felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): update dbus rules.

Browse source
This commit is contained in:
Alexandre Pujol 2023-09-12 22:55:24 +01:00
parent 600a71a6b1
commit 6c397882ad
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
36 changed files with 206 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

7
apparmor.d/groups/gnome/evolution-addressbook-factory
View file

@ -23,6 +23,8 @@ profile evolution-addressbook-factory @{exec_path} {
network inet6 dgram,
network netlink raw,
dbus bind bus=session name=org.gnome.evolution.dataserver.AddressBook@{int},
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=GetAll,
@ -36,6 +38,11 @@ profile evolution-addressbook-factory @{exec_path} {
member={CheckPermissions,StateChanged,DeviceAdded,DeviceRemoved}
peer=(name=:*, label=NetworkManager),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,
@{exec_path}-subprocess rix,

7
apparmor.d/groups/gnome/evolution-calendar-factory
View file

@ -32,8 +32,13 @@ profile evolution-calendar-factory @{exec_path} {
member={CheckPermissions,StateChanged,DeviceAdded,DeviceRemoved}
peer=(name=:*, label=NetworkManager),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus (send,receive) bus=session path=/org/gnome/evolution/dataserver{,/**}
interface={org.freedesktop.DBus.{Introspectable,ObjectManager,Properties},org.gnome.evolution.dataserver.*},
interface={org.freedesktop.DBus.{ObjectManager,Properties},org.gnome.evolution.dataserver.*},
dbus bind bus=session name=org.gnome.evolution.dataserver.Calendar[0-9]*,

36
apparmor.d/groups/gnome/gjs-console
View file

@ -36,35 +36,37 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/freedesktop/Notifications
dbus send bus=session path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-extension-ding),
dbus send bus=session path=/org/gnome/ScreenSaver
dbus receive bus=session path=/org/gnome/Shell/Screencast
interface=org.freedesktop.DBus.Properties
member=GetAll
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/gnome/ScreenSaver
dbus (send,receive) bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
dbus receive bus=session path=/org/gnome/Shell/Introspect
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=xdg-desktop-portal-*),
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
member=ActiveChanged
peer=(name=org.freedesktop.DBus, label="{gnome-session-binary,gsd-power,xdg-desktop-portal-gtk}"),
dbus receive bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
member={ActiveChanged,WakeUpScreen,GetActive}
peer=(name=:*, label="{gnome-shell,gnome-session-binary,xdg-desktop-portal-*}"),
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
@ -77,6 +79,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
dbus bind bus=session name=org.gnome.Shell.Notifications,
dbus bind bus=session name=org.gnome.Shell.Screencast,
@{exec_path} mr,
@{bin}/ r,
@{bin}/[a-z0-9]* rPUx,

3
apparmor.d/groups/gnome/gnome-disks
View file

@ -9,11 +9,14 @@ include <tunables/global>
@{exec_path} = @{bin}/gnome-disks
profile gnome-disks @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/disks-write>
include <abstractions/gnome>
include <abstractions/user-download-strict>
dbus bind bus=session name=org.gnome.DiskUtility,
@{exec_path} mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,

5
apparmor.d/groups/gnome/gnome-extension-ding
View file

@ -44,9 +44,10 @@ profile gnome-extension-ding @{exec_path} {
member=GetAll
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/org/freedesktop/DBus
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
member=Introspect
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/net/hadess/SwitcherooControl
interface=org.freedesktop.DBus.Properties

6
apparmor.d/groups/gnome/gnome-keyring-daemon
View file

@ -39,6 +39,10 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
member=GetSession
peer=(name=org.freedesktop.login[0-9]),
dbus send bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
peer=(name=org.gnome.SessionManager, label=gnome-session-binary),
dbus (send, receive) bus=session path=/org/gnome/keyring/daemon
interface=org.gnome.keyring.Daemon
peer=(name="{org.gnome.keyring,:*}", label=@{profile_name}), # all members
@ -93,7 +97,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=xdg-desktop-portal),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

4
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -125,9 +125,9 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
member=GetAddress
peer=(name=org.a11y.Bus), # all peer's labels
dbus receive bus=session path=/{,org}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session

