felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dbus temp tails

Browse source
This commit is contained in:
nobody43 2023-08-12 17:10:53 +00:00
parent 4b7141cdbe
commit 81b7ab0b6f
11 changed files with 19 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/abstractions/dbus-session-strict.d/complete
View file

@ -2,12 +2,12 @@
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-*", unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-????????",
unix (bind, listen) type=stream addr="@/tmp/dbus-*", unix (bind, listen) type=stream addr="@/tmp/dbus-????????",
unix (connect, receive, send, accept) type=stream peer=(addr="@/tmp/dbus-*"), unix (connect, send, receive, accept) type=stream peer=(addr="@/tmp/dbus-????????"),
owner @{run}/user/@{uid}/at-spi/ rw, owner @{run}/user/@{uid}/at-spi/ rw,
owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw, owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw,
owner /tmp/dbus-[0-9a-zA-Z]* rw, owner /tmp/dbus-@{rand8} rw,

8
apparmor.d/abstractions/ibus.d/complete
View file

@ -6,17 +6,17 @@
# abstract path in ibus < 1.5.22 uses /tmp # abstract path in ibus < 1.5.22 uses /tmp
unix (connect, receive, send) unix (connect, receive, send)
type=stream type=stream
peer=(addr="@/tmp/ibus/dbus-*"), peer=(addr="@/tmp/ibus/dbus-????????"),
# abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{user_cache_dirs}) # abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{user_cache_dirs})
# This should use this, but due to LP: #1856738 we cannot # This should use this, but due to LP: #1856738 we cannot
#unix (connect, receive, send) #unix (connect, receive, send)
# type=stream # type=stream
# peer=(addr="@@{user_cache_dirs}/ibus/dbus-*"), # peer=(addr="@@{user_cache_dirs}/ibus/dbus-????????"),
unix (connect, receive, send) unix (connect, receive, send)
type=stream type=stream
peer=(addr="@/home/*/.cache/ibus/dbus-*"), peer=(addr="@/home/*/.cache/ibus/dbus-????????"),
unix (connect, send, receive, accept, bind, listen) unix (connect, send, receive, accept, bind, listen)
type=stream type=stream
addr="@/home/*/.cache/ibus/dbus-*", addr="@/home/*/.cache/ibus/dbus-????????",

2
apparmor.d/groups/bus/dbus-daemon
View file

@ -77,8 +77,6 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/dbus-1/{,**} r, owner @{user_share_dirs}/dbus-1/{,**} r,
@{user_share_dirs}/icc/{,edid-*} r, @{user_share_dirs}/icc/{,edid-*} r,
owner /tmp/dbus-[0-9a-zA-Z]* rw,
owner @{run}/user/@{uid}/dbus-1/ rw, owner @{run}/user/@{uid}/dbus-1/ rw,
owner @{run}/user/@{uid}/dbus-1/services/ rw, owner @{run}/user/@{uid}/dbus-1/services/ rw,
@{run}/systemd/inhibit/[0-9]*.ref rw, @{run}/systemd/inhibit/[0-9]*.ref rw,

6
apparmor.d/groups/bus/ibus-daemon
View file

@ -16,9 +16,9 @@ profile ibus-daemon @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(usr1) peer=gnome-shell, signal (receive) set=(usr1) peer=gnome-shell,
signal (send) set=(term) peer=ibus*, signal (send) set=(term) peer=ibus*,
unix (bind, listen) type=stream addr=@/var/lib/gdm{3,}/.cache/ibus/dbus-*, unix (bind, listen) type=stream addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????",
unix (send, receive, accept) type=stream addr=@/var/lib/gdm{3,}/.cache/ibus/dbus-* peer=(label=ibus-*), unix (send, receive, accept) type=stream addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????" peer=(label=ibus-*),
unix (send, receive, accept) type=stream addr=@/var/lib/gdm{3,}/.cache/ibus/dbus-* peer=(label=gnome-shell), unix (send, receive, accept) type=stream addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????" peer=(label=gnome-shell),
dbus send bus=session path=/org/freedesktop/DBus dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus interface=org.freedesktop.DBus

