felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): finishing replacing local *_ext variables.

Browse source
This commit is contained in:
Alexandre Pujol 2023-03-12 15:24:53 +00:00
parent d23348c689
commit 8bdce8bd62
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
11 changed files with 291 additions and 770 deletions
Download patch file Download diff file Expand all files Collapse all files

145
apparmor.d/profiles-s-z/smplayer
View file

@ -1,76 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
# Video/audio extensions:
# a52, aac, ac3, mka, flac, mp1, mp2, mp3, mpc, oga, oma, wav, wv, wm, wma, 3g2, 3gp, 3gp2, 3gpp,
# asf, avi, divx, m1v, m2v, m4v, mkv, mov, mp4, mpa, mpe, mpg, mpeg, mpeg1, mpeg2, mpeg4, ogg, ogm,
# ogx, ogv, rm, rmvb, webm, wmv, wtv, mp2t
@{smplayer_ext} = [aA]{52,[aA][cC],[cC]3}
@{smplayer_ext} += [mM][kK][aA]
@{smplayer_ext} += [fF][lL][aA][cC]
@{smplayer_ext} += [mM][pP][123cC]
@{smplayer_ext} += [oO][gGmM][aA]
@{smplayer_ext} += [wW]{,[aA]}[vV]
@{smplayer_ext} += [wW][mM]{,[aA]}
@{smplayer_ext} += 3[gG]{[2pP],[pP][2pP]}
@{smplayer_ext} += [aA][sS][fF]
@{smplayer_ext} += [aA][vV][iI]
@{smplayer_ext} += [dD][iI][vV][xX]
@{smplayer_ext} += [mM][124][vV]
@{smplayer_ext} += [mM][kKoO][vV]
@{smplayer_ext} += [mM][pP][4aAeEgG]
@{smplayer_ext} += [mM][pP][eE][gG]{,[124]}
@{smplayer_ext} += [oO][gG][gGmMxXvV]
@{smplayer_ext} += [rR][mM]{,[vV][bB]}
@{smplayer_ext} += [wW][eE][bB][mM]
@{smplayer_ext} += [wW][mMtT][vV]
@{smplayer_ext} += [mM][pP]2[tT]
# Image extensions
# bmp, jpg, jpeg, png, gif
@{smplayer_ext} += [bB][mM][pP]
@{smplayer_ext} += [jJ][pP]{,[eE]}[gG]
@{smplayer_ext} += [pP][nN][gG]
@{smplayer_ext} += [gG][iI][fF]
# Subtitle extensions:
# srt, txt, sub
@{smplayer_ext} += [sS][rR][tT]
@{smplayer_ext} += [tT][xX][tT]
@{smplayer_ext} += [sS][uU][bB]
# Playlist extensions:
# m3u, m3u8, pls
@{smplayer_ext} += [mM]3[uU]{,8}
@{smplayer_ext} += [pP][lL][sS]
# For Qbittorrent !qB extension
@{smplayer_ext} += "!qB"
@{exec_path} = /{usr/,}bin/smplayer
profile smplayer @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/X>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/audio>
include <abstractions/consoles>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write>
include <abstractions/wayland>
include <abstractions/dri-enumerate>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/private-files-strict>
include <abstractions/openssl>
include <abstractions/wayland>
include <abstractions/X>
# Needed for hardware decoding
##include <abstractions/nvidia>
@ -86,33 +40,42 @@ profile smplayer @{exec_path} {
@{exec_path} mrix,
# Which media files SMPlayer should be able to open
/ r,
/home/ r,
/{usr/,}bin/mpv rPx,
/{usr/,}bin/pacmd rPx,
/{usr/,}bin/smtube rPx,
/{usr/,}bin/youtube-dl rPx,
/{usr/,}bin/yt-dlp rPx,
/usr/share/qt5ct/** r,
/usr/share/hwdata/pnp.ids r,
/etc/fstab r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{HOME}/ r,
owner @{HOME}/**/ r,
@{MOUNTS}/ r,
owner @{MOUNTS}/**/ r,
/tmp/ r,
owner /tmp/mozilla_*/ r,
owner /{home,media,tmp/mozilla_*}/**.@{smplayer_ext} rw,
owner @{user_music_dirs}/{,**} rw,
owner @{user_pictures_dirs}/{,**} rw,
owner @{user_torrents_dirs}/{,**} rw,
owner @{user_videos_dirs}/{,**} rw,
# For SMB shares
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**.@{smplayer_ext} r,
# SMPlayer config files
owner @{user_config_dirs}/smplayer/ rw,
owner @{user_config_dirs}/smplayer/* rwkl -> @{user_config_dirs}/smplayer/#[0-9]*[0-9],
# To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
owner @{user_config_dirs}/qt5ct/{,**} r,
/usr/share/qt5ct/** r,
owner @{user_cache_dirs}/#[0-9]*[0-9] rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner /tmp/qtsingleapp-smplay-* rw,
owner /tmp/qtsingleapp-smplay-*-lockfile rwk,
owner /tmp/smplayer_preview/ rw,
owner /tmp/smplayer_preview/[0-9]*.{jpg,png} rw,
owner /tmp/smplayer-mpv-* w,
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=** r,
owner /dev/shm/#[0-9]*[0-9] rw,
deny owner @{PROC}/@{pid}/stat r,
deny owner @{PROC}/@{pid}/cmdline r,
@ -120,34 +83,8 @@ profile smplayer @{exec_path} {
@{PROC}/@{pid}/mountinfo r,
@{PROC}/@{pid}/mounts r,
/etc/fstab r,
deny /dev/ r,
/dev/shm/#[0-9]*[0-9] rw,
owner /tmp/qtsingleapp-smplay-* rw,
owner /tmp/qtsingleapp-smplay-*-lockfile rwk,
/usr/share/hwdata/pnp.ids r,
# For the builtin thumbnail generator
owner /tmp/smplayer_preview/ rw,
owner /tmp/smplayer_preview/[0-9]*.{jpg,png} rw,
owner /tmp/smplayer-mpv-* w,
# External apps
/{usr/,}bin/mpv rPUx,
/{usr/,}bin/smtube rPUx,
/{usr/,}bin/youtube-dl rPUx,
/{usr/,}bin/yt-dlp rPUx,
# PulseAudio (to use "pacmd")
/{usr/,}bin/pacmd rPUx,
# file_inherit
/dev/ r,
owner /dev/tty[0-9]* rw,
owner @{HOME}/.anyRemote/anyremote.stdout w,
include if exists <local/smplayer>
}