32
apparmor.d/groups/gnome/gnome-shell
View file

@ -81,10 +81,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.{DBus.Properties,Accounts*}
member={GetAll,FindUserByName,Changed,PropertiesChanged,FindUserById,ListCachedUsers,UserAdded},
dbus (send,receive) bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
dbus (send,receive) bus=system path=/org/freedesktop/UPower{,**}
interface=org.freedesktop.DBus.Properties
member={GetAll,PropertiesChanged},
dbus (send,receive) bus=system path=/org/freedesktop/UPower{,**}
interface=org.freedesktop.UPower
peer=(name=:*, label=upowerd),
dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
interface=org.freedesktop.{DBus.Properties,GeoClue2.Manager}
member={PropertiesChanged,AddAgent,GetAll},
@ -256,25 +260,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=gsd-media-keys),
dbus send bus=session path=/org/gnome/Shell
dbus (send,receive) bus=session path=/org/gnome/Shell{,/**}
interface=org.gnome.Shell
member=AcceleratorActivated
peer=(name=:*, label=gsd-media-keys),
dbus receive bus=session path=/org/gnome/Shell
interface=org.gnome.Shell
member={GrabAccelerators,UngrabAccelerators}
peer=(name=:*, label=gsd-media-keys),
dbus send bus=session path=/org/gnome/Shell/Introspect
interface=org.gnome.Shell.Introspect
member={RunningApplicationsChanged,WindowsChanged}
peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal-*),
dbus receive bus=session path=/org/gnome/Shell/Introspect
interface=org.gnome.Shell.Introspect
member=GetRunningApplications
peer=(name=:*, label=xdg-desktop-portal-*),
peer=(name=:*),
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
@ -331,7 +319,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
member=GetAppId
peer=(name=:*, label=gnome-session-binary),
dbus send bus=session
dbus (send, receive) bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*), # all paths and peer's labels
@ -386,6 +374,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
member=DescribeAll
peer=(name=:*, label=gnome-extension-ding),
dbus receive bus=system path=/org/freedesktop/ColorManager{,/**}
interface=org.freedesktop.ColorManager
peer=(name=:*, label=colord),
dbus send bus=session path=/com/rastersoft/ding
interface=org.gtk.Actions
member=DescribeAll

22
apparmor.d/groups/gnome/gnome-shell-calendar-server
View file

@ -13,8 +13,26 @@ profile gnome-shell-calendar-server @{exec_path} {
include <abstractions/dconf-write>
include <abstractions/nameservice-strict>
dbus bind bus=session
name=org.gnome.Shell.CalendarServer,
dbus bind bus=session name=org.gnome.Shell.CalendarServer,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus (send receive) bus=session path=/org/gnome/evolution/dataserver/{,**}
interface=org.gnome.evolution.dataserver.CalendarView
peer=(name=:*, label=evolution-calendar-factory),
dbus receive bus=session path=/org/gnome/Shell/CalendarServer
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/gnome/Shell/CalendarServer
interface=org.gnome.Shell.CalendarServer
member=SetTimeRange
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,

4
apparmor.d/groups/gnome/goa-daemon
View file

@ -46,9 +46,9 @@ profile goa-daemon @{exec_path} {
dbus receive bus=session path=/org/gnome/OnlineAccounts
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
peer=(name=:*, label="{gvfs-goa-volume-monitor,goa-daemon,goa-identity-service,unconfined}"),
peer=(name=:*, label="{gvfs-goa-volume-monitor,goa-daemon,goa-identity-service,evolution-source-registry,unconfined}"),
dbus receive bus=session path=/{,org}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/goa-identity-service
View file

@ -27,7 +27,7 @@ profile goa-identity-service @{exec_path} {
member=GetManagedObjects
peer=(name=:*, label=goa-daemon),
dbus receive bus=session path=/{,org}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/tracker-extract
View file

@ -49,7 +49,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
member=ListMountable*
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor

14
apparmor.d/groups/gnome/tracker-miner
View file

@ -44,28 +44,26 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.DBus.Peer
member=Ping
peer=(name=:*, label=tracker-extract),
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.Tracker3.Endpoint
peer=(name=org.freedesktop.DBus, label=tracker-extract), # all members
peer=(name=org.freedesktop.DBus), # all members
dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.Tracker3.Endpoint
peer=(name=:*, label=tracker-extract), # all members
peer=(name=:*), # all members
dbus receive bus=session path=/org/freedesktop/Tracker3/Miner/**
interface=org.freedesktop.Tracker3.Miner
peer=(name=:*, label=tracker-extract), # all members
peer=(name=:*), # all members
dbus receive bus=session path=/{,org}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.freedesktop.Tracker3.Miner.*,
dbus bind bus=session name=org.freedesktop.Tracker3.Miner.*,
@{exec_path} mr,