From 7cf4719728569dc207122236ff5a187ff2375a8f Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sat, 13 Sep 2025 00:35:07 +0200
Subject: [PATCH] feat(abs): add the secrets-service abs.

---
 .../bus/session/org.freedesktop.Secret        | 49 +++++++++++++++++++
 apparmor.d/abstractions/secrets-service       | 33 +++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 apparmor.d/abstractions/bus/session/org.freedesktop.Secret
 create mode 100644 apparmor.d/abstractions/secrets-service

diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.Secret b/apparmor.d/abstractions/bus/session/org.freedesktop.Secret
new file mode 100644
index 000000000..8ded1b6d7
--- /dev/null
+++ b/apparmor.d/abstractions/bus/session/org.freedesktop.Secret
@@ -0,0 +1,49 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2017 Canonical Ltd
+# Copyright (C) 2021-2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Provide full access to the secret-service API:
+# - https://standards.freedesktop.org/secret-service/)
+#
+# The secret-service allows managing (add/delete/lock/etc) collections and
+# (add/delete/etc) items within collections. The API also has the concept of
+# aliases for collections which is typically used to access the default
+# collection. While it would be possible for an application developer to use a
+# snap-specific collection and mediate by object path, application developers
+# are meant to instead to treat collections (typically the default collection)
+# as a database of key/value attributes each with an associated secret that
+# applications may query. Because AppArmor does not mediate member data,
+# typical and recommended usage of the API does not allow for application
+# isolation. For details, see:
+# - https://standards.freedesktop.org/secret-service/ch03.html
+#
+
+  abi <abi/4.0>,
+
+  #aa:dbus common bus=session name=org.freedesktop.{S,s}ecret label=gnome-keyring-daemon
+
+  dbus send bus=session path=/org/freedesktop/secrets{,/**}
+       interface=org.freedesktop.Secret.{Collection,Item,Prompt,Service,Session}
+       peer=(name="{@{busname},org.freedesktop.secrets}", label=gnome-keyring-daemon),
+
+  dbus receive bus=session path=/org/freedesktop/secrets{,/**}
+       interface=org.freedesktop.Secret.{Collection,Item,Prompt,Service,Session}
+       peer=(name="{@{busname},org.freedesktop.secrets}", label=gnome-keyring-daemon),
+
+  dbus send bus=session path=/org/freedesktop/secrets
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=@{busname}, label=gnome-keyring-daemon),
+  dbus send bus=session path=/org/freedesktop/secrets
+       interface=org.freedesktop.Secret.Service
+       member=ReadAlias
+       peer=(name=org.freedesktop.secrets, label=gnome-keyring-daemon),
+  dbus send bus=session path=/org/freedesktop/secrets
+       interface=org.freedesktop.Secret.Service
+       member=SearchItems
+       peer=(name=@{busname}, label=gnome-keyring-daemon),
+
+  include if exists <abstractions/bus/session/org.freedesktop.Secret.d>
+
+# vim:syntax=apparmor
diff --git a/apparmor.d/abstractions/secrets-service b/apparmor.d/abstractions/secrets-service
new file mode 100644
index 000000000..71b7c7d82
--- /dev/null
+++ b/apparmor.d/abstractions/secrets-service
@@ -0,0 +1,33 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2017 Canonical Ltd
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Provide full access to the secret-service API:
+# - https://standards.freedesktop.org/secret-service/)
+#
+# The secret-service allows managing (add/delete/lock/etc) collections and
+# (add/delete/etc) items within collections. The API also has the concept of
+# aliases for collections which is typically used to access the default
+# collection. While it would be possible for an application developer to use a
+# snap-specific collection and mediate by object path, application developers
+# are meant to instead to treat collections (typically the default collection)
+# as a database of key/value attributes each with an associated secret that
+# applications may query. Because AppArmor does not mediate member data,
+# typical and recommended usage of the API does not allow for application
+# isolation. For details, see:
+# - https://standards.freedesktop.org/secret-service/ch03.html
+#
+
+  abi <abi/4.0>,
+
+  include <abstractions/bus/session/org.freedesktop.Secret>
+
+  dbus send bus=session path=/org/gnome/keyring/daemon
+       interface=org.gnome.keyring.Daemon
+       member=GetEnvironment
+       peer=(name=org.gnome.keyring, label=gnome-keyring-daemon),
+
+  include if exists <abstractions/secrets-service.d>
+
+# vim:syntax=apparmor