felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-20 00:04:39 +00:00
parent c074c09e3b
commit 7b880a5142
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
19 changed files with 84 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/gnome/gdm
View file

@ -32,7 +32,8 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term) peer=gdm-session-worker,
signal (send) set=(term) peer=gdm-session,
signal (send) set=(term) peer=gnome-session-binary,
signal (send) set=(term) peer=xdg-permission-store,
signal (send) set=(term) peer=tracker-miner,
signal (send) set=(term) peer=xdg-*,
signal (send) set=(term) peer=xorg,
unix (bind, listen) type=stream addr="@/tmp/dbus-@{rand8}",

3
apparmor.d/groups/gnome/gdm-generate-config
View file

@ -32,9 +32,10 @@ profile gdm-generate-config @{exec_path} {
/usr/share/gdm{3,}/{,**} r,
/var/lib/ r,
@{GDM_HOME}/ r,
owner @{GDM_HOME}/ rw,
owner @{GDM_HOME}/greeter-dconf-defaults rw,
owner @{GDM_HOME}/greeter-dconf-defaults.@{rand6} w,
owner @{GDM_HOME}/greeter-dconf-defaults.@{rand6} rw,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,

3
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -32,7 +32,6 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
network netlink raw,
signal (receive) set=term peer=gdm,
signal (receive) set=hup peer=@{systemd},
signal (send) set=(hup term) peer=gdm-session,
signal (send) set=hup peer=at-spi*,
signal (send) set=hup peer=dbus-session,
@ -41,7 +40,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
signal (send) set=hup peer=gsd-*,
signal (send) set=hup peer=ibus-*,
signal (send) set=hup peer=tracker-miner,
signal (send) set=hup peer=xdg-permission-store,
signal (send) set=hup peer=xdg-*,
signal (send) set=hup peer=xorg,
signal (send) set=hup peer=xwayland,

11
apparmor.d/groups/gnome/gnome-initial-setup
View file

@ -45,24 +45,33 @@ profile gnome-initial-setup @{exec_path} {
/usr/share/gnome-initial-setup/{,**} r,
/usr/share/xml/iso-codes/{,**} r,
/etc/security/pwquality.conf r,
/etc/security/pwquality.conf.d/{,**} r,
/etc/timezone r,
owner @{GDM_HOME}/greeter-dconf-defaults r,
owner @{user_config_dirs}/gnome-initial-setup-done w,
owner @{user_config_dirs}/gnome-initial-setup-done.@{rand6}BQK2 rw,
owner @{user_config_dirs}/gnome-initial-setup-done.@{rand6} rw,
owner @{user_config_dirs}/ibus/bus/ r,
owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r,
owner @{run}/user/@{uid}/avatar.png rw,
@{run}/systemd/sessions/@{int} r,
@{run}/systemd/users/@{uid} r,
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/gnome-initial-setup-first-login.service/memory.* r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/bios_version r,
@{sys}/devices/virtual/dmi/id/product_family r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{PROC}/zoneinfo r,
owner @{PROC}/@{pid}/cgroup r,
include if exists <local/gnome-initial-setup>
}

6
apparmor.d/groups/gnome/gnome-session
View file

@ -19,6 +19,7 @@ profile gnome-session @{exec_path} {
@{sh_path} rix,
@{bin}/cat rix,
@{bin}/gettext.sh r,
@{bin}/gettext rix,
@{bin}/grep rix,
@{bin}/head rix,
@{bin}/id rix,
@ -32,6 +33,7 @@ profile gnome-session @{exec_path} {
@{bin}/tty rix,
@{bin}/uname rPx,
@{bin}/dpkg-query rpx,
@{bin}/flatpak rCx -> flatpak,
@{bin}/gsettings rPx,
@{lib}/gnome-session-binary rPx,
@ -51,6 +53,7 @@ profile gnome-session @{exec_path} {
/etc/sysconfig/mail r,
/etc/sysconfig/proxy r,
/etc/sysconfig/windowmanager r,
/etc/X11/xinit/xinputrc r,
/etc/X11/Xsession.d/*im-config_launch r,
owner @{PROC}/@{pid}/cmdline r,
@ -60,7 +63,8 @@ profile gnome-session @{exec_path} {
profile flatpak {
include <abstractions/base>
include <abstractions/consoles>
@{bin}/flatpak mr,
/dev/tty@{int} rw,

10
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -56,9 +56,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{bin}/gnome-session rPx,
@{bin}/gnome-shell rPx,
@{bin}/session-migration rPx,
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx -> dbus-accessibility,
@{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh rix,
@{lib}/gnome-session-check-accelerated rix,
@{lib}/gnome-session-check-accelerated-gl-helper rix,
@{lib}/gnome-session-check-accelerated-gles-helper rix,
@ -90,7 +88,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/autostart/{,*.desktop} r,
owner @{user_config_dirs}/gnome-session/ rw,
owner @{user_config_dirs}/gnome-session/saved-session/ rw,
owner @{user_share_dirs}/gnome-shell/gnome-overrides-migrated rw,
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{run}/systemd/sessions/* r,
@ -117,8 +114,9 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
profile open {
include <abstractions/base>
@{lib}/gio-launch-desktop mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
@{lib}/gio-launch-desktop mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
@{sh_path} rix,
@{bin}/aa-notify rPx,
@{bin}/blueman-applet rPx,
@ -139,6 +137,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{bin}/xbrlapi rPx,
@{bin}/xdg-user-dirs-gtk-update rPx,
@{bin}/xdg-user-dirs-update rPx,
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
@{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh rPx,
@{lib}/@{multiarch}/libexec/kdeconnectd rPUx,
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
@{lib}/baloo_file rPx,

13
apparmor.d/groups/gnome/gnome-shell
View file

@ -272,7 +272,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{gdm_config_dirs}/pulse/cookie rwk,
owner @{gdm_share_dirs}/applications/{,**} r,
owner @{gdm_share_dirs}/gnome-shell/{,**} rw,
owner @{gdm_share_dirs}/icc/{,*} rw,
owner @{gdm_share_dirs}/icc/ r,
owner @{gdm_share_dirs}/icc/edid-@{hex32}.icc rw,
owner @{gdm_share_dirs}/icc/.goutputstream-@{rand6} rw,
owner @{HOME}/.face r,
owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
@ -295,7 +297,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{user_share_dirs}/gnome-shell/{,**} rw,
owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/icc/{,*} rw,
owner @{user_share_dirs}/icc/ r,
owner @{user_share_dirs}/icc/.goutputstream-@{rand6} rw,
owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw,
owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r,
owner @{user_cache_dirs}/gnome-boxes/*.png r,
@ -359,6 +363,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{sys}/devices/platform/**/input@{int}/{properties,name} r,
@{sys}/devices/virtual/net/*/statistics/{rx_bytes,tx_bytes} r,
@{sys}/fs/cgroup/user.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/cpu.max r,
@{PROC}/ r,
@{PROC}/@{pid}/attr/current r,
@{PROC}/@{pid}/cgroup r,

22
apparmor.d/groups/gnome/gnome-shell-overrides-migration Normal file
View file

@ -0,0 +1,22 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh
profile gnome-shell-overrides-migration @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/gsettings rPx,
owner @{user_share_dirs}/gnome-shell/ rw,
owner @{user_share_dirs}/gnome-shell/gnome-overrides-migrated rw,
include if exists <local/gnome-shell-overrides-migration>
}

1
apparmor.d/groups/gnome/gsd-power
View file

@ -57,6 +57,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
/usr/share/gdm/greeter-dconf-defaults r,
owner @{GDM_HOME}/greeter-dconf-defaults r,
owner @{gdm_config_dirs}/dconf/user r,
@{run}/udev/data/+backlight:* r,
@{run}/udev/data/+drm:card@{int}-* r, # For screen outputs

4
apparmor.d/groups/gnome/loupe
View file

@ -30,6 +30,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r,
deny @{user_share_dirs}/gvfs-metadata/* r,
profile bwrap flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bwrap>
@ -39,6 +41,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
@{bin}/bwrap mr,
@{lib}/glycin-loaders/*/glycin-image-rs rix,
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/loupe_bwrap>
}