150
apparmor.d/profiles-s-z/vidcutter
View file

@ -1,57 +1,32 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
# Video/audio extensions:
# a52, aac, ac3, mka, flac, mp1, mp2, mp3, mpc, oga, oma, wav, wv, wm, wma, 3g2, 3gp, 3gp2, 3gpp,
# asf, avi, divx, m1v, m2v, m4v, mkv, mov, mp4, mpa, mpe, mpg, mpeg, mpeg1, mpeg2, mpeg4, ogg, ogm,
# ogx, ogv, rm, rmvb, webm, wmv, wtv, mp2t
@{vidcutter_ext} = [aA]{52,[aA][cC],[cC]3}
@{vidcutter_ext} += [mM][kK][aA]
@{vidcutter_ext} += [fF][lL][aA][cC]
@{vidcutter_ext} += [mM][pP][123cC]
@{vidcutter_ext} += [oO][gGmM][aA]
@{vidcutter_ext} += [wW]{,[aA]}[vV]
@{vidcutter_ext} += [wW][mM]{,[aA]}
@{vidcutter_ext} += 3[gG]{[2pP],[pP][2pP]}
@{vidcutter_ext} += [aA][sS][fF]
@{vidcutter_ext} += [aA][vV][iI]
@{vidcutter_ext} += [dD][iI][vV][xX]
@{vidcutter_ext} += [mM][124][vV]
@{vidcutter_ext} += [mM][kKoO][vV]
@{vidcutter_ext} += [mM][pP][4aAeEgG]
@{vidcutter_ext} += [mM][pP][eE][gG]{,[124]}
@{vidcutter_ext} += [oO][gG][gGmMxXvV]
@{vidcutter_ext} += [rR][mM]{,[vV][bB]}
@{vidcutter_ext} += [wW][eE][bB][mM]
@{vidcutter_ext} += [wW][mMtT][vV]
@{vidcutter_ext} += [mM][pP]2[tT]
@{exec_path} = /{usr/,}bin/vidcutter
profile vidcutter @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/X>
include <abstractions/gtk>
include <abstractions/freedesktop.org>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/qt5-settings-write>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-shader-cache>
include <abstractions/user-download-strict>
include <abstractions/private-files-strict>
include <abstractions/audio>
include <abstractions/dconf-write>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/python>
include <abstractions/openssl>
include <abstractions/python>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write>
include <abstractions/qt5-shader-cache>
include <abstractions/ssl_certs>
include <abstractions/user-download-strict>
include <abstractions/X>
@{exec_path} r,
/{usr/,}bin/python3.[0-9]* r,
@ -63,46 +38,35 @@ profile vidcutter @{exec_path} {
/{usr/,}bin/ffprobe rPx,
/{usr/,}bin/mediainfo rPx,
/{usr/,}bin/xdg-open rCx -> open,
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
/{usr/,}bin/xdg-open rPx -> child-open,
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
# Which files vidcutter should be able to open
/ r,
/home/ r,
owner @{HOME}/ r,
owner @{HOME}/**/ r,
@{MOUNTS}/ r,
owner @{MOUNTS}/**/ r,
owner /{home,media}/**.@{vidcutter_ext} rw,
/usr/share/hwdata/pnp.ids r,
/usr/share/qt5ct/** r,
/etc/fstab r,
/etc/vdpau_wrapper.cfg r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{HOME}/ r,
owner @{user_music_dirs}/{,**} rw,
owner @{user_pictures_dirs}/{,**} rw,
owner @{user_torrents_dirs}/{,**} rw,
owner @{user_videos_dirs}/{,**} rw,
owner @{user_config_dirs}/vidcutter/ rw,
owner @{user_config_dirs}/vidcutter/* rwkl -> @{user_config_dirs}/vidcutter/#[0-9]*[0-9],
# If one is blocked, the others are probed.
deny owner @{HOME}/#[0-9]*[0-9] mrw,
owner @{HOME}/.glvnd* mrw,
# owner /tmp/#[0-9]*[0-9] mrw,
# owner /tmp/.glvnd* mrw,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9],
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9],
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
owner @{user_cache_dirs}/qtshadercache/ rw,
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9],
owner @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9] rw,
owner @{user_config_dirs}/qt5ct/{,**} r,
/usr/share/qt5ct/** r,
deny owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
# To remove the following error:
# GLib-GIO-WARNING **: Error creating IO channel for /proc/self/mountinfo: Permission denied
# (g-file-error-quark, 2)
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
deny @{PROC}/sys/kernel/random/boot_id r,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node[0-9]*/meminfo r,
@ -112,49 +76,17 @@ profile vidcutter @{exec_path} {
owner /tmp/*.jpg rwl -> /tmp/#[0-9]*[0-9],
owner /tmp/vidcutter/{,*} rw,
deny /dev/ r,
/dev/shm/#[0-9]*[0-9] rw,
/dev/disk/*/ r,
deny owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
deny @{PROC}/sys/kernel/random/boot_id r,
/etc/vdpau_wrapper.cfg r,
/dev/ r,
/dev/shm/#[0-9]*[0-9] rw,
/dev/disk/*/ r,
/etc/fstab r,
/usr/share/hwdata/pnp.ids r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
# Allowed apps to open
/{usr/,}lib/firefox/firefox rPUx,
# file_inherit
owner /dev/tty[0-9]* rw,
profile open {
include <abstractions/base>
include <abstractions/xdg-open>
/{usr/,}bin/xdg-open mr,
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{m,g,}awk rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/basename rix,
owner @{HOME}/ r,
owner @{run}/user/@{uid}/ r,
# Allowed apps to open
/{usr/,}lib/firefox/firefox rPUx,
# file_inherit
owner @{HOME}/.xsession-errors w,
}
include if exists <local/vidcutter>
}

66
apparmor.d/profiles-s-z/youtube-dl
View file

@ -1,59 +1,26 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
# Video/audio extensions:
# a52, aac, ac3, mka, flac, mp1, mp2, mp3, mpc, oga, oma, wav, wv, wm, wma, 3g2, 3gp, 3gp2, 3gpp,
# asf, avi, divx, m1v, m2v, m4v, mkv, mov, mp4, mpa, mpe, mpg, mpeg, mpeg1, mpeg2, mpeg4, ogg, ogm,
# ogx, ogv, rm, rmvb, webm, wmv, wtv, mp2t, m4a
@{ytdl_ext} = [aA]{52,[aA][cC],[cC]3}
@{ytdl_ext} += [mM][kK][aA]
@{ytdl_ext} += [fF][lL][aA][cC]
@{ytdl_ext} += [mM][pP][123cC]
@{ytdl_ext} += [oO][gGmM][aA]
@{ytdl_ext} += [wW]{,[aA]}[vV]
@{ytdl_ext} += [wW][mM]{,[aA]}
@{ytdl_ext} += 3[gG]{[2pP],[pP][2pP]}
@{ytdl_ext} += [aA][sS][fF]
@{ytdl_ext} += [aA][vV][iI]
@{ytdl_ext} += [dD][iI][vV][xX]
@{ytdl_ext} += [mM][124][vV]
@{ytdl_ext} += [mM][kKoO][vV]
@{ytdl_ext} += [mM][pP][4aAeEgG]
@{ytdl_ext} += [mM][pP][eE][gG]{,[124]}
@{ytdl_ext} += [oO][gG][gGmMxXvV]
@{ytdl_ext} += [rR][mM]{,[vV][bB]}
@{ytdl_ext} += [wW][eE][bB][mM]
@{ytdl_ext} += [wW][mMtT][vV]
@{ytdl_ext} += [mM][pP]2[tT]
@{ytdl_ext} += [mM]4[aA]
# The ytdl specific file extensions
# ytdl, part, tmp, temp
@{ytdl_ext} += [yY][tT][dD][lL]
@{ytdl_ext} += part{,-*}
@{ytdl_ext} += [tT]{,[eE]}[mM][pP]
@{exec_path} = /{usr/,}bin/youtube-dl
profile youtube-dl @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/X>
include <abstractions/audio>
include <abstractions/fonts>
include <abstractions/consoles>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/python>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/python>
include <abstractions/ssl_certs>
include <abstractions/user-download-strict>
signal (receive) set=(term, kill),
include <abstractions/X>
network inet dgram,
network inet6 dgram,
@ -61,9 +28,14 @@ profile youtube-dl @{exec_path} {
network inet6 stream,
network netlink raw,
signal (receive) set=(term, kill),
@{exec_path} r,
/{usr/,}bin/python3.[0-9]* r,
/{usr/,}bin/ffmpeg rPx,
/{usr/,}bin/ffprobe rPx,
/{usr/,}bin/ r,
/{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
/{usr/,}lib/llvm-[0-9]*/bin/clang rix,
@ -72,25 +44,19 @@ profile youtube-dl @{exec_path} {
/{usr/,}bin/rtmpdump rix,
/{usr/,}bin/git rix,
# Which files youtube-dl should be able to open
owner @{HOME}/ r,
owner @{HOME}/**/ r,
owner @{MOUNTS}/**/ r,
owner /{home,media}/**.@{ytdl_ext} rw,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
/etc/mime.types r,
owner @{HOME}/ r,
owner @{user_music_dirs}/{,**} rw,
owner @{user_videos_dirs}/{,**} rw,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/youtube-dl/{,**} rw,
owner @{user_config_dirs}/git/config r,
# External apps
/{usr/,}bin/ffmpeg rPUx,
/{usr/,}bin/ffprobe rPUx,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/youtube-dl>
}

44
apparmor.d/profiles-s-z/yt-dlp
View file

@ -1,50 +1,19 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
# Video/audio extensions:
# a52, aac, ac3, mka, flac, mp1, mp2, mp3, mpc, oga, oma, wav, wv, wm, wma, 3g2, 3gp, 3gp2, 3gpp,
# asf, avi, divx, m1v, m2v, m4v, mkv, mov, mp4, mpa, mpe, mpg, mpeg, mpeg1, mpeg2, mpeg4, ogg, ogm,
# ogx, ogv, rm, rmvb, webm, wmv, wtv, mp2t, m4a
@{ytdlp_ext} = [aA]{52,[aA][cC],[cC]3}
@{ytdlp_ext} += [mM][kK][aA]
@{ytdlp_ext} += [fF][lL][aA][cC]
@{ytdlp_ext} += [mM][pP][123cC]
@{ytdlp_ext} += [oO][gGmM][aA]
@{ytdlp_ext} += [wW]{,[aA]}[vV]
@{ytdlp_ext} += [wW][mM]{,[aA]}
@{ytdlp_ext} += 3[gG]{[2pP],[pP][2pP]}
@{ytdlp_ext} += [aA][sS][fF]
@{ytdlp_ext} += [aA][vV][iI]
@{ytdlp_ext} += [dD][iI][vV][xX]
@{ytdlp_ext} += [mM][124][vV]
@{ytdlp_ext} += [mM][kKoO][vV]
@{ytdlp_ext} += [mM][pP][4aAeEgG]
@{ytdlp_ext} += [mM][pP][eE][gG]{,[124]}
@{ytdlp_ext} += [oO][gG][gGmMxXvV]
@{ytdlp_ext} += [rR][mM]{,[vV][bB]}
@{ytdlp_ext} += [wW][eE][bB][mM]
@{ytdlp_ext} += [wW][mMtT][vV]
@{ytdlp_ext} += [mM][pP]2[tT]
@{ytdlp_ext} += [mM]4[aA]
# The ytdl specific file extensions
# ytdl, part, tmp, temp
@{ytdlp_ext} += [yY][tT][dD][lL]
@{ytdlp_ext} += part{,-*}
@{ytdlp_ext} += [tT]{,[eE]}[mM][pP]
@{exec_path} = /{usr/,}bin/yt-dlp
profile yt-dlp @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/python>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/python>
include <abstractions/ssl_certs>
include <abstractions/user-download-strict>
@ -63,9 +32,10 @@ profile yt-dlp @{exec_path} {
/{usr/,}bin/ffmpeg rPx,
/{usr/,}bin/ffprobe rPx,
# Which files yt-dlp should be able to open
owner /media/**/ r,
owner /media/**.@{ytdlp_ext} rwk,
/etc/magic r,
owner @{user_music_dirs}/{,**} rw,
owner @{user_videos_dirs}/{,**} rw,
owner @{HOME}/.cache/ rw,
owner @{HOME}/.cache/yt-dlp/ rw,
@ -73,7 +43,5 @@ profile yt-dlp @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
/etc/magic r,
include if exists <local/yt-dlp>
}

