felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general updtae.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-18 18:10:27 +01:00
parent cc139f1144
commit 7a53fc3a99
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
27 changed files with 158 additions and 184 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox
View file

@ -7,8 +7,10 @@ abi <abi/3.0>,
include <tunables/global>
@{name} = signal-desktop{,-beta}
@{lib_dirs} = @{lib}/signal-desktop /opt/Signal{,?Beta}
@{config_dirs} = @{user_config_dirs}/Signal{,?Beta}
@{cache_dirs} = @{user_cache_dirs}/@{name}
@{exec_path} = @{lib_dirs}/chrome-sandbox
profile signal-desktop-chrome-sandbox @{exec_path} {
@ -19,7 +21,7 @@ profile signal-desktop-chrome-sandbox @{exec_path} {
@{exec_path} mr,
@{lib_dirs}/signal-desktop{,-beta} rPx,
@{lib_dirs}/@{name} rPx,
@{PROC}/@{pid}/ r,
@{PROC}/@{pid}/oom_adj w,

1
apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper
View file

@ -17,7 +17,6 @@ profile spice-client-glib-usb-acl-helper @{exec_path} {
@{exec_path} mr,
@{PROC}/sys/kernel/cap_last_cap r,
owner @{PROC}/@{pid}/stat r,
include if exists <local/spice-client-glib-usb-acl-helper>

2
apparmor.d/profiles-s-z/switcherooctl
View file

@ -12,7 +12,7 @@ profile switcherooctl @{exec_path} {
include <abstractions/bus-system>
include <abstractions/python>
#aa:dbus own bus=system name=net.hadess.SwitcherooControl
#aa:dbus talk bus=system name=net.hadess.SwitcherooControl label=switcheroo-control
@{exec_path} mr,

3
apparmor.d/profiles-s-z/tomb
View file

@ -115,9 +115,10 @@ profile tomb @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability sys_admin,
umount @{MOUNTS}/{,*/},
umount @{MOUNTS}/{,**/},
@{bin}/umount mr,

7
apparmor.d/profiles-s-z/udisksd
View file

@ -11,8 +11,6 @@ include <tunables/global>
profile udisksd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.login1>
include <abstractions/bus/org.freedesktop.PolicyKit1>
include <abstractions/disks-write>
include <abstractions/nameservice-strict>
@ -60,9 +58,11 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
umount @{run}/udisks2/temp-mount-*/,
umount /media/cdrom@{int}/,
signal (receive) set=(int) peer=@{p_systemd},
signal receive set=int peer=@{p_systemd},
#aa:dbus own bus=system name=org.freedesktop.UDisks2
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
#aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
@ -88,6 +88,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
@{bin}/sgdisk rPx,
@{bin}/systemctl rCx -> systemctl,
@{bin}/systemd-escape rPx,
@{bin}/xfs_db rPUx,
/etc/crypttab r,
/etc/fstab r,

11
apparmor.d/profiles-s-z/wpa-gui
View file

@ -10,20 +10,13 @@ include <tunables/global>
@{exec_path} = @{bin}/wpa_gui
profile wpa-gui @{exec_path} {
include <abstractions/base>
include <abstractions/dri-enumerate>
include <abstractions/graphics>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/desktop>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/X>
@{exec_path} mr,
/usr/share/hwdata/pnp.ids r,
owner @{tmp}/wpa_ctrl_@{pid}-[0-9] w,
owner /dev/shm/#@{int} rw,