refractor: moce a lot of profiles inside they own groups.
This commit is contained in:
Alexandre Pujol
parent
e5aad04be4
commit
9304c9a668
61 changed files with 1 additions and 9 deletions
|
|
@ -1,134 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{bin_dirs} = @{bin}/ /snap/{snapd,core}/@{int}@{bin}
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{bin_dirs}/snap
|
||||
profile snap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.systemd1>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
capability setuid,
|
||||
capability sys_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
ptrace read peer=snap.snap-store.snap-store,
|
||||
|
||||
unix (send, receive) type=stream peer=(label=apt),
|
||||
|
||||
mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-@{int}/,
|
||||
|
||||
#aa:dbus own bus=session name=io.snapcraft.Launcher
|
||||
#aa:dbus own bus=session name=io.snapcraft.SessionAgent
|
||||
#aa:dbus own bus=session name=io.snapcraft.Settings
|
||||
|
||||
#aa:dbus talk bus=session name=io.snapcraft.PrivilegedDesktopLauncher label=snap.snap-store.snap-store
|
||||
#aa:dbus talk bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}"
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/portal/documents
|
||||
interface=org.freedesktop.portal.Documents
|
||||
member=GetMountPoint
|
||||
peer=(name=org.freedesktop.portal.Documents, label="{xdg-document-portal,unconfined}"),
|
||||
|
||||
dbus receive bus=session
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
member=Introspect
|
||||
peer=(name=@{busname}, label=gnome-shell),
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{bin}/mount rix,
|
||||
@{bin}/getent rix,
|
||||
|
||||
@{bin}/gpg{,2} rCx -> gpg,
|
||||
@{bin}/systemctl rCx -> systemctl,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
@{lib_dirs}/snapd/snap-confine rPx,
|
||||
@{lib_dirs}/snapd/snap-seccomp rPx,
|
||||
@{lib_dirs}/snapd/snapd rPx,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/snapd/{,**} rwk,
|
||||
/var/cache/snapd/commands.db rwk,
|
||||
/var/cache/snapd/names r,
|
||||
|
||||
@{DESKTOP_HOME}/snap/{,**} rw,
|
||||
@{HOME}/snap/{,**} rw,
|
||||
/snap/{,**} rw,
|
||||
|
||||
owner @{tmp}/snapd-auto-import-mount-@{int}/ rw,
|
||||
|
||||
@{run}/user/@{uid}/bus rw,
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
||||
owner @{run}/user/@{uid}/snapd-session-agent.socket rw,
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
@{run}/snapd.socket rw,
|
||||
|
||||
@{sys}/fs/cgroup/cgroup.controllers r,
|
||||
@{sys}/kernel/security/apparmor/features/{,**} r,
|
||||
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
@{PROC}/cgroups r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/uuid r,
|
||||
@{PROC}/sys/kernel/seccomp/actions_avail r,
|
||||
@{PROC}/version r,
|
||||
owner @{PROC}/@{pid}/attr/apparmor/current r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
/dev/ttyS@{int} rw,
|
||||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/gpg{,2} mr,
|
||||
|
||||
@{bin}/dirmngr rix,
|
||||
@{bin}/gpg-agent rix,
|
||||
@{bin}/gpg-connect-agent rix,
|
||||
|
||||
owner @{HOME}/.snap/gnupg/ rw,
|
||||
owner @{HOME}/.snap/gnupg/** rwkl,
|
||||
|
||||
include if exists <local/snap_gpg>
|
||||
}
|
||||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/systemctl>
|
||||
include <abstractions/bus/org.freedesktop.systemd1>
|
||||
|
||||
network unix stream,
|
||||
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
owner @{run}/user/@{uid}/systemd/private rw,
|
||||
|
||||
include if exists <local/snap_systemctl>
|
||||
}
|
||||
|
||||
include if exists <local/snap>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/snapd/snap-bootstrap
|
||||
profile snap-bootstrap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/snap-bootstrap>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/snapd/snap-device-helper
|
||||
profile snap-device-helper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
capability bpf,
|
||||
capability dac_read_search,
|
||||
capability setgid,
|
||||
capability sys_resource,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/fs/bpf/snap/ w,
|
||||
|
||||
include if exists <local/snap-device-helper>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snap-discard-ns
|
||||
profile snap-discard-ns @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
capability setgid,
|
||||
capability sys_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
umount @{run}/snapd/ns/*.mnt,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/ r,
|
||||
@{run}/ r,
|
||||
@{run}/snapd/ r,
|
||||
@{run}/snapd/lock/ r,
|
||||
@{run}/snapd/lock/*.lock rwk,
|
||||
@{run}/snapd/ns/ r,
|
||||
@{run}/snapd/ns/* rw,
|
||||
|
||||
include if exists <local/snap-discard-ns>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snap-failure
|
||||
profile snap-failure @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/systemctl rCx -> systemctl,
|
||||
@{lib_dirs}/snapd/snapd rPx,
|
||||
|
||||
/var/lib/snapd/sequence/snapd.json r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/snap-failure_systemctl>
|
||||
}
|
||||
|
||||
include if exists <local/snap-failure>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/snapd/snap-repair
|
||||
profile snap-repair @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/snap-repair>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snap-seccomp
|
||||
profile snap-seccomp @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib_dirs}/**.so* mr,
|
||||
|
||||
@{bin}/getent rix,
|
||||
|
||||
/var/lib/snapd/seccomp/bpf/{,**} rw,
|
||||
|
||||
owner @{PROC}/@{pids}/mountinfo r,
|
||||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
include if exists <local/snap-seccomp>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snap-update-ns
|
||||
profile snap-update-ns @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
capability dac_override,
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
mount -> /boot/,
|
||||
mount -> /snap/**,
|
||||
mount -> /tmp/.snap/**,
|
||||
mount -> /usr/**,
|
||||
mount -> /var/lib/dhcp/,
|
||||
|
||||
umount /snap/**,
|
||||
umount /var/lib/dhcp/,
|
||||
umount @{lib}/@{multiarch}/webkit2gtk-@{version}/,
|
||||
umount /usr/share/xml/iso-codes/,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib}/@{multiarch}/webkit2gtk-@{version}/ w,
|
||||
/usr/share/xml/iso-codes/ w,
|
||||
|
||||
/var/lib/snapd/mount/{,*} r,
|
||||
|
||||
/ r,
|
||||
/tmp/ r,
|
||||
|
||||
owner /snap/{,**} rw,
|
||||
|
||||
owner /var/ rw,
|
||||
owner /var/snap/ rw,
|
||||
owner /var/snap/**/ rw,
|
||||
|
||||
owner @{tmp}/.snap/{,**} rwk,
|
||||
|
||||
@{run}/snapd/lock/*.lock rwk,
|
||||
@{run}/snapd/ns/{,**} rw,
|
||||
|
||||
@{sys}/fs/cgroup/{,**/} r,
|
||||
@{sys}/fs/cgroup/system.slice/snap.*.service/cgroup.freeze rw,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.freeze rw,
|
||||
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/version r,
|
||||
|
||||
include if exists <local/snap-update-ns>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,190 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{bin_dirs} = @{bin}/ /snap/{snapd,core}/@{int}@{bin}
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snapd
|
||||
profile snapd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.PolicyKit1>
|
||||
include <abstractions/bus/org.freedesktop.timedate1>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability mac_admin,
|
||||
capability net_admin,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_admin,
|
||||
capability sys_ptrace,
|
||||
capability sys_resource,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network netlink raw,
|
||||
network unix stream,
|
||||
|
||||
mount fstype=squashfs /dev/loop@{int} -> /tmp/syscheck-mountpoint-@{int}/,
|
||||
umount /tmp/syscheck-mountpoint-@{int}/,
|
||||
umount /snap/*/*/,
|
||||
|
||||
ptrace read peer=@{p_systemd},
|
||||
ptrace read peer=snap{,.*},
|
||||
|
||||
unix (bind) type=stream addr=@@{udbus}/bus/systemctl/,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/
|
||||
interface=org.freedesktop.login1.Manager
|
||||
member={SetWallMessage,ScheduleShutdown}
|
||||
peer=(name=org.freedesktop.login1, label=systemd-logind),
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{bin}/adduser rPx,
|
||||
@{bin}/groupadd rPx,
|
||||
@{bin}/hostnamectl rPx,
|
||||
@{bin}/ssh-keygen rPx,
|
||||
@{bin}/useradd rPx,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/apparmor_parser rPx,
|
||||
@{bin}/cp rix,
|
||||
@{bin}/getent rix,
|
||||
@{bin}/gzip rix,
|
||||
@{bin}/journalctl rPx,
|
||||
@{bin}/kmod rPx,
|
||||
@{bin}/mount rix,
|
||||
@{bin}/runuser rCx -> runuser,
|
||||
@{bin}/sync rix,
|
||||
@{bin}/systemctl rix,
|
||||
@{bin}/systemd-detect-virt rPx,
|
||||
@{bin}/tar rix,
|
||||
@{bin}/udevadm rPx,
|
||||
@{bin}/umount rix,
|
||||
@{bin}/unsquashfs rix,
|
||||
@{bin}/update-desktop-database rPx,
|
||||
|
||||
@{bin_dirs}/fc-cache-* mr,
|
||||
@{bin_dirs}/snap rPUx,
|
||||
@{bin_dirs}/xdelta3 rix,
|
||||
@{lib_dirs}/@{multiarch}/** mr,
|
||||
@{lib_dirs}/@{multiarch}/ld-*.so rix,
|
||||
@{lib_dirs}/snapd/apparmor_parser rPx,
|
||||
@{lib_dirs}/snapd/snap-discard-ns rPx,
|
||||
@{lib_dirs}/snapd/snap-seccomp rPx,
|
||||
@{lib_dirs}/snapd/snap-update-ns rPx,
|
||||
|
||||
/usr/share/bash-completion/{,**} r,
|
||||
/usr/share/dbus-1/{system,session}.d/{,snapd*} rw,
|
||||
/usr/share/dbus-1/services/*snap* r,
|
||||
/usr/share/polkit-1/actions/{,**/} r,
|
||||
|
||||
@{etc_ro}/environment r,
|
||||
/etc/apparmor.d/*snapd.snap* r,
|
||||
/etc/dbus-1/system.d/{,**/} r,
|
||||
/etc/fstab r,
|
||||
/etc/mime.types r,
|
||||
/etc/modprobe.d/{,**/} r,
|
||||
