felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pre-cleanup

Browse source
This commit is contained in:
nobodysu 2022-10-06 01:47:19 +03:00
parent efb3e22cd3
commit 6c46d0a103
28 changed files with 54 additions and 117 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/apt/apt
View file

@ -155,7 +155,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/inhibit/[0-9]*.ref rw,
profile editor {
profile editor flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@ -197,7 +197,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
}
profile dpkg-source {
profile dpkg-source flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/perl>

2
apparmor.d/groups/avahi/avahi-daemon
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/avahi-daemon
profile avahi-daemon @{exec_path} {
profile avahi-daemon @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>

22
apparmor.d/groups/bus/dbus-daemon
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/dbus-daemon
profile dbus-daemon @{exec_path} flags=(attach_disconnected complain) {
profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus>
@ -21,18 +21,18 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected complain) {
capability setuid,
capability sys_resource,
# signal (receive) set=(term hup kill) peer=at-spi-bus-launcher,
# signal (receive) set=(term hup kill) peer=dbus-run-session,
# signal (receive) set=(term hup kill) peer=gdm*,
# signal (send) set=(term hup kill) peer=at-spi-bus-launcher,
# signal (send) set=(term hup kill) peer=at-spi2-registryd,
# signal (send) set=(term hup kill) peer=dconf-service,
# signal (send) set=(term hup kill) peer=xdg-permission-store,
signal (receive) set=(term hup kill) peer=at-spi-bus-launcher,
signal (receive) set=(term hup kill) peer=dbus-run-session,
signal (receive) set=(term hup kill) peer=gdm*,
signal (send) set=(term hup kill) peer=at-spi-bus-launcher,
signal (send) set=(term hup kill) peer=at-spi2-registryd,
signal (send) set=(term hup kill) peer=dconf-service,
signal (send) set=(term hup kill) peer=xdg-permission-store,
# network netlink raw,
network netlink raw,
# network bluetooth stream,
# network bluetooth seqpacket,
network bluetooth stream,
network bluetooth seqpacket,
ptrace (read),

6
apparmor.d/groups/bus/dbus-run-session
View file

@ -12,14 +12,14 @@ profile dbus-run-session @{exec_path} {
include <abstractions/dconf-write>
signal (receive) set=(term, kill, hup) peer=gdm*,
signal (send) set=term peer=dbus-daemon,
signal (send) set=term peer=dbus-daemon,
@{exec_path} mr,
/{usr/,}bin/gnome-session rix,
/{usr/,}bin/gsettings rix,
/{usr/,}bin/dbus-daemon rPx,
/{usr/,}bin/gnome-session rix,
/{usr/,}bin/gnome-shell rPx,
/{usr/,}bin/gsettings rix,
@{libexec}/gnome-session-binary rPx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,

6
apparmor.d/groups/bus/ibus-extension-gtk3
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile ibus-extension-gtk3 @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
@ -26,11 +27,6 @@ profile ibus-extension-gtk3 @{exec_path} {
network inet6 stream,
network netlink raw,
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,RequestName,ReleaseName,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}

6
apparmor.d/groups/bus/ibus-x11
View file

@ -48,10 +48,12 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/var/lib/gdm{3,}/.config/ibus/bus/{,@{hex}-unix{,-wayland}-[0-9]} r,
/var/lib/gdm{3,}/.config/ibus/bus/ r,
/var/lib/gdm{3,}/.config/ibus/bus/@{hex}-unix{,-wayland}-[0-9] r,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
owner @{user_config_dirs}/ibus/bus/{,@{hex}-unix{,-wayland}-[0-9]} r,
owner @{user_config_dirs}/ibus/bus/ r,
owner @{user_config_dirs}/ibus/bus/@{hex}-unix{,-wayland}-[0-9] r,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
owner @{run}/user/@{uid}/gdm/Xauthority r,

2
apparmor.d/groups/freedesktop/pipewire-media-session
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/pipewire-media-session
profile pipewire-media-session @{exec_path} flags=(complain ) {
profile pipewire-media-session @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/dbus-session-strict>

6
apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
View file

@ -12,6 +12,7 @@ profile xdg-desktop-portal-gtk @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
@ -28,11 +29,6 @@ profile xdg-desktop-portal-gtk @{exec_path} {
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.DBus.Properties
member=GetAll,

18
apparmor.d/groups/freedesktop/xorg
View file

@ -11,7 +11,7 @@ include <tunables/global>
@{exec_path} += /{usr/,}bin/Xorg
@{exec_path} += /{usr/,}lib/Xorg{,.wrap}
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}
profile xorg @{exec_path} flags=(attach_disconnected complain) {
profile xorg @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/fontconfig-cache-read>
@ -32,17 +32,17 @@ profile xorg @{exec_path} flags=(attach_disconnected complain) {
# deny capability sys_nice,
#capability sys_tty_config,
# signal (send) set=(usr1),
signal (send) set=(usr1),
# signal (receive) peer=lightdm,
# signal (receive) peer=sddm,
# signal (receive) peer=xinit,
# signal (receive) set=term peer=gdm{,-x-session},
signal (receive) peer=lightdm,
signal (receive) peer=sddm,
signal (receive) peer=xinit,
signal (receive) set=term peer=gdm{,-x-session},
# unix (bind, listen) type=stream addr=@/tmp/.X11-unix/*,
# unix (send, receive, accept) type=stream addr=@/tmp/.X11-unix/*, # all peers
unix (bind, listen) type=stream addr=@/tmp/.X11-unix/*,
unix (send, receive, accept) type=stream addr=@/tmp/.X11-unix/*, # all peers
# network netlink raw,
network netlink raw,
dbus send bus=system path=/org/freedesktop/login[0-9]{,/session/*}
interface=org.freedesktop.{DBus.Properties,login[0-9].Session,login[0-9]*.Manager}

6
apparmor.d/groups/gnome/gdm
View file

@ -65,11 +65,11 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/{usr/,}{s,}prime-switch rPUx,
/{usr/,}{s,}bin/prime-switch rPUx,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/plymouth rPUx,
/{usr/,}bin/plymouth rPx,
/etc/gdm{3,}/PrimeOff/Default rix,
@{libexec}/gdm-session-worker rPUx,
@{libexec}/gdm-session-worker rPx,
/usr/share/gdm/gdm.schemas r,
/usr/share/wayland-sessions/*.desktop r,

2
apparmor.d/groups/gnome/gdm-xsession
View file

@ -56,7 +56,7 @@ profile gdm-xsession @{exec_path} {
# file_inherit
/dev/tty[0-9]* rw,
profile dbus flags=(complain) {
profile dbus {
include <abstractions/base>
/{usr/,}bin/dbus-update-activation-environment mr,

6
apparmor.d/groups/gnome/gnome-control-center-print-renderer
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gnome-control-center-print-renderer @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
@ -20,11 +21,6 @@ profile gnome-control-center-print-renderer @{exec_path} {
include <abstractions/opencl-nvidia>
include <abstractions/vulkan>
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/a11y/bus
interface=org.a11y.Bus
member=GetAddress

6
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -11,6 +11,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
@ -35,11 +36,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
member={RequestName,ReleaseName,UpdateActivationEnvironment,GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus label=dbus-daemon),
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=Hello
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member={CanPowerOff,GetSession,PowerOff,Inhibit,Reboot}

7
apparmor.d/groups/gnome/gnome-session-ctl
View file

@ -9,11 +9,7 @@ include <tunables/global>
@{exec_path} = @{libexec}/gnome-session-ctl
profile gnome-session-ctl @{exec_path} {
include <abstractions/base>
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=Hello
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
include <abstractions/dbus-session-strict>
dbus send bus=session path=/org/freedesktop/systemd[0-9]*
interface=org.freedesktop.systemd[0-9]*.Manager
@ -29,7 +25,6 @@ profile gnome-session-ctl @{exec_path} {
@{exec_path} mr,
owner @{run}/user/@{uid}/bus rw,
owner @{run}/user/@{uid}/gnome-session-leader-fifo r,
@{run}/user/@{uid}/systemd/notify rw,

6
apparmor.d/groups/gnome/gnome-shell
View file

@ -14,6 +14,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/dbus-network-manager-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
@ -48,11 +49,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
unix (send,receive) type=stream addr=none peer=(label=xwayland),
unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-*", label=ibus-daemon),
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/ interface=org.freedesktop.DBus
member=ListNames
peer=(name=org.freedesktop.DBus label=dbus-daemon),

6
apparmor.d/groups/gnome/gsd-color
View file

@ -11,6 +11,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
@ -18,11 +19,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}

6
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -11,6 +11,7 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
@ -18,11 +19,6 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}

6
apparmor.d/groups/gnome/gsd-power
View file

@ -12,6 +12,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
include <abstractions/audio>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/fonts>
include <abstractions/gtk>
@ -21,11 +22,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}

6
apparmor.d/groups/gnome/gsd-wacom
View file

@ -11,6 +11,7 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dconf-write>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
@ -18,11 +19,6 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}

2
apparmor.d/groups/gnome/tracker-extract
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/tracker-extract-3
profile tracker-extract @{exec_path} flags=(complain) {
profile tracker-extract @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>

2
apparmor.d/groups/gnome/tracker-miner
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/tracker-miner-fs-{,control-}3
profile tracker-miner @{exec_path} flags=(attach_disconnected complain) {
profile tracker-miner @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>

2
apparmor.d/groups/gvfs/gvfsd
View file

@ -15,7 +15,7 @@ profile gvfsd @{exec_path} {
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=RequestName
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/gtk/vfs/mounttracker

2
apparmor.d/groups/systemd/systemd-resolved
View file

@ -39,7 +39,7 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/login[0-9]*
interface=org.freedesktop.login[0-9]*.Manager
member=PrepareForSleep
member={PrepareForSleep,PrepareForShutdown}
peer=(name=:*, label=systemd-logind),
dbus bind bus=system

8
apparmor.d/groups/systemd/systemd-sleep
View file

@ -10,19 +10,13 @@ include <tunables/global>
profile systemd-sleep @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/dbus-strict>
include <abstractions/systemd-common>
capability net_admin,
capability sys_admin,
capability sys_resource,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=Hello
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{run}/dbus/system_bus_socket rw,
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,

2
apparmor.d/groups/ubuntu/release-upgrade-motd
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/ubuntu-release-upgrader/release-upgrade-motd
profile release-upgrade-motd @{exec_path} flags=(complain) {
profile release-upgrade-motd @{exec_path} {
include <abstractions/base>
@{exec_path} mr,

16
apparmor.d/profiles-s-z/setpriv
View file

@ -7,28 +7,14 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/setpriv
profile setpriv @{exec_path} flags=(complain) {
profile setpriv @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability setuid,
capability setgid,
@{exec_path} mr,
/{usr/,}bin/[a-z0-9]* rPUx,
/{usr/,}{s,}bin/[a-z0-9]* rPUx,
/etc/gdm{3,}/greeter.dconf-defaults r,
/usr/share/gdm/dconf/{,**} r,
/var/lib/gdm{3,}/ r,
/var/lib/gdm{3,}/greeter-dconf-defaults{,.??????} rw,
@{PROC}/uptime r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/@{pids}/cmdline r,
include if exists <local/setpriv>
}

6
apparmor.d/profiles-s-z/spice-vdagent
View file

@ -11,15 +11,11 @@ profile spice-vdagent @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-accessibility-strict>
include <abstractions/fonts>
include <abstractions/gtk>
include <abstractions/X-strict>
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/gnome/Mutter/DisplayConfig
interface=org.gnome.Mutter.DisplayConfig
member=GetCurrentState

2
apparmor.d/profiles-s-z/udisksd
View file

@ -66,7 +66,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/login[0-9]*
interface=org.freedesktop.login[0-9]*.Manager
member=PrepareForSleep
member={PrepareForSleep,PrepareForShutdown}
peer=(name=:*, label=systemd-logind),
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority