/vlcsnap-.png rw,
|
||||
|
||||
/usr/share/minitube/{,**} r,
|
||||
owner @{tmp}/qtsingleapp-minitu-* rw,
|
||||
owner @{tmp}/qtsingleapp-minitu-*-lockfile rwk,
|
||||
|
||||
# If one is blocked, the others are probed.
|
||||
deny owner @{HOME}/#@{int} mrw,
|
||||
|
|
@ -53,65 +64,13 @@ profile minitube @{exec_path} {
|
|||
# owner @{tmp}/#@{int} mrw,
|
||||
# owner @{tmp}/.glvnd* mrw,
|
||||
|
||||
# Cache
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/" rw,
|
||||
owner "@{user_cache_dirs}/Flavio Tordini/Minitube/**" rwl -> "@{user_cache_dirs}/Flavio Tordini/Minitube/**",
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
deny /dev/ r,
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
/etc/vdpau_wrapper.cfg r,
|
||||
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
# TMP
|
||||
owner @{tmp}/qtsingleapp-minitu-* rw,
|
||||
owner @{tmp}/qtsingleapp-minitu-*-lockfile rwk,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
|
||||
# Be able to turn off the screensaver while playing movies
|
||||
@{bin}/xdg-screensaver rCx -> xdg-screensaver,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPx,
|
||||
|
||||
# file_inherit
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
profile xdg-screensaver {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
|
@ -133,6 +92,8 @@ profile minitube @{exec_path} {
|
|||
/dev/dri/card@{int} rw,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
include if exists <local/minitube_xdg-screensaver>
|
||||
}
|
||||
|
||||
include if exists <local/minitube>
|
||||
|
|
|
|||
|
|
@ -11,21 +11,16 @@ include <tunables/global>
|
|||
profile psi @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -38,12 +33,11 @@ profile psi @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
@{bin}/aplay rCx -> aplay,
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
@{bin}/gpg{,2} rPx,
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{open_path} rPx -> child-open,
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/psi/{,**} r,
|
||||
|
||||
/etc/debian_version r,
|
||||
|
|
@ -51,8 +45,6 @@ profile psi @{exec_path} {
|
|||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/#@{int} rw,
|
||||
|
|
@ -64,18 +56,17 @@ profile psi @{exec_path} {
|
|||
owner @{user_share_dirs}/psi/** rwk,
|
||||
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/etilqs_@{hex} rw,
|
||||
owner @{tmp}/Psi.* rwl -> /tmp/#@{int},
|
||||
|
||||
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
# file_inherit
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile aplay {
|
||||
|
|
@ -95,42 +86,7 @@ profile psi @{exec_path} {
|
|||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/gpg{,2} mr,
|
||||
|
||||
owner @{HOME}/.gnupg/ rw,
|
||||
owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**,
|
||||
|
||||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/psi_aplay>
|
||||
}
|
||||
|
||||
include if exists <local/psi>
|
||||
|
|
|
|||
|
|
@ -11,21 +11,16 @@ include <tunables/global>
|
|||
profile psi-plus @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -38,12 +33,11 @@ profile psi-plus @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
@{bin}/aplay rCx -> aplay,
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
@{bin}/gpg{,2} rPx,
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{open_path} rPx -> child-open,
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/psi-plus/{,**} r,
|
||||
|
||||
/etc/debian_version r,
|
||||
|
|
@ -62,19 +56,17 @@ profile psi-plus @{exec_path} {
|
|||
owner @{user_share_dirs}/psi+/** rwk,
|
||||
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/etilqs_@{hex} rw,
|
||||
owner @{tmp}/Psi+.* rwl -> /tmp/#@{int},
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
# file_inherit
|
||||
/dev/shm/#@{int} rw,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile aplay {
|
||||
|
|
@ -94,42 +86,7 @@ profile psi-plus @{exec_path} {
|
|||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/gpg{,2} mr,
|
||||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
# file_inherit
|
||||
/dev/dri/card@{int} rw,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/psi-plus_aplay>
|
||||
}
|
||||
|
||||
include if exists <local/psi-plus>
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qbittorrent-nox
|
||||
profile qbittorrent-nox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freeedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
|
|
@ -22,48 +23,37 @@ profile qbittorrent-nox @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
# Qbittorrent home dirs
|
||||
owner @{user_config_dirs}/qBittorrent/ rw,
