feat(profile) add the display-manager group.
- Group all display manager profile in the same group - Ensure unsuported display manager can start a DE without breaking.
This commit is contained in:
Alexandre Pujol
parent
7603ac33d0
commit
839f137de2
5 changed files with 70 additions and 16 deletions
88
apparmor.d/groups/display-manager/lightdm
Normal file
88
apparmor.d/groups/display-manager/lightdm
Normal file
|
|
@ -0,0 +1,88 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lightdm
|
||||
profile lightdm @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability kill,
|
||||
capability net_admin,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_resource,
|
||||
capability sys_tty_config,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
signal (send) set=(term) peer=lightdm-*-greeter,
|
||||
signal (receive) set=(usr1) peer=xorg,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{bin}/rm rix,
|
||||
|
||||
@{bin}/lightdm-*-greeter rPUx,
|
||||
@{bin}/startx rPx,
|
||||
@{bin}/Xorg rPx,
|
||||
@{bin}/plymouth rPx,
|
||||
@{bin}/gnome-keyring-daemon rPx,
|
||||
|
||||
@{lib}/security-misc/* rPx, #aa:only whonix
|
||||
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
|
||||
|
||||
/etc/lightdm/Xsession rPx,
|
||||
/etc/X11/Xsession rPx,
|
||||
|
||||
/usr/share/lightdm/{,**} r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
/usr/share/xgreeters/{,**} r,
|
||||
|
||||
/etc/default/locale r,
|
||||
/etc/environment r,
|
||||
/etc/lightdm/{,**} r,
|
||||
/etc/machine-id r,
|
||||
/etc/security/limits.d/{,*} r,
|
||||
/etc/shells r,
|
||||
|
||||
/var/cache/lightdm/dmrc/*.dmrc* rw,
|
||||
/var/lib/lightdm/{,**} rw,
|
||||
/var/lib/lightdm-data/{,**} rw,
|
||||
/var/log/lightdm/{,**} rw,
|
||||
|
||||
owner @{HOME}/.dmrc r,
|
||||
owner @{HOME}/.Xauthority rw,
|
||||
owner @{HOME}/.xsession-errors{,.old} rw,
|
||||
|
||||
@{run}/faillock/ rw,
|
||||
@{run}/faillock/user rwk,
|
||||
@{run}/lightdm.pid rw,
|
||||
@{run}/lightdm/{,**} rw,
|
||||
owner @{run}/systemd/sessions/*.ref rw,
|
||||
|
||||
@{PROC}/1/limits r,
|
||||
@{PROC}/cmdline r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
|
||||
/dev/tty@{int} r,
|
||||
|
||||
include if exists <local/lightdm>
|
||||
}
|
||||
55
apparmor.d/groups/display-manager/lightdm-gtk-greeter
Normal file
55
apparmor.d/groups/display-manager/lightdm-gtk-greeter
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lightdm-gtk-greeter
|
||||
profile lightdm-gtk-greeter @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (receive) set=(term, kill) peer=lightdm,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/locale rix,
|
||||
|
||||
@{lib}/systemd/systemd rCx -> systemd,
|
||||
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
|
||||
|
||||
/usr/share/backgrounds/xfce/{,**} r,
|
||||
/usr/share/desktop-base/{,**} r,
|
||||
/usr/share/lightdm/{,**} r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
|
||||
/etc/lightdm/{,**} r,
|
||||
|
||||
/var/lib/AccountsService/{,**} r,
|
||||
/var/lib/lightdm/{,**} rw,
|
||||
/var/log/lightdm/{,**} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
profile systemd {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{lib}/systemd/systemd mr,
|
||||
|
||||
/etc/systemd/user.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/oom_score_adj r,
|
||||
|
||||
include if exists <local/lightdm-gtk-greeter_systemd>
|
||||
}
|
||||
|
||||
include if exists <local/lightdm-gtk-greeter>
|
||||
}
|
||||
52
apparmor.d/groups/display-manager/lightdm-xsession
Normal file
52
apparmor.d/groups/display-manager/lightdm-xsession
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/lightdm/Xsession
|
||||
profile lightdm-xsession @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/shells>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/cat rix,
|
||||
@{bin}/tr rix,
|
||||
@{bin}/tty rix,
|
||||
|
||||
@{bin}/dbus-update-activation-environment rCx -> dbus,
|
||||
@{bin}/startxfce4 rPx,
|
||||
@{bin}/systemctl rCx -> systemctl,
|
||||
|
||||
/etc/X11/xinit/xinitrc.d/{,**} r,
|
||||
/etc/debuginfod/{,**} r,
|
||||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/lightdm-xsession_systemctl>
|
||||
}
|
||||
|
||||
profile dbus {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/dbus-update-activation-environment mr,
|
||||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/lightdm-xsession_dbus>
|
||||
}
|
||||
|
||||
include if exists <local/lightdm-xsession>
|
||||
}
|
||||
162
apparmor.d/groups/display-manager/x11-xsession
Normal file
162
apparmor.d/groups/display-manager/x11-xsession
Normal file
|
|
@ -0,0 +1,162 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/X11/Xsession
|
||||
profile x11-xsession @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{,e}grep rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/basename rix,
|
||||
@{bin}/cat rix,
|
||||
@{bin}/chmod rix,
|
||||
@{bin}/cut rix,
|
||||
@{bin}/date rix,
|
||||
@{bin}/fold rix,
|
||||
@{bin}/head rix,
|
||||
@{bin}/id rix,
|
||||
@{bin}/mktemp rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/rm rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/sleep rix,
|
||||
@{bin}/tail rix,
|
||||
@{bin}/tempfile rix,
|
||||
@{bin}/touch rix,
|
||||
@{bin}/which{,.debianutils} rix,
|
||||
|
||||
@{bin}/dbus-update-activation-environment rCx -> dbus,
|
||||
|
||||
@{bin}/gpgconf rCx -> gpg,
|
||||
@{bin}/run-parts rCx -> run-parts,
|
||||
@{bin}/udevadm rCx -> udevadm,
|
||||
|
||||
@{bin}/flatpak rPx,
|
||||
@{bin}/glxinfo rPx,
|
||||
@{bin}/numlockx rPx,
|
||||
@{bin}/systemd-detect-virt rPx,
|
||||
@{bin}/xhost rPx,
|
||||
@{bin}/xrdb rPx,
|
||||
@{bin}/xset rPx,
|
||||
|
||||
# Allowed GUI sessions to start
|
||||
@{bin}/openbox-session rPx,
|
||||
@{bin}/enlightenment_start rPUx,
|
||||
@{bin}/sway rPUx,
|
||||
@{bin}/ssh-agent rCx -> ssh-agent,
|
||||
|
||||
@{bin}/sudo rPx, #aa:only whonix
|
||||
@{lib}/*/*.sh r,
|
||||
|
||||
/etc/default/{,*} r,
|
||||
/etc/profile.d/*.sh r,
|
||||
/etc/X11/{,**} r,
|
||||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner /tmp/file* rw,
|
||||
owner /tmp/tmp.@{rand10} rw,
|
||||
owner /tmp/user/@{uid}/tmp.@{rand10} rw,
|
||||
|
||||
profile ssh-agent {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/ssh-agent mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
|
||||
@{bin}/gpg-agent rPx,
|
||||
@{bin}/enlightenment_start rPUx,
|
||||
@{bin}/env rix,
|
||||
@{bin}/im-launch rPx,
|
||||
@{bin}/kwalletaskpass rPUx,
|
||||
@{bin}/openbox-session rPx,
|
||||
@{bin}/startkde rPUx,
|
||||
@{bin}/startxfce4 rPUx,
|
||||
@{bin}/sway rPUx,
|
||||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner /tmp/ssh-*/ rw,
|
||||
owner /tmp/ssh-*/agent.* rw,
|
||||
|
||||
include if exists <local/x11-xsession_ssh-agent>
|
||||
}
|
||||
|
||||
profile run-parts {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/run-parts mr,
|
||||
|
||||
/etc/X11/Xsession.d/{,*} r,
|
||||
/etc/X11/Xresources/{,*} r,
|
||||
|
||||
/etc/default/kexec.d/ r,
|
||||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/x11-xsession_run-parts>
|
||||
}
|
||||
|
||||
profile dbus {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/dbus-update-activation-environment mr,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner @{HOME}/.xsession-errors rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/x11-xsession_dbus>
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/gpgconf mr,
|
||||
|
||||
@{bin}/gpg-agent rix,
|
||||
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/x11-xsession_gpg>
|
||||
}
|
||||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/*/devices/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/*/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{run}/udev/data/* r,
|
||||
|
||||
include if exists <local/x11-xsession_udevadm>
|
||||
}
|
||||
|
||||
include if exists <local/x11-xsession>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue