felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile) add the display-manager group.

Browse source 
- Group all display manager profile in the same group
- Ensure unsuported display manager can start a DE without breaking.
This commit is contained in:
Alexandre Pujol 2024-04-05 11:59:41 +01:00
parent 7603ac33d0
commit 839f137de2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
5 changed files with 70 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

86
apparmor.d/profiles-g-l/lightdm
View file

@ -1,86 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/lightdm
profile lightdm @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/authentication>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/wutmp>
include <abstractions/X>
audit capability sys_nice,
capability audit_write,
capability chown,
capability dac_read_search,
capability fowner,
capability fsetid,
capability kill,
capability net_admin,
capability setgid,
capability setuid,
capability sys_resource,
capability sys_tty_config,
network netlink raw,
signal (send) set=(term, kill, usr1),
signal (receive) set=(usr1) peer=xorg,
@{exec_path} mrix,
@{bin}/rm rix,
@{bin}/lightdm-gtk-greeter rPx,
@{bin}/startx rPx,
@{bin}/Xorg rPx,
@{bin}/plymouth rPx,
@{bin}/gnome-keyring-daemon rPx,
@{lib}/security-misc/* rPUx, #aa:only whonix
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
/etc/X11/Xsession rPUx,
/usr/share/lightdm/{,**} r,
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xgreeters/{,**} r,
/etc/default/locale r,
/etc/environment r,
/etc/lightdm/{,**} r,
/etc/security/limits.d/{,*} r,
/var/cache/lightdm/dmrc/*.dmrc* rw,
/var/lib/lightdm/{,**} rw,
/var/log/lightdm/{,**} rw,
owner @{HOME}/.dmrc r,
owner @{HOME}/.Xauthority rw,
owner @{HOME}/.xsession-errors{,.old} rw,
@{run}/faillock/ rw,
@{run}/faillock/user rwk,
@{run}/lightdm.pid rw,
@{run}/lightdm/{,**} rw,
owner @{run}/systemd/sessions/@{int}.ref rw,
@{PROC}/1/limits r,
@{PROC}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid rw,
owner @{PROC}/@{pid}/uid_map r,
/dev/tty@{int} r,
include if exists <local/lightdm>
}

56
apparmor.d/profiles-g-l/lightdm-gtk-greeter
View file

@ -1,56 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/lightdm-gtk-greeter
profile lightdm-gtk-greeter @{exec_path} {
include <abstractions/base>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/X>
signal (receive) set=(term, kill) peer=lightdm,
@{exec_path} mr,
@{bin}/locale rix,
@{lib}/systemd/systemd rCx -> systemd,
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
/usr/share/desktop-base/{,**} r,
/usr/share/lightdm/{,**} r,
/usr/share/wayland-sessions/{,*.desktop} r,
/etc/lightdm/{,**} r,
/var/lib/AccountsService/{,**} r,
/var/lib/lightdm/{,**} rw,
/var/log/lightdm/{,**} rw,
owner @{PROC}/@{pid}/fd/ r,
profile systemd {
include <abstractions/base>
include <abstractions/common/systemd>
include <abstractions/nameservice-strict>
@{lib}/systemd/systemd mr,
/etc/systemd/user.conf r,
owner @{PROC}/@{pid}/oom_score_adj r,
include if exists <local/lightdm-gtk-greeter_systemd>
}
include if exists <local/lightdm-gtk-greeter>
}