/etc/modules-load.d/{,**/} r,
|
||||
/etc/modules-load.d/*snap* rw,
|
||||
/etc/systemd/system/{,**/} r,
|
||||
/etc/systemd/system/snap* rw,
|
||||
/etc/systemd/user/{,**/} r,
|
||||
/etc/systemd/user/**/*snap* rw,
|
||||
/etc/systemd/user/*snap* rw,
|
||||
/etc/udev/rules.d/{,*snap*} rw,
|
||||
|
||||
/snap/{,**} rw,
|
||||
/var/cache/snapd/{,**} rwlk,
|
||||
/var/lib/snapd/{,**} rwlk,
|
||||
/var/snap/{,**} rw,
|
||||
|
||||
/var/cache/apparmor/{,*/} r,
|
||||
/var/cache/apparmor/*/snap* rw,
|
||||
|
||||
/tmp/ r,
|
||||
/tmp/read-file@{int}/{,**} rw,
|
||||
/tmp/snapd@{int}/ rw,
|
||||
/tmp/snapd@{int}/** rw,
|
||||
/tmp/syscheck-mountpoint-@{int}/{,**} rw,
|
||||
/tmp/syscheck-squashfs-@{int} rw,
|
||||
|
||||
/boot/ r,
|
||||
/boot/grub/grubenv r,
|
||||
|
||||
/ r,
|
||||
/home/ r,
|
||||
@{HOME}/ r,
|
||||
@{HOME}/snap/{,**} rw,
|
||||
@{HOME}/.snap*/{,**} rw,
|
||||
|
||||
owner @{run}/mount/ rw,
|
||||
owner @{run}/mount/utab{,.*} rw,
|
||||
owner @{run}/mount/utab.lock wk,
|
||||
|
||||
@{run}/user/ r,
|
||||
@{run}/user/@{uid}/ r,
|
||||
@{run}/user/@{uid}/snapd-session-agent.socket rw,
|
||||
@{run}/user/snap.*/{,**} rw,
|
||||
|
||||
@{run}/snapd*.socket rw,
|
||||
@{run}/snapd/{,**} rw,
|
||||
@{run}/snapd/lock/*.lock rwk,
|
||||
@{run}/systemd/notify rw,
|
||||
@{run}/systemd/private rw,
|
||||
|
||||
@{sys}/fs/cgroup/{,*/} r,
|
||||
@{sys}/fs/cgroup/cgroup.controllers r,
|
||||
@{sys}/fs/cgroup/system.slice/{,**/} r,
|
||||
@{sys}/fs/cgroup/system.slice/snap*.service/cgroup.procs r,
|
||||
@{sys}/fs/cgroup/user.slice/ r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.procs r,
|
||||
@{sys}/kernel/kexec_loaded r,
|
||||
@{sys}/kernel/security/apparmor/.notify r,
|
||||
@{sys}/kernel/security/apparmor/features/{,**} r,
|
||||
@{sys}/kernel/security/apparmor/profiles r,
|
||||
|
||||
@{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/@{pid}/stat r,
|
||||
@{PROC}/cgroups r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/seccomp/actions_avail r,
|
||||
@{PROC}/version r,
|
||||
owner @{PROC}/@{pids}/cmdline r,
|
||||
owner @{PROC}/@{pids}/mountinfo r,
|
||||
|
||||
/dev/loop-control rw,
|
||||
|
||||
profile runuser {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/runuser mr,
|
||||
|
||||
include if exists <local/snapd_runuser>
|
||||
}
|
||||
|
||||
include if exists <local/snapd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snapd-aa-prompt-listener
|
||||
profile snapd-aa-prompt-listener @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{lib_dirs}/snapd/info r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
include if exists <local/snapd-aa-prompt-listener>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snapd-aa-prompt-ui
|
||||
profile snapd-aa-prompt-ui @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{lib_dirs}/snapd/info r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
include if exists <local/snapd-aa-prompt-ui>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
|
||||
|
||||
@{exec_path} = @{lib_dirs}/snapd/snapd-apparmor
|
||||
profile snapd-apparmor @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{bin}/systemd-detect-virt rPx,
|
||||
@{bin}/apparmor_parser rPx,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
@{lib_dirs}/snapd/apparmor_parser rPx -> apparmor_parser,
|
||||
@{lib_dirs}/snapd/info r,
|
||||
|
||||
/var/lib/snapd/apparmor/profiles/ r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
include if exists <local/snapd-apparmor>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/snapd/snapd.core-fixup.sh
|
||||
profile snapd-core-fixup @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/snapd-core-fixup>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,434 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# Security objectives of the steam profiles:
|
||||
# - Ensure no user data is accessed by either steam or steam games
|
||||
# - Limit what steam/games can access to the host
|
||||
#
|
||||
# Overall architecture of the steam profiles:
|
||||
# steam
|
||||
# ├── steam//check # Requirements check (sandboxed)
|
||||
# ├── steam//web # steamwebhelper (sandboxed)
|
||||
# ├── steam-fossilize # Update shader cache
|
||||
# ├── steam-runtime # Launcher tasks up to the creation of the sandbox
|
||||
# │ ├── steam-game-native # Native games
|
||||
# │ └── steam-game-proton # Proton games (sandboxed)
|
||||
# ├── steam-gameoverlayui # Steam game overlay
|
||||
# └── steamerrorreporter # Error reporter
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{share_dirs}/steam.sh
|
||||
profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/video>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
network unix,
|
||||
|
||||
ptrace read,
|
||||
ptrace trace peer=steam,
|
||||
|
||||
signal send peer=steam-game-{native,proton},
|
||||
signal send peer=steam-launcher,
|
||||
signal send peer=steam//journalctl,
|
||||
signal send peer=steam//web,
|
||||
|
||||
unix,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{coreutils_path} rix,
|
||||
@{open_path} rPx -> child-open,
|
||||
@{bin}/getopt rix,
|
||||
@{bin}/journalctl rPx -> systemctl,
|
||||
@{bin}/ldconfig rix,
|
||||
@{bin}/ldd rix,
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/lsof rix,
|
||||
@{bin}/lspci rCx -> lspci,
|
||||
@{bin}/tar rix,
|
||||
@{bin}/which{,.debianutils} rix,
|
||||
@{bin}/xdg-icon-resource rPx,
|
||||
@{bin}/xdg-user-dir rix,
|
||||
@{bin}/xz rix,
|
||||
@{bin}/zenity rix,
|
||||
@{lib}/@{multiarch}/ld-*.so* rix,
|
||||
@{lib}/ld-linux.so* rix,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
@{lib_dirs}/*driverquery rix,
|
||||
@{lib_dirs}/fossilize_replay rpx, # steam-fossilize
|
||||
@{lib_dirs}/gameoverlayui rpx, # steam-gameoverlayui
|
||||
@{lib_dirs}/reaper rpx, # steam-runtime
|
||||
@{lib_dirs}/steam* rix,
|
||||
|
||||
@{app_dirs}/@{runtime}/*entry-point rpx -> steam-runtime,
|
||||
|
||||
@{share_dirs}/linux{32,64}/steamerrorreporter rpx, # steamerrorreporter
|
||||
|
||||
@{runtime_dirs}/*entry-point rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/srt-logger rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements rcx -> check,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-dialog{,-ui} rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-identify-library-abi rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-input-monitor rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launch-* rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-interface-@{int} rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, # steam-launcher
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-libcurl-* rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-supervisor rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-system-info rix,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-urlopen rix,
|
||||
@{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix,
|
||||
@{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-logger rix,
|
||||
@{runtime_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix,
|
||||
@{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix,
|
||||
@{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rcx -> web,
|
||||
@{runtime_dirs}/run{,.sh} rix,
|
||||
@{runtime_dirs}/setup.sh rix,
|
||||
|
||||
@{lib}/os-release rk,
|
||||
|
||||
/usr/share/fonts/** rk,
|
||||
|
||||
/etc/lsb-release r,
|
||||
/etc/machine-id r,
|
||||
/etc/timezone r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/ r,
|
||||
@{bin}/ r,
|
||||
@{lib}/ r,
|
||||
/etc/ r,
|
||||
/home/ r,
|
||||
/usr/ r,
|
||||
/usr/local/ r,
|
||||
/usr/local/lib/ r,
|
||||
|
||||
/var/ r,
|
||||
/var/tmp/ r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.steam/{,**} rw,
|
||||
owner @{HOME}/.steam/registry.vdf rwk,
|
||||
owner @{HOME}/.steampath rw,
|
||||
owner @{HOME}/.steampid rw,
|
||||
|
||||
owner @{share_dirs}/ rw,
|
||||
owner @{share_dirs}/** rwlk -> @{share_dirs}/**,
|
||||
|
||||
owner @{user_games_dirs}/ rw,
|
||||
owner @{user_games_dirs}/** rwlk -> @{user_games_dirs}/**,
|
||||
|
||||
owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw,
|
||||
owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk,
|
||||
owner @{user_config_dirs}/autostart/ r,
|
||||
owner @{user_config_dirs}/cef_user_data/{,**} r,
|
||||
owner @{user_config_dirs}/cef_user_data/Dictionaries/* rw,
|
||||
owner @{user_config_dirs}/cef_user_data/WidevineCdm/** mrw,
|
||||
|
||||
owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw,
|
||||
owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk,
|
||||
owner @{user_share_dirs}/applications/*.desktop w,
|
||||
owner @{user_share_dirs}/icons/hicolor/**/apps/steam*.png rw,
|
||||
owner @{user_share_dirs}/vulkan/implicit_layer.d/steam*.json rwk,
|
||||
|
||||
@{tmp}/ r,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/ rw,
|
||||
owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/** rwlk,
|
||||
owner @{tmp}/dumps/ rw,
|
||||
owner @{tmp}/dumps/** rwk,
|
||||
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
|
||||
owner @{tmp}/glx-icds-@{rand6}/{,**} rw,
|
||||
owner @{tmp}/runtime-info.txt.@{rand6} rwk,
|
||||
owner @{tmp}/steam/ rw,
|
||||
owner @{tmp}/steam/** rwk,
|
||||
owner @{tmp}/steam@{rand6}/{,**} rw,
|
||||
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,
|
||||
|
||||
owner @{att}/dev/shm/ValveIPCSHM_@{uid} rw,
|
||||
owner /dev/shm/fossilize-*-@{int}-@{int} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex8} rw,
|
||||
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
owner @{run}/user/@{uid}/srt-fifo.@{rand6}/{,*} rw,
|
||||
|
||||
@{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.)