|
||||
owner @{user_config_dirs}/qBittorrent/** rwkl -> @{user_config_dirs}/qBittorrent/#@{int},
|
||||
owner @{user_share_dirs}/qBittorrent/ rw,
|
||||
owner @{user_share_dirs}/qBittorrent/** rwl -> @{user_share_dirs}/data/qBittorrent/**/#@{int},
|
||||
# Old dir, not recommended to use:
|
||||
deny owner @{user_share_dirs}/data/qBittorrent/ rw,
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{user_torrents_dirs}/ r,
|
||||
owner @{user_torrents_dirs}/** rw,
|
||||
|
||||
# Cache dir
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/#@{int} rw,
|
||||
owner @{user_cache_dirs}/qBittorrent/{,**} rw,
|
||||
|
||||
# Torrent files
|
||||
owner @{user_torrents_dirs}/ r,
|
||||
owner @{user_torrents_dirs}/** rw,
|
||||
owner @{user_config_dirs}/qBittorrent/ rw,
|
||||
owner @{user_config_dirs}/qBittorrent/** rwkl -> @{user_config_dirs}/qBittorrent/#@{int},
|
||||
owner @{user_share_dirs}/qBittorrent/ rw,
|
||||
owner @{user_share_dirs}/qBittorrent/** rwl -> @{user_share_dirs}/data/qBittorrent/**/#@{int},
|
||||
|
||||
/dev/disk/by-label/ r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/usr/share/mime/mime.cache r,
|
||||
/usr/share/mime/types r,
|
||||
owner @{user_share_dirs}/mime/mime.cache r,
|
||||
owner @{user_share_dirs}/mime/types r,
|
||||
|
||||
# TMP
|
||||
owner @{tmp}/qtsingleapp-qBitto-* rw,
|
||||
owner @{tmp}/qtsingleapp-qBitto-*-lockfile rwk,
|
||||
owner @{tmp}/.*/{,s} rw,
|
||||
owner @{tmp}/.qBittorrent/ rw,
|
||||
owner @{tmp}/.qBittorrent/* rwl -> /tmp/.qBittorrent/*,
|
||||
owner @{tmp}/mozilla_*/*.torrent rw,
|
||||
owner @{tmp}/*.torrent rw,
|
||||
owner @{tmp}/.*/{,s} rw,
|
||||
owner @{tmp}/mozilla_*/*.torrent rw,
|
||||
owner @{tmp}/qtsingleapp-qBitto-* rw,
|
||||
owner @{tmp}/qtsingleapp-qBitto-*-lockfile rwk,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/disk/by-label/ r,
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
deny owner @{user_share_dirs}/data/qBittorrent/ rw, # Old dir, not recommended to use
|
||||
|
||||
include if exists <local/qbittorrent-nox>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,18 +10,13 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qnapi
|
||||
profile qnapi @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -39,12 +34,10 @@ profile qnapi @{exec_path} {
|
|||
@{bin}/7z rix,
|
||||
@{lib}/p7zip/7z rix,
|
||||
|
||||
@{bin}/ffprobe rPx,
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{bin}/ffprobe rPx,
|
||||
@{open_path} rPx -> child-open,
|
||||
@{lib}/firefox/firefox rPx,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
|
@ -60,8 +53,6 @@ profile qnapi @{exec_path} {
|
|||
owner @{user_config_dirs}/qnapi.ini.* rwl -> @{user_config_dirs}/#@{int},
|
||||
owner @{user_config_dirs}/qnapi.ini.mlXXXY rwl -> @{user_config_dirs}/#@{int},
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
|
||||
/tmp/ r,
|
||||
owner @{tmp}/@{hex}.* rw,
|
||||
owner @{tmp}/** rw,
|
||||
|
|
@ -73,37 +64,13 @@ profile qnapi @{exec_path} {
|
|||
owner @{tmp}/QNapi.@{int}.tmp.* rwl -> /tmp/#@{int},
|
||||
owner @{tmp}/QNapi.@{int} rw,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
owner /dev/shm/#@{int} rw,
|
||||
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/qnapi>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,19 +10,14 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qpdfview
|
||||
profile qpdfview @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/X>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
@ -34,7 +29,6 @@ profile qpdfview @{exec_path} {
|
|||
@{lib}/firefox/firefox rPUx,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/poppler/** r,
|
||||
/usr/share/djvu/** r,
|
||||
|
||||
|
|
@ -60,10 +54,10 @@ profile qpdfview @{exec_path} {
|
|||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/qpdfview.*.pdf rwl -> /tmp/#@{int},
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/sys/kernel/random/boot_id r,
|
||||
deny owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,19 +10,17 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/qt5ct
|
||||
profile qt5ct @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner @{user_config_dirs}/qt5ct/ rw,
|
||||
owner @{user_config_dirs}/qt5ct/** rwkl -> @{user_config_dirs}/qt5ct/#@{int},
|
||||
|
||||
|
|
@ -35,19 +33,8 @@ profile qt5ct @{exec_path} {
|
|||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}//sys/kernel/random/boot_id r,
|
||||
|
||||
/etc/X11/cursors/*.theme r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/dev/shm/#@{int} rw,
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue