felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

@{HOME}/.config -> @{user_config_dirs}

Browse source
This commit is contained in:
Alexandre Pujol 2021-04-01 17:21:33 +01:00
parent 1c9fc00c13
commit 7f6ea8d44d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
138 changed files with 378 additions and 378 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor.d/groups/browsers/brave
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_HOMEDIR} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{exec_path} = @{BRAVE_INSTALLDIR}/brave{,-beta,-dev}
@ -87,7 +87,7 @@ profile brave @{exec_path} {
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{HOME}/ r,
owner @{HOME}/.config/BraveSoftware/ w,
owner @{user_config_dirs}/BraveSoftware/ w,
owner @{BRAVE_HOMEDIR}/ rw,
owner @{BRAVE_HOMEDIR}/** rwk,
# For Widevine plugin
@ -111,14 +111,14 @@ profile brave @{exec_path} {
owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
owner @{HOME}/.mozilla/firefox/*/logins.json r,
# For importing data from Chromium
owner "@{HOME}/.config/chromium/Local State" r,
owner @{HOME}/.config/chromium/Singleton{Lock,Socket,Cookie} w,
owner "@{HOME}/.config/chromium/*/Login Data{,-journal}" rwk,
owner @{HOME}/.config/chromium/*/ r,
owner @{HOME}/.config/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
owner "@{user_config_dirs}/chromium/Local State" r,
owner @{user_config_dirs}/chromium/Singleton{Lock,Socket,Cookie} w,
owner "@{user_config_dirs}/chromium/*/Login Data{,-journal}" rwk,
owner @{user_config_dirs}/chromium/*/ r,
owner @{user_config_dirs}/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
owner @{HOME}/.config/menus/applications-merged/ r,
owner @{HOME}/.config/menus/applications-merged/xdg-desktop-menu-dummy.menu r,
owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu r,
/etc/fstab r,

2
apparmor.d/groups/browsers/brave-browser
View file

@ -3,7 +3,7 @@
# SPDX-License-Identifier: GPL-2.0-only
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_HOMEDIR} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
abi <abi/3.0>,

2
apparmor.d/groups/browsers/brave-sandbox
View file

@ -3,7 +3,7 @@
# SPDX-License-Identifier: GPL-2.0-only
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_HOMEDIR} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
@{BRAVE_CACHEDIR} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}
abi <abi/3.0>,

2
apparmor.d/groups/browsers/chromium
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
@{CHROMIUM_HOMEDIR} = @{user_config_dirs}/chromium
@{CHROMIUM_CACHEDIR} = @{user_cache_dirs}/chromium
@{exec_path} = /{usr/,}bin/chromium

2
apparmor.d/groups/browsers/chromium-chrome-sandbox
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
@{CHROMIUM_HOMEDIR} = @{user_config_dirs}/chromium
@{CHROMIUM_CACHEDIR} = @{user_cache_dirs}/chromium
@{exec_path} = @{CHROMIUM_INSTALLDIR}/chrome-sandbox

4
apparmor.d/groups/browsers/chromium-chromium
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
@{CHROMIUM_HOMEDIR} = @{user_config_dirs}/chromium
@{CHROMIUM_CACHEDIR} = @{user_cache_dirs}/chromium
@{exec_path} = @{CHROMIUM_INSTALLDIR}/chromium
@ -83,7 +83,7 @@ profile chromium-chromium @{exec_path} {
# Chromium home files
owner @{HOME}/ r,
owner @{HOME}/.config/ r,
owner @{user_config_dirs}/ r,
owner @{CHROMIUM_HOMEDIR}/ rw,
owner @{CHROMIUM_HOMEDIR}/** rwk,
owner @{CHROMIUM_HOMEDIR}/WidevineCdm/*/_platform_specific/linux_*/libwidevinecdm.so mrw,

2
apparmor.d/groups/browsers/firefox
View file

@ -121,7 +121,7 @@ profile firefox @{exec_path} {
# Set default browser
/{usr/,}bin/update-mime-database rPUx,
owner @{HOME}/.config/mimeapps.list{,.*} rw,
owner @{user_config_dirs}/mimeapps.list{,.*} rw,
owner @{HOME}/.local/share/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw,
owner @{HOME}/.local/share/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw,

12
apparmor.d/groups/browsers/google-chrome-chrome
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{user_config_dirs}/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{user_cache_dirs}/google-chrome{,-beta,-unstable}
@{exec_path} = @{CHROME_INSTALLDIR}/chrome{,-beta,-unstable}
@ -107,11 +107,11 @@ profile google-chrome-chrome @{exec_path} {
owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
owner @{HOME}/.mozilla/firefox/*/logins.json r,
# For importing data from Chromium
owner "@{HOME}/.config/chromium/Local State" r,
owner @{HOME}/.config/chromium/Singleton{Lock,Socket,Cookie} w,
owner "@{HOME}/.config/chromium/*/Login Data{,-journal}" rwk,
owner @{HOME}/.config/chromium/*/ r,
owner @{HOME}/.config/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
owner "@{user_config_dirs}/chromium/Local State" r,
owner @{user_config_dirs}/chromium/Singleton{Lock,Socket,Cookie} w,
owner "@{user_config_dirs}/chromium/*/Login Data{,-journal}" rwk,
owner @{user_config_dirs}/chromium/*/ r,
owner @{user_config_dirs}/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
/etc/fstab r,

2
apparmor.d/groups/browsers/google-chrome-chrome-sandbox
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{user_config_dirs}/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{user_cache_dirs}/google-chrome{,-beta,-unstable}
@{exec_path} = @{CHROME_INSTALLDIR}/chrome-sandbox

2
apparmor.d/groups/browsers/google-chrome-google-chrome
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
@{CHROME_HOMEDIR} = @{user_config_dirs}/google-chrome{,-beta,-unstable}
@{CHROME_CACHEDIR} = @{user_cache_dirs}/google-chrome{,-beta,-unstable}
@{exec_path} = @{CHROME_INSTALLDIR}/google-chrome{,-beta,-unstable}

18
apparmor.d/groups/browsers/opera
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{user_config_dirs}/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{user_cache_dirs}/opera{,-beta,-developer}
@{exec_path} = @{OPERA_INSTALLDIR}/opera{,-beta,-developer}
@ -94,16 +94,16 @@ profile opera @{exec_path} {
owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
owner @{HOME}/.mozilla/firefox/*/logins.json r,
# For importing data from Chromium
owner "@{HOME}/.config/chromium/Local State" r,
owner @{HOME}/.config/chromium/Singleton{Lock,Socket,Cookie} w,
owner "@{HOME}/.config/chromium/*/Login Data{,-journal}" rwk,
owner @{HOME}/.config/chromium/*/ r,
owner @{HOME}/.config/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
owner "@{user_config_dirs}/chromium/Local State" r,
owner @{user_config_dirs}/chromium/Singleton{Lock,Socket,Cookie} w,
owner "@{user_config_dirs}/chromium/*/Login Data{,-journal}" rwk,
owner @{user_config_dirs}/chromium/*/ r,
owner @{user_config_dirs}/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
# Flashplayer
owner @{HOME}/.config/google-chrome{,-beta,-unstable}/PepperFlash/**/manifest.json r,
owner @{HOME}/.config/google-chrome{,-beta,-unstable}/PepperFlash/latest-component-updated-flash r,
owner @{HOME}/.config/google-chrome{,-beta,-unstable}/PepperFlash/**/libpepflashplayer.so mr,
owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/**/manifest.json r,
owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/latest-component-updated-flash r,
owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/**/libpepflashplayer.so mr,
/etc/fstab r,

2
apparmor.d/groups/browsers/opera-crashreporter
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{user_config_dirs}/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{user_cache_dirs}/opera{,-beta,-developer}
@{exec_path} = @{OPERA_INSTALLDIR}/opera_crashreporter

2
apparmor.d/groups/browsers/opera-sandbox
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
@{OPERA_HOMEDIR} = @{user_config_dirs}/opera{,-beta,-developer}
@{OPERA_CACHEDIR} = @{user_cache_dirs}/opera{,-beta,-developer}
@{exec_path} = @{OPERA_INSTALLDIR}/opera_sandbox

4
apparmor.d/groups/browsers/torbrowser.Browser.firefox
View file

@ -119,8 +119,8 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
deny /dev/dri/ rwklx,
deny @{user_cache_dirs}/fontconfig/ rw,
deny @{user_cache_dirs}/fontconfig/** rw,
deny @{HOME}/.config/gtk-2.0/ rw,
deny @{HOME}/.config/gtk-2.0/** rw,
deny @{user_config_dirs}/gtk-2.0/ rw,
deny @{user_config_dirs}/gtk-2.0/** rw,
deny @{PROC}/@{pid}/net/route r,
deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,