felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixes

Browse source
This commit is contained in:
nobody43 2023-02-21 15:10:51 +00:00 • committed by Alex
parent 01714cc4f0
commit 8b4407ca02
6 changed files with 19 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/browsers/firefox
View file

@ -7,12 +7,12 @@ abi <abi/3.0>,
include <tunables/global>
@{firefox_name} = firefox{,-esr}
@{firefox_name} = firefox{,-esr,-bin}
@{firefox_lib_dirs} = /{usr/,}lib{,32,64}/@{firefox_name} /opt/@{firefox_name}
@{firefox_config_dirs} = @{HOME}/.mozilla/
@{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}{-bin,}
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}
profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
@ -173,8 +173,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
/etc/xul-ext/kwallet5.js r,
owner @{HOME}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/ w,
owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ w,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,

35
apparmor.d/groups/systemd/loginctl Normal file
View file

@ -0,0 +1,35 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{,usr/}bin/loginctl
profile loginctl @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/systemd-common>
capability sys_resource,
capability net_admin,
@{exec_path} mr,
/{usr/,}bin/less rPx -> child-pager,
/{usr/,}bin/more rPx -> child-pager,
/{usr/,}bin/pager rPx -> child-pager,
dbus (send) bus=system path=/org/freedesktop/login[0-9]*
interface=org.freedesktop.login[0-9]*.Manager
member={ListSessions,GetSession}
peer=(name=org.freedesktop.login[0-9]* label=systemd-logind),
dbus (send) bus=system path=/org/freedesktop/login[0-9]*/session/**
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(name=org.freedesktop.login[0-9]* label=systemd-logind),
include if exists <local/loginctl>
}

9
apparmor.d/groups/virt/virtiofsd
View file

@ -5,9 +5,6 @@ abi <abi/3.0>,
include <tunables/global>
@{LOCAL_SHARED_DIRS} = /var/lib/libvirt/shared
include if exists <local/tunables/virtiofsd>
@{exec_path} = /{,usr/}lib/qemu/virtiofsd
profile virtiofsd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@ -39,9 +36,9 @@ profile virtiofsd @{exec_path} flags=(attach_disconnected) {
/var/lib/libvirt/qemu/*/fs[0-9]*-fs.sock rw,
# shared folders
mount options=(rw, rbind) -> @{LOCAL_SHARED_DIRS}/,
pivot_root @{LOCAL_SHARED_DIRS}/,
@{LOCAL_SHARED_DIRS}/ r,
mount options=(rw, rbind) -> @{user_vm_shares}/,
pivot_root @{user_vm_shares}/,
@{user_vm_shares}/ r,
include if exists <local/virtiofsd>
}