felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): update dbus rules.

Browse source
This commit is contained in:
Alexandre Pujol 2023-09-12 22:55:24 +01:00
parent 600a71a6b1
commit 6c397882ad
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
36 changed files with 206 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

12
apparmor.d/profiles-s-z/thermald
View file

@ -15,6 +15,8 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
capability sys_boot,
dbus (bind) bus=system name=org.freedesktop.thermald,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
@ -25,7 +27,15 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus (bind) bus=system name=org.freedesktop.thermald,
dbus send bus=system path=/net/hadess/PowerProfiles
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=power-profiles-daemon),
dbus send bus=system path=/org/freedesktop/UPower
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=upowerd),
@{exec_path} mr,

50
apparmor.d/profiles-s-z/vlc
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile vlc @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-gtk>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
@ -32,34 +33,32 @@ profile vlc @{exec_path} {
network inet6 stream,
network netlink raw,
signal (receive) set=(term, kill) peer=anyremote//*,
dbus send bus=session path=/org/freedesktop/DBus
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus),
dbus send bus=session path=/org/a11y/bus
dbus send bus=session path=/org/a11y/bus
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.a11y.Bus),
dbus send bus=session path=/StatusNotifierWatcher
dbus send bus=session path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=org.kde.StatusNotifierWatcher),
dbus send bus=session path=/StatusNotifierWatcher
dbus send bus=session path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Properties
member={Get,RegisterStatusNotifierItem}
peer=(name=org.kde.StatusNotifierWatcher),
dbus send bus=session path=/StatusNotifierWatcher
dbus send bus=session path=/StatusNotifierWatcher
interface=org.kde.StatusNotifierWatcher
member=RegisterStatusNotifierItem
peer=(name=org.kde.StatusNotifierWatcher),
dbus send bus=session path=/StatusNotifierItem
dbus send bus=session path=/StatusNotifierItem
interface=org.kde.StatusNotifierItem
member={NewToolTip,NewStatus,NewAttentionIcon,NewTitle,NewStatus,NewIcon}
peer=(name=org.freedesktop.DBus),
@ -74,24 +73,18 @@ profile vlc @{exec_path} {
member={Get,GetAll}
peer=(name=:*),
dbus send bus=session path=/ScreenSaver
dbus send bus=session path=/ScreenSaver
interface=org.freedesktop.ScreenSaver
member={Inhibit,UnInhibit}
peer=(name=org.freedesktop.ScreenSaver),
dbus receive bus=session path=/MenuBar
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*),
dbus send bus=session path=/MenuBar
dbus send bus=session path=/MenuBar
interface=com.canonical.dbusmenu
member={LayoutUpdated,ItemsPropertiesUpdated}
peer=(name=org.freedesktop.DBus),
dbus receive bus=session path=/MenuBar
dbus (send receive) bus=session path=/MenuBar
interface=com.canonical.dbusmenu
member={GetLayout,GetGroupProperties,AboutToShow,AboutToShowGroup,EventGroup,Event}
peer=(name=:*),
dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
@ -102,19 +95,8 @@ profile vlc @{exec_path} {
interface=org.mpris.MediaPlayer2.*
peer=(name="{org.mpris.MediaPlayer2.vlc,org.freedesktop.DBus,:*}"), # all members
# dbus send bus=system path=/
# interface=org.freedesktop.DBus.Peer
# member=Ping,
# peer=(name="org.freedesktop.Avahi"),
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus),
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
dbus send bus=accessibility
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=org.a11y.atspi.Registry),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
@ -122,21 +104,11 @@ profile vlc @{exec_path} {
member=Set
peer=(name=:*),
dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=GetRegisteredEvents
peer=(name=org.a11y.atspi.Registry),
dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=EventListenerDeregistered
peer=(name=:*),
dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=org.a11y.atspi.Registry),
dbus bind bus=session
name=org.kde.StatusNotifierItem-*,

9
apparmor.d/profiles-s-z/wireplumber
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile wireplumber @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>
include <abstractions/nameservice-strict>
include <abstractions/video>
@ -19,6 +21,13 @@ profile wireplumber @{exec_path} {
network bluetooth stream,
network netlink raw,
dbus bind bus=session name=org.freedesktop.ReserveDevice1.Audio0,
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,
/opt/intel/oneapi/{compiler,lib,mkl}/**/ r,

5
apparmor.d/profiles-s-z/wpa-supplicant
View file

@ -29,12 +29,11 @@ profile wpa-supplicant @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus
member=RequestName,
dbus receive bus=system path=/fi/w[0-9]/wpa_supplicant[0-9]
dbus receive bus=system path=/fi/w[0-9]/wpa_supplicant1
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus bind bus=system
name=fi.w1.wpa_supplicant[0-9],
dbus bind bus=system name=fi.w1.wpa_supplicant1,
@{exec_path} mr,