54
apparmor.d/profiles-s-z/ytdl
View file

@ -1,60 +1,29 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
# Video/audio extensions:
# a52, aac, ac3, mka, flac, mp1, mp2, mp3, mpc, oga, oma, wav, wv, wm, wma, 3g2, 3gp, 3gp2, 3gpp,
# asf, avi, divx, m1v, m2v, m4v, mkv, mov, mp4, mpa, mpe, mpg, mpeg, mpeg1, mpeg2, mpeg4, ogg, ogm,
# ogx, ogv, rm, rmvb, webm, wmv, wtv, mp2t, m4a
@{ytdl_ext} = [aA]{52,[aA][cC],[cC]3}
@{ytdl_ext} += [mM][kK][aA]
@{ytdl_ext} += [fF][lL][aA][cC]
@{ytdl_ext} += [mM][pP][123cC]
@{ytdl_ext} += [oO][gGmM][aA]
@{ytdl_ext} += [wW]{,[aA]}[vV]
@{ytdl_ext} += [wW][mM]{,[aA]}
@{ytdl_ext} += 3[gG]{[2pP],[pP][2pP]}
@{ytdl_ext} += [aA][sS][fF]
@{ytdl_ext} += [aA][vV][iI]
@{ytdl_ext} += [dD][iI][vV][xX]
@{ytdl_ext} += [mM][124][vV]
@{ytdl_ext} += [mM][kKoO][vV]
@{ytdl_ext} += [mM][pP][4aAeEgG]
@{ytdl_ext} += [mM][pP][eE][gG]{,[124]}
@{ytdl_ext} += [oO][gG][gGmMxXvV]
@{ytdl_ext} += [rR][mM]{,[vV][bB]}
@{ytdl_ext} += [wW][eE][bB][mM]
@{ytdl_ext} += [wW][mMtT][vV]
@{ytdl_ext} += [mM][pP]2[tT]
@{ytdl_ext} += [mM]4[aA]
# The ytdl specific file extensions
# ytdl, part, tmp, temp
@{ytdl_ext} += [yY][tT][dD][lL]
@{ytdl_ext} += part{,-*}
@{ytdl_ext} += [tT]{,[eE]}[mM][pP]
@{exec_path} = /{usr/,}bin/ytdl
profile ytdl @{exec_path} {
include <abstractions/base>
include <abstractions/python>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/python>
include <abstractions/ssl_certs>
include <abstractions/user-download-strict>
signal (receive) set=(term, kill),
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
network netlink raw,
signal (receive) set=(term, kill),
@{exec_path} r,
/{usr/,}bin/python3.[0-9]* r,
@ -62,19 +31,16 @@ profile ytdl @{exec_path} {
/{usr/,}{s,}bin/ldconfig rix,
/{usr/,}bin/uname rix,
# Which files youtube-dl should be able to open
/etc/mime.types r,
owner @{HOME}/ r,
owner @{HOME}/**/ r,
owner @{MOUNTS}/**/ r,
owner /{home,media}/**.@{ytdl_ext} rw,
owner @{user_music_dirs}/{,**} rw,
owner @{user_videos_dirs}/{,**} rw,
owner @{user_cache_dirs}/youtube-dl/youtube-sigfuncs/js*.json r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
/etc/mime.types r,
# Needed when displaying info on available formats
owner @{user_cache_dirs}/youtube-dl/youtube-sigfuncs/js*.json r,
include if exists <local/ytdl>
}