felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-01 13:22:45 +00:00
parent 952ef478c0
commit 7f38dd255e
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
17 changed files with 93 additions and 186 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/groups/freedesktop/pipewire
View file

@ -49,13 +49,9 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
@{bin}/pactl rix,
@{bin}/pipewire-media-session rPx,
/usr/share/pipewire/pipewire*.conf r,
/usr/share/pipewire/{,**} r,
/etc/gnutls/config r,
/etc/pipewire/client.conf r,
/etc/pipewire/pipewire-pulse.conf.d/{,*} r,
/etc/pipewire/pipewire.conf r,
/etc/pipewire/pipewire.conf.d/{,*} r,
/etc/pipewire/{,**} r,
/var/lib/gdm{3,}/.config/pulse/cookie rk,

5
apparmor.d/groups/gnome/epiphany-search-provider
View file

@ -12,6 +12,7 @@ profile epiphany-search-provider @{exec_path} {
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/enchant>
include <abstractions/fonts>
include <abstractions/gnome>
include <abstractions/mesa>
@ -35,15 +36,19 @@ profile epiphany-search-provider @{exec_path} {
owner @{user_cache_dirs}/epiphany/{,**} rwk,
owner @{user_share_dirs}/epiphany/{,**} rwk,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
@{PROC}/driver/nvidia/params r,
@{PROC}/modules r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
@{PROC}/zoneinfo r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/epiphany-search-provider>
}

2
apparmor.d/groups/gnome/evolution-addressbook-factory
View file

@ -63,8 +63,6 @@ profile evolution-addressbook-factory @{exec_path} {
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/etc/gnutls/config r,
owner @{user_share_dirs}/evolution/{,**} rwk,
owner @{user_cache_dirs}/evolution/addressbook/{,**} rwk,

2
apparmor.d/groups/gnome/evolution-alarm-notify
View file

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,

3
apparmor.d/groups/gnome/gdm-xsession
View file

@ -61,7 +61,6 @@ profile gdm-xsession @{exec_path} {
owner /tmp/gdm{3,}-config-err-@{rand6} rw,
# file_inherit
/dev/tty@{int} rw,
profile dbus {
@ -81,10 +80,8 @@ profile gdm-xsession @{exec_path} {
member=SetEnvironment
peer=(name=org.freedesktop.systemd[0-9]*),
# file_inherit
/dev/tty rw,
/dev/tty@{int} rw,
owner @{HOME}/.xsession-errors w,
include if exists <local/gdm-xsession_dbus>
}

4
apparmor.d/groups/gnome/gnome-extension-ding
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/gnome-shell/extensions/ding@rastersoft.com/ding.js
@{exec_path} = /usr/share/gnome-shell/extensions/ding@rastersoft.com/{,app/}ding.js
profile gnome-extension-ding @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
@ -150,7 +150,7 @@ profile gnome-extension-ding @{exec_path} {
@{bin}/gnome-control-center rPx,
@{bin}/nautilus rPx,
/usr/share/gnome-shell/extensions/ding@rastersoft.com/* r,
/usr/share/gnome-shell/extensions/ding@rastersoft.com/{,app/}* r,
/usr/share/thumbnailers/{,*.thumbnailer} r,
/usr/share/X11/{,**} r,

9
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -17,6 +17,7 @@ profile gnome-terminal-server @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/wayland>
include <abstractions/X-strict>
signal (send) set=(term hup kill) peer=unconfined,
ptrace (read) peer=unconfined,
@ -43,13 +44,15 @@ profile gnome-terminal-server @{exec_path} {
/var/lib/flatpak/exports/share/icons/{,**} r,
/var/lib/snapd/desktop/icons/{,**} r,
/etc/pulse/client.conf r,
/etc/pulse/client.conf.d/{,**} r,
/etc/shells r,
owner @{user_config_dirs}/*xdg-terminals.list* rw,
owner @{user_config_dirs}/pulse/cookie r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner /tmp/#@{int} rw,
owner @{run}/user/@{uid}/pulse/ r,
owner @{run}/user/@{uid}/pulse/native rw,
@{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/cgroup r,

14
apparmor.d/groups/gnome/gsd-printer
View file

@ -16,15 +16,9 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
signal (receive) set=(hup) peer=gsd-print-notifications,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={ReleaseName,RequestName},
dbus bind bus=system name=com.redhat.NewPrinterNotification,
dbus bind bus=system
name=com.redhat.NewPrinterNotification,
dbus bind bus=system
name=com.redhat.PrinterDriversInstaller,
dbus bind bus=system name=com.redhat.PrinterDriversInstaller,
dbus (send,receive) bus=session path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
@ -52,10 +46,6 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/etc/gnutls/config r,
owner /tmp/[a-z0-9]* rw,
owner @{PROC}/@{pid}/cgroup r,
owner /dev/tty@{int} rw,

5
apparmor.d/groups/systemd/coredumpctl
View file

@ -12,7 +12,9 @@ profile coredumpctl @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability dac_read_search,
capability net_admin,
capability sys_resource,
signal (send) peer=child-pager,
@ -40,6 +42,7 @@ profile coredumpctl @{exec_path} flags=(complain) {
owner /var/tmp/coredump-* rw,
@{PROC}/1/cgroup r,
@{PROC}/sys/fs/nr_open r,
owner @{PROC}/@{pid}/cgroup r,
profile gdb {
@ -67,7 +70,7 @@ profile coredumpctl @{exec_path} flags=(complain) {
@{PROC}/@{pids}/fd/ r,
include if exists <local/coredumpctl_gdb>
}
include if exists <local/coredumpctl>

1
apparmor.d/groups/systemd/systemd-generator-fstab
View file

@ -12,6 +12,7 @@ profile systemd-generator-fstab @{exec_path} {
include <abstractions/systemd-common>
capability dac_override,
capability dac_read_search,
@{exec_path} mr,

1
apparmor.d/groups/ubuntu/apport-checkreports
View file

@ -23,6 +23,7 @@ profile apport-checkreports @{exec_path} {
/etc/apt/apt.conf.d/{,**} r,
/etc/default/apport r,
/etc/login.defs r,
/var/crash/ r,