|
||||
|
||||
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
|
||||
@{run}/udev/data/n@{int} r,
|
||||
|
||||
@{sys}/ r,
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/hidraw/ r,
|
||||
@{sys}/class/input/ r,
|
||||
@{sys}/class/net/ r,
|
||||
@{sys}/class/power_supply/ r,
|
||||
@{sys}/devices/ r,
|
||||
@{sys}/devices/**/input/input@{int}/ r,
|
||||
@{sys}/devices/**/input/input@{int}/properties r,
|
||||
@{sys}/devices/**/input@{int}/ r,
|
||||
@{sys}/devices/**/input@{int}/capabilities/* r,
|
||||
@{sys}/devices/**/power_supply/{AC,BAT@{int},hidpp_battery_@{int}}/{,*} r,
|
||||
@{sys}/devices/**/report_descriptor r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/devices/@{pci}/boot_vga r,
|
||||
@{sys}/devices/@{pci}/sound/card@{int}/input@{int}/properties r,
|
||||
@{sys}/devices/system/ r,
|
||||
@{sys}/devices/system/cpu/cpu@{int}/ r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_version r,
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/net/*/ r,
|
||||
@{sys}/kernel/ r,
|
||||
@{sys}/power/suspend_stats/success rk,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pid}/comm rk,
|
||||
@{PROC}/@{pid}/fdinfo/@{int} r,
|
||||
@{PROC}/@{pid}/net/* r,
|
||||
@{PROC}/@{pid}/stat r,
|
||||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/locks r,
|
||||
@{PROC}/sys/kernel/sched_autogroup_enabled r,
|
||||
@{PROC}/sys/kernel/unprivileged_userns_clone r,
|
||||
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
|
||||
@{PROC}/sys/user/max_user_namespaces r,
|
||||
@{PROC}/version r,
|
||||
owner @{PROC}/@{pid}/autogroup rw,
|
||||
owner @{PROC}/@{pid}/cmdline rk,
|
||||
owner @{PROC}/@{pid}/environ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/fd/@{int} rw,
|
||||
owner @{PROC}/@{pid}/mem r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/task/ r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/children r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
|
||||
/dev/input/ r,
|
||||
/dev/uinput w,
|
||||
|
||||
deny /opt/** r,
|
||||
|
||||
profile web flags=(attach_disconnected,mediate_deleted,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/video>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability sys_chroot,
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
ptrace trace peer=steam//web,
|
||||
|
||||
signal receive set=(cont kill term) peer=steam,
|
||||
|
||||
unix receive type=stream,
|
||||
|
||||
@{bin}/getopt rix,
|
||||
@{bin}/gzip rix,
|
||||
@{bin}/ldconfig rix,
|
||||
@{bin}/localedef rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/true rix,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
@{lib_dirs}/steamwebhelper rix,
|
||||
@{lib_dirs}/steamwebhelper_sniper_wrap.sh rix,
|
||||
|
||||
@{runtime_dirs}/pressure-vessel/@{bin}/steam-runtime-launcher-interface-@{int} rix,
|
||||
@{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap mr,
|
||||
|
||||
@{lib}/pressure-vessel/from-host/** rix,
|
||||
@{run}/host/@{bin}/* rix,
|
||||
@{run}/host/@{lib}/** rix,
|
||||
|
||||
@{share_dirs}/config/cefdata/WidevineCdm/**/linux_*/libwidevinecdm.so mr,
|
||||
|
||||
@{runtime_dirs}/var/tmp-@{rand6}/usr/.ref w,
|
||||
|
||||
@{run}/host/{,**} r,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
||||
@{lib}/ r,
|
||||
/usr/local/lib/ r,
|
||||
/var/tmp/ r,
|
||||
|
||||
owner /bindfile@{rand6} rw,
|
||||
|
||||
owner /var/cache/ldconfig/aux-cache* rw,
|
||||
owner /var/pressure-vessel/ldso/* rw,
|
||||
|
||||
owner @{lib_dirs}/.cef-* wk,
|
||||
|
||||
owner @{share_dirs}/{,**} r,
|
||||
owner @{share_dirs}/clientui/** k,
|
||||
owner @{share_dirs}/config/** rwk,
|
||||
owner @{share_dirs}/logs/** rwk,
|
||||
owner @{share_dirs}/public/** k,
|
||||
|
||||
@{tmp}/ r,
|
||||
owner @{tmp}/.com.valvesoftware.Steam.@{rand6} rw,
|
||||
owner @{tmp}/.com.valvesoftware.Steam.@{rand6}/{,**} rw,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/dumps/ rw,
|
||||
owner @{tmp}/dumps/** rwk,
|
||||
owner @{tmp}/pressure-vessel-*-@{rand6}/ rw,
|
||||
owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**,
|
||||
owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw,
|
||||
|
||||
owner /dev/shm/.com.valvesoftware.Steam.@{rand6} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex8} rw,
