felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): new definition for MOUNTs, add MOUNTDIRS.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-12 22:51:37 +01:00
parent 9493e783ce
commit 779853dc7f
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
62 changed files with 198 additions and 203 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/apps/android-studio
View file

@ -6,8 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{AS_LIBDIR} = @{MOUNTS}/*/android-studio
@{AS_SDKDIR} = @{MOUNTS}/*/SDK
@{AS_LIBDIR} = @{MOUNTS}/android-studio
@{AS_SDKDIR} = @{MOUNTS}/SDK
@{AS_HOMEDIR} = @{HOME}/.AndroidStudio*
@{AS_PROJECTDIR} = @{HOME}/AndroidStudioProjects

6
apparmor.d/groups/apps/atom
View file

@ -87,9 +87,9 @@ profile atom @{exec_path} {
# Git dirs
/ r,
@{MOUNTS}/ r,
owner @{MOUNTS}/*/ r,
owner @{MOUNTS}/*/atom/ r,
owner @{MOUNTS}/*/atom/** rwkl -> @{MOUNTS}/*/atom/**,
owner @{MOUNTS}/ r,
owner @{MOUNTS}/@{XDG_PROJECTS_DIR}/ r,
owner @{MOUNTS}/@{XDG_PROJECTS_DIR}/** rwkl -> @{MOUNTS}/@{XDG_PROJECTS_DIR}/**,
owner @{user_config_dirs}/git/config r,

6
apparmor.d/groups/apps/calibre
View file

@ -78,9 +78,9 @@ profile calibre @{exec_path} {
owner @{HOME}/@{XDG_BOOKS_DIR} rw,
owner @{HOME}/@{XDG_BOOKS_DIR}/** rwkl,
owner @{MOUNTS}/*/@{XDG_BOOKS_DIR}/ r,
owner @{MOUNTS}/*/@{XDG_BOOKS_DIR}*/ rw,
owner @{MOUNTS}/*/@{XDG_BOOKS_DIR}*/** rwkl -> @{MOUNTS}/*/@{XDG_BOOKS_DIR}*/**,
owner @{MOUNTS}/@{XDG_BOOKS_DIR}/ r,
owner @{MOUNTS}/@{XDG_BOOKS_DIR}*/ rw,
owner @{MOUNTS}/@{XDG_BOOKS_DIR}*/** rwkl -> @{MOUNTS}/@{XDG_BOOKS_DIR}*/**,
owner @{user_config_dirs}/calibre/ rw,
owner @{user_config_dirs}/calibre/** rwk,

5
apparmor.d/groups/apps/code
View file

@ -66,9 +66,8 @@ profile code @{exec_path} {
# Git dirs
/ r,
@{MOUNTS}/ r,
owner @{MOUNTS}/*/ r,
owner @{MOUNTS}/*/code/ r,
owner @{MOUNTS}/*/code/** rwkl -> @{MOUNTS}/*/code/**,
owner @{MOUNTS}/@{XDG_PROJECTS_DIR}/ r,
owner @{MOUNTS}/@{XDG_PROJECTS_DIR}/** rwkl -> @{MOUNTS}/@{XDG_PROJECTS_DIR}/**,
/etc/fstab r,

4
apparmor.d/groups/apps/filezilla
View file

@ -56,8 +56,8 @@ profile filezilla @{exec_path} {
/{usr/,}lib/firefox/firefox rPUx,
# FTP share folder
owner @{MOUNTS}/*/ftp/ r,
owner @{MOUNTS}/*/ftp/** rw,
owner @{MOUNTS}/ftp/ r,
owner @{MOUNTS}/ftp/** rw,
# Silencer
/ r,

10
apparmor.d/groups/apt/apt-cdrom
View file

@ -39,11 +39,11 @@ profile apt-cdrom @{exec_path} flags=(complain) {
/media/cdrom[0-9]/dists/**/i18n/Translation-en{,.gz} r,
# For pendrives
@{MOUNTS}/*/*/ r,
@{MOUNTS}/*/*/**/ r,
@{MOUNTS}/*/*/.disk/info r,
@{MOUNTS}/*/*/dists/**/binary-*/Packages{,.gz} r,
@{MOUNTS}/*/*/dists/**/i18n/Translation-en{,.gz} r,
@{MOUNTS}/*/ r,
@{MOUNTS}/*/**/ r,
@{MOUNTS}/*/.disk/info r,
@{MOUNTS}/*/dists/**/binary-*/Packages{,.gz} r,
@{MOUNTS}/*/dists/**/i18n/Translation-en{,.gz} r,
/var/lib/apt/lists/** rw,

10
apparmor.d/groups/gpg/dirmngr
View file

@ -29,11 +29,11 @@ profile dirmngr @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/crls.d/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/crls.d/DIR.txt rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/dirmngr.conf r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/dirmngr_ldapservers.conf r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/crls.d/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/crls.d/DIR.txt rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/dirmngr.conf r,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/dirmngr_ldapservers.conf r,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/crls.d/ rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/crls.d/DIR.txt rw,
owner @{run}/user/@{uid}/gnupg/ rw,
owner @{run}/user/@{uid}/gnupg/S.dirmngr rw,

2
apparmor.d/groups/gpg/gpg
View file

@ -77,7 +77,7 @@ profile gpg @{exec_path} {
# Verify files
owner @{HOME}/** r,
owner @{MOUNTS}/*/** r,
owner @{MOUNTS}/** r,
owner @{PROC}/@{pid}/task/@{tid}/stat rw,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,

12
apparmor.d/groups/gpg/gpg-agent
View file

@ -29,12 +29,12 @@ profile gpg-agent @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{HOME}/@{XDG_GPG_DIR}/sshcontrol r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/gpg-agent.conf r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/sshcontrol r,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/gpg-agent.conf r,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/sshcontrol r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/ rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/gpg-agent.conf r,

2
apparmor.d/groups/gvfs/gvfsd-archive
View file

@ -20,7 +20,7 @@ profile gvfsd-archive @{exec_path} {
owner @{HOME}/**.{tar,tar.gz,zip} r,
owner @{HOME}/**.{iso,img,bin,mdf,nrg} r,
owner @{MOUNTS}/*/**.{iso,img,bin,mdf,nrg} r,
owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
include if exists <local/gvfsd-archive>

2
apparmor.d/groups/gvfs/gvfsd-mtp
View file

@ -24,7 +24,7 @@ profile gvfsd-mtp @{exec_path} {
/usr/share/glib-2.0/schemas/gschemas.compiled r,
owner @{HOME}/{,**} rw,
owner @{MOUNTS}/*/{,**} rw,
owner @{MOUNTS}/{,**} rw,
owner @{run}/user/@{uid}/gvfsd/socket-* rw,

2
apparmor.d/groups/gvfs/gvfsd-recent
View file

@ -19,7 +19,7 @@ profile gvfsd-recent @{exec_path} {
# Full access to user's data
owner @{HOME}/{,**} rw,
owner @{MOUNTS}/*/{,**} rw,
owner @{MOUNTS}/{,**} rw,
owner @{HOME}/.zshenv r,
owner @{user_config_dirs}/user-dirs.dirs r,

2
apparmor.d/groups/gvfs/gvfsd-trash
View file

@ -24,7 +24,7 @@ profile gvfsd-trash @{exec_path} {
# Can restore all user files
owner @{HOME}/{,**} rw,
owner @{MOUNTS}/*/{,**} rw,
owner @{MOUNTS}/{,**} rw,
owner @{run}/user/@{uid}/gvfsd/ rw,
owner @{run}/user/@{uid}/gvfsd/socket-* rw,