4
apparmor.d/groups/bus/ibus-dconf
View file

@ -17,8 +17,8 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) {
signal (receive) set=term peer=ibus-daemon, signal (receive) set=term peer=ibus-daemon,
unix (send, receive, connect) type=stream peer=(addr="@/home/*/.cache/ibus/dbus-*", label=ibus-daemon), unix (send, receive, connect) type=stream peer=(addr="@/home/*/.cache/ibus/dbus-????????", label=ibus-daemon),
unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-*", label=ibus-daemon), unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????", label=ibus-daemon),
dbus receive bus=session path=/ dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable interface=org.freedesktop.DBus.Introspectable

2
apparmor.d/groups/bus/ibus-engine-simple
View file

@ -14,7 +14,7 @@ profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) {
signal (receive) set=term peer=ibus-daemon, signal (receive) set=term peer=ibus-daemon,
unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-*", label=ibus-daemon), unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????", label=ibus-daemon),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/gnome/gnome-control-center
View file

@ -35,7 +35,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
signal (send) set=(kill) peer=unconfined, signal (send) set=(kill) peer=unconfined,
signal (send) set=(kill) peer=passwd, signal (send) set=(kill) peer=passwd,
unix (send, receive, connect) type=stream peer=(addr="@/home/*/.cache/ibus/dbus-*", label=ibus-daemon), unix (send, receive, connect) type=stream peer=(addr="@/home/*/.cache/ibus/dbus-????????", label=ibus-daemon),
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket interface=org.a11y.atspi.Socket

2
apparmor.d/groups/gnome/gnome-session-ctl
View file

@ -21,7 +21,7 @@ profile gnome-session-ctl @{exec_path} {
member=Initialized member=Initialized
peer=(name=org.gnome.SessionManager, label=gnome-session-binary), peer=(name=org.gnome.SessionManager, label=gnome-session-binary),
unix (send, receive, connect) type=stream peer=(addr=@/tmp/dbus-*, label=dbus-daemon), unix (send, receive, connect) type=stream peer=(addr=@/tmp/dbus-????????, label=dbus-daemon),
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/gnome/gnome-shell
View file

@ -52,7 +52,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
unix (send,receive) type=stream addr=none peer=(label=gnome-extension-ding), unix (send,receive) type=stream addr=none peer=(label=gnome-extension-ding),
unix (send,receive) type=stream addr=none peer=(label=xkbcomp), unix (send,receive) type=stream addr=none peer=(label=xkbcomp),
unix (send,receive) type=stream addr=none peer=(label=xwayland), unix (send,receive) type=stream addr=none peer=(label=xwayland),
unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-*", label=ibus-daemon), unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-????????", label=ibus-daemon),
dbus send bus=session path=/org/freedesktop/DBus dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus interface=org.freedesktop.DBus

4
apparmor.d/profiles-g-l/gsettings
View file

@ -11,7 +11,7 @@ profile gsettings @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/dconf-write> include <abstractions/dconf-write>
unix (connect, receive, send) type=stream peer=(addr="@/tmp/dbus-*"), unix (connect, receive, send) type=stream peer=(addr="@/tmp/dbus-????????"),
@{exec_path} mr, @{exec_path} mr,
@ -27,4 +27,4 @@ profile gsettings @{exec_path} {
owner @{run}/user/@{uid}/bus rw, owner @{run}/user/@{uid}/bus rw,
include if exists <local/gsettings> include if exists <local/gsettings>
} }

2
apparmor.d/profiles-m-r/qbittorrent
View file

@ -106,8 +106,6 @@ profile qbittorrent @{exec_path} {
dbus bind bus=session dbus bind bus=session
name=org.kde.StatusNotifierItem-*, name=org.kde.StatusNotifierItem-*,
owner /tmp/dbus-[0-9a-zA-Z]* rw,
@{exec_path} mr, @{exec_path} mr,
# For "search engine" # For "search engine"