|
||||
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
|
||||
owner /dev/shm/ValveIPCSHM_@{uid} rw,
|
||||
|
||||
owner @{run}/pressure-vessel/** r,
|
||||
|
||||
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/*/devices/ r,
|
||||
@{sys}/class/*/ r,
|
||||
@{sys}/devices/**/report_descriptor r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/devices/@{pci}/usb@{int}/**/{idVendor,idProduct,interface} r,
|
||||
@{sys}/devices/system/cpu/kernel_max r,
|
||||
@{sys}/devices/virtual/tty/tty@{int}/active r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pid}/stat r,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mem r,
|
||||
owner @{PROC}/@{pid}/oom_score_adj w,
|
||||
owner @{PROC}/@{pid}/statm r,
|
||||
owner @{PROC}/@{pid}/task/ r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/status r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/hidraw@{int} rw,
|
||||
/dev/tty rw,
|
||||
|
||||
include if exists <local/steam_web>
|
||||
}
|
||||
|
||||
profile check flags=(attach_disconnected,mediate_deleted,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
||||
unix receive type=stream,
|
||||
|
||||
@{bin}/true rix,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements mr,
|
||||
@{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rix,
|
||||
|
||||
/ r,
|
||||
|
||||
owner @{HOME}/.steam/root r,
|
||||
owner @{HOME}/.steam/steam r,
|
||||
|
||||
owner @{share_dirs}/ r,
|
||||
|
||||
@{PROC}/1/cgroup r,
|
||||
|
||||
include if exists <local/steam_check>
|
||||
}
|
||||
|
||||
profile lspci flags=(attach_disconnected,mediate_deleted,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
unix receive type=stream,
|
||||
|
||||
@{bin}/lspci mr,
|
||||
|
||||
owner @{HOME}/.steam/steam.pipe r,
|
||||
|
||||
@{sys}/bus/pci/devices/ r,
|
||||
@{sys}/bus/pci/slots/ r,
|
||||
@{sys}/bus/pci/slots/@{int}/address r,
|
||||
@{sys}/devices/@{pci}/** r,
|
||||
|
||||
owner /dev/shm/ValveIPCSHM_@{uid} rw,
|
||||
|
||||
include if exists <local/steam_lspci>
|
||||
}
|
||||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
/{run,var}/log/journal/ r,
|
||||
/{run,var}/log/journal/@{hex32}/ r,
|
||||
/{run,var}/log/journal/@{hex32}/system.journal* r,
|
||||
/{run,var}/log/journal/@{hex32}/system@@{hex}.journal* r,
|
||||
/{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r,
|
||||
|
||||
include if exists <local/steam_systemctl>
|
||||
}
|
||||
|
||||
include if exists <local/steam>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{lib_dirs}/fossilize_replay
|
||||
profile steam-fossilize @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/wayland>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
signal receive peer=steam,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
|
||||
owner @{HOME}/.steam/steam.pipe r,
|
||||
|
||||
owner @{share_dirs}/logs/container-runtime-info.txt.@{rand6} rw,
|
||||
owner @{share_dirs}/steamapps/shadercache/@{int}/fozpipelinesv@{int}/{,**} rw,
|
||||
owner @{share_dirs}/steamapps/shadercache/@{int}/mesa_shader_cache_sf/{,**} rwk,
|
||||
owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/ rw,
|
||||
owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/** rwk,
|
||||
|
||||
owner @{tmp}/runtime-info.txt.@{rand6} rw,
|
||||
|
||||
owner /dev/shm/fossilize-*-@{int}-@{int} rw,
|
||||
|
||||
@{sys}/devices/system/node/node@{int}/cpumap r,
|
||||
|
||||
@{PROC}/@{pids}/statm r,
|
||||
@{PROC}/pressure/io r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
|
||||
include if exists <local/steam-fossilize>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{app_dirs}/*/**
|
||||
profile steam-game-native @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/steam-game>
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
network unix stream,
|
||||
|
||||
signal receive peer=steam,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{sh_path} rix,
|
||||
|
||||
@{app_dirs}/** mr,
|
||||
@{lib_dirs}/** mr,
|
||||
|
||||
include if exists <local/steam-game-native>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,103 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap
|
||||
profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/common/steam-game>
|
||||
include <abstractions/python>
|
||||
include <abstractions/wine>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network unix stream,
|
||||
|
||||
signal receive peer=steam,
|
||||
unix,
|
||||
|
||||
@{exec_path} mr,
|
||||
@{bin}/bwrap mrix,
|
||||
|
||||
@{bin}/chmod rix,
|
||||
@{bin}/fc-match rix,
|
||||
@{bin}/getopt rix,
|
||||
@{bin}/gzip rix,
|
||||
@{bin}/ldconfig rix,
|
||||
@{bin}/localedef rix,
|
||||
@{bin}/python3.@{int} rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/steam-runtime-launcher-interface-@{int} rix,
|
||||
@{bin}/steam-runtime-system-info rix,
|
||||
@{bin}/steam-runtime-urlopen rix,
|
||||
@{bin}/true rix,
|
||||
@{open_path} rix,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
@{lib}/pressure-vessel/from-host/@{bin}/* rix,
|
||||
@{lib}/pressure-vessel/from-host/@{lib}/** rix,
|
||||
@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix,
|
||||
|
||||
@{app_dirs}/** mrix,
|
||||
|
||||
@{run}/host/@{bin}/ldconfig rix,
|
||||
@{run}/host/@{bin}/localedef rix,
|
||||
@{run}/host/@{lib}/** mr,
|
||||
|
||||
@{share_dirs}/bin/d3ddriverquery64.exe mr,
|
||||
@{share_dirs}/steamapps/compatdata/@{int}/pfx/** mr,
|
||||
|
||||
@{user_games_dirs}/** mr,
|
||||
|
||||
owner /bindfile@{rand6} rw,
|
||||
|
||||
owner /var/pressure-vessel/** rw,
|
||||
owner /var/cache/ldconfig/aux-cache* rw,
|
||||
|
||||
owner "@{app_dirs}/Steamworks Shared/runasadmin.vdf" rw,
|
||||
owner @{app_dirs}/@{runtime}/var/tmp-@{rand6}/usr/.ref rwk,
|
||||
owner @{app_dirs}/Proton*/** rwkl,
|
||||
|
||||
owner @{share_dirs}/*.dll r,
|
||||
owner @{share_dirs}/bin/ r,
|
||||
owner @{share_dirs}/installscriptevalutor_log.txt rw,
|
||||
owner @{share_dirs}/legacycompat/ r,
|
||||
owner @{share_dirs}/legacycompat/** mr,
|
||||
owner @{share_dirs}/steamapps/compatdata/{,**} rwk,
|
||||
|
||||
owner @{tmp}/glx-icds-@{rand6}/{,**} w,
|
||||
owner @{tmp}/pressure-vessel-*-@{rand6}/ rw,
|
||||
owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**,
|
||||
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} w,
|
||||
|
||||
@{run}/host/fonts/{,**} r,
|
||||
@{run}/host/share/{,**} r,
|
||||
@{run}/host/usr/{,**} r,
|
||||
owner @{run}/pressure-vessel/{,**} r,
|
||||
|
||||
@{sys}/devices/system/node/node@{int}/cpumap r,
|
||||
@{sys}/devices/system/node/online r,
|
||||
|
||||
@{PROC}/@{pids}/net/* r,
|
||||
@{PROC}/sys/net/core/bpf_jit_enable r,
|
||||
|
||||
include if exists <local/steam-game-proton>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,74 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{lib_dirs}/gameoverlayui
|
||||
profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/graphics>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
unix,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib_dirs}/**.so* mr,
|
||||
@{runtime_dirs}/@{lib}/**.so* mr,
|
||||
|
||||
@{lib_dirs}/steamerrorreporter rpx,
|
||||
|
||||
/usr/share/fonts/{,**} rk,
|
||||
|
||||
/ r,
|
||||
/home/ r,
|
||||
/tmp/ r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.steam/registry.vdf rk,
|
||||
owner @{HOME}/.steam/steam.pipe r,
|
||||
owner @{lib_dirs}/fontconfig/{,**} rwl,
|
||||
|
||||
owner @{share_dirs}/{,**} r,
|
||||
owner @{share_dirs}/config/DialogConfigOverlay*.vdf rw,
|
||||
owner @{share_dirs}/public/* rk,
|
||||
owner @{share_dirs}/resource/{,**} rk,
|
||||
owner @{share_dirs}/userdata/@{int}/{,**} rk,
|
||||
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex} rw,
|
||||
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
|
||||
owner /dev/shm/ValveIPCSHM_@{uid} rw,
|
||||
|
||||
owner @{tmp}/gameoverlayui.log* rw,
|
||||
owner @{tmp}/miles_image_@{rand6} mrw,
|
||||
owner @{tmp}/runtime-info.txt.@{rand6} rw,
|
||||
owner @{tmp}/steam_chrome_overlay_uid@{uid}_spid@{pids} rw,
|
||||
|
||||
@{sys}/ r,
|
||||
@{sys}/kernel/ r,
|
||||
@{sys}/devices/ r,
|
||||
@{sys}/devices/system/ r,
|
||||
@{sys}/devices/system/cpu/cpu@{int}/ r,
|
||||
|
||||
@{PROC}/version r,
|
||||
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
|
||||
include if exists <local/steam-gameoverlayui>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{bin}/steam @{bin}/steam-runtime
|
||||
profile steam-launch @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
|
||||
network unix stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/cmp rix,
|
||||
@{bin}/cp rix,
|
||||
@{bin}/dirname rix,
|
||||
@{bin}/env rix,
|
||||
@{bin}/id rix,
|
||||
@{bin}/readlink rix,
|
||||
|
||||
@{lib}/steam/steam rix,
|
||||
@{lib}/steam/bin_steam.sh rix,
|
||||
@{share_dirs}/steam.sh rPx,
|
||||
|
||||
@{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rPx,
|
||||
|
||||
/usr/ r,
|
||||
/usr/local/ r,
|
||||
|
||||
owner @{share_dirs}/bootstrap.tar.xz rw,
|
||||
|
||||
/dev/tty rw,
|
||||
|
||||
deny /opt/** r,
|
||||
|
||||
include if exists <local/steam-launch>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service
|
||||
profile steam-launcher @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
network unix stream,
|
||||
|
||||
signal receive peer=steam,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
|
||||
include if exists <local/steam-launcher>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,87 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{lib_dirs}/reaper
|
||||
profile steam-runtime @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/graphics>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wayland>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network unix stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/getopt rix,
|
||||
@{bin}/readlink rix,
|
||||
|
||||
@{lib_dirs}/** mr,
|
||||
@{lib_dirs}/steam-launch-wrapper rix,
|
||||
|
||||
# Native linux games (steam-game-native)
|
||||
@{app_dirs}/[^S]*/** rpx -> steam-game-native, # Only for @{app_dirs}/@{runtime}/**
|
||||
|
||||
# Proton games, sandboxed (steam-game-proton)
|
||||
@{app_dirs}/@{runtime}/*entry-point rmix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{bin}/pressure-vessel-* rix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/** mr,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix,
|
||||
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rpx -> steam-game-proton,
|
||||
@{app_dirs}/@{runtime}/run rix,
|
||||
@{bin}/bwrap rpx -> steam-game-proton,
|
||||
|
||||
/ r,
|
||||
@{lib}/ r,
|
||||
@{lib_dirs}/ r,
|
||||
|
||||
owner @{HOME}/.steam/steam.pipe r,
|
||||
|
||||
owner @{app_dirs}/*/ r,
|
||||
owner @{app_dirs}/config/config.vdf{,.*} rw,
|
||||
owner @{app_dirs}/@{runtime}/** r,
|
||||
owner @{app_dirs}/@{runtime}/pressure-vessel/** rwk,
|
||||
owner @{app_dirs}/@{runtime}/sniper_platform_*/** rwk,
|
||||
owner @{app_dirs}/@{runtime}/var/** rwk,
|
||||
owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/pressure-vessel/**,
|
||||
owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/sniper_platform_*/**,
|
||||
|
||||
owner @{share_dirs}/config/config.vdf{,.*} rw,
|
||||
owner @{share_dirs}/steamapps/appmanifest_* rw,
|
||||
|
||||
owner @{tmp}/ r,
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw,
|
||||
owner /dev/shm/u@{uid}-Shm_@{hex8} rw,
|
||||
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/comm r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/dev/tty rw,
|
||||
|
||||
include if exists <local/steam-runtime>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote
|
||||
profile steam-runtime-steam-remote @{exec_path} flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{runtime_dirs}/** mr,
|
||||
|
||||
owner @{HOME}/.steam/steam.pipe rw,
|
||||
|
||||
include if exists <local/steam-runtime-steam-remote>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{runtime} = SteamLinuxRuntime_sniper
|
||||
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
||||
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
||||
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
||||
@{app_dirs} = @{share_dirs}/steamapps/common/
|
||||
|
||||
@{exec_path} = @{lib_dirs}/steamerrorreporter
|
||||
profile steamerrorreporter @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network unix stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.steam/steam.pipe r,
|
||||
|
||||
owner @{lib_dirs}/{,**} r,
|
||||
owner @{runtime_dirs}/pinned_libs_{32,64}/ r,
|
||||
owner @{share_dirs}/ r,
|
||||
|
||||
owner @{tmp}/dumps/ r,
|
||||
owner @{tmp}/dumps/*_log.txt rw,
|
||||
|
||||
owner @{PROC}/@{pid}/status r,
|
||||
|
||||
include if exists <local/steamerrorreporter>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue