felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): rewrite some dbus rules (1).

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-01 20:58:21 +00:00
parent d6888a65c4
commit 6d1ff256af
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
32 changed files with 248 additions and 383 deletions
Download patch file Download diff file Expand all files Collapse all files

28
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -23,24 +23,24 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
ptrace (read) peer=unconfined,
dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
interface=org.freedesktop.{DBus.{Properties,Introspectable},Accounts{,.User}},
dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
member={CheckAuthorization,Changed},
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
dbus bind bus=system name=org.freedesktop.Accounts,
dbus receive bus=system path=/org/freedesktop/Accounts{,/User@{uid}}
interface=org.freedesktop.Accounts*
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/Accounts{,/User@{uid}}
interface=org.freedesktop.DBus.Properties
member=GetAll,
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName,GetConnectionUnixUser}
peer=(name=org.freedesktop.DBus),
dbus bind bus=system
name=org.freedesktop.Accounts,
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
@{exec_path} mr,

8
apparmor.d/groups/freedesktop/colord
View file

@ -35,14 +35,6 @@ profile colord @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.ColorManager
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=polkitd),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.PolicyKit1.Authority
peer=(name=:*, label=polkitd),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixUser,GetConnectionUnixProcessID}

2
apparmor.d/groups/freedesktop/pipewire
View file

@ -36,7 +36,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetConnectionUnixProcessID
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus receive bus=session

6
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -13,7 +13,6 @@ profile pulseaudio @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/consoles>
include <abstractions/dbus-gtk>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -69,11 +68,6 @@ profile pulseaudio @{exec_path} {
member=Free
peer=(name=org.freedesktop.Avahi),
dbus receive bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,RequestName,ReleaseName}
peer=(name=:*),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect

12
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -24,10 +24,12 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
dbus bind bus=session name=org.freedesktop.portal.Desktop,
dbus bind bus=session name=org.freedesktop.background.Monitor,
dbus receive bus=session path=/org/freedesktop/background/monitor
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=gnome-shell),
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/background/monitor
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.DBus),
dbus send bus=session path=/org/freedesktop/impl/portal/PermissionStore
interface=org.freedesktop.DBus.Properties
@ -39,12 +41,10 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Settings
peer=(name=:*, label=xdg-desktop-portal-gnome),
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Settings
member=Read
peer=(name=:*, label=nautilus),
dbus send bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=xdg-document-portal),
@ -54,7 +54,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetConnectionUnixProcessID
member={GetConnectionUnixUser,GetConnectionUnixProcessID}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus receive bus=session

6
apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
View file

@ -30,6 +30,8 @@ profile xdg-desktop-portal-gtk @{exec_path} {
unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/*", label=gnome-shell),
dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gtk,
dbus send bus=system path=/org/freedesktop/Accounts/User@{int}
interface=org.freedesktop.DBus.Properties
member=GetAll,
@ -89,6 +91,10 @@ profile xdg-desktop-portal-gtk @{exec_path} {
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gjs-console),
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.gnome.ScreenSaver
member=GetActive
peer=(name=:*, label=gjs-console),
dbus send bus=session path=/org/gnome/Shell/Introspect
interface=org.freedesktop.DBus.Properties