chore: reorganise the freedesktop group.
This commit is contained in:
Alexandre Pujol
parent
3f664e5b2c
commit
940c9de083
61 changed files with 0 additions and 0 deletions
23
apparmor.d/profiles-m-r/obex-folder-listing
Normal file
23
apparmor.d/profiles-m-r/obex-folder-listing
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/obex-folder-listing
|
||||
profile obex-folder-listing @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/private-files-strict>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/**/ r,
|
||||
owner @{MOUNTS}/*/ r,
|
||||
owner @{MOUNTS}/*/**/ r,
|
||||
|
||||
include if exists <local/obex-folder-listing>
|
||||
}
|
||||
64
apparmor.d/profiles-m-r/obexautofs
Normal file
64
apparmor.d/profiles-m-r/obexautofs
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/obexautofs
|
||||
profile obexautofs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
network bluetooth seqpacket,
|
||||
network bluetooth stream,
|
||||
network bluetooth raw,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/fusermount{,3} rCx -> fusermount,
|
||||
|
||||
owner @{HOME}/*/ r,
|
||||
owner @{HOME}/*/*/ r,
|
||||
|
||||
mount fstype=fuse.obexautofs -> @{HOME}/*/,
|
||||
mount fstype=fuse.obexautofs -> @{HOME}/*/*/,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/bus/usb/devices/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/bConfigurationValue r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/bConfigurationValue r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{uevent,busnum,devnum,speed,descriptors} r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{uevent,busnum,devnum,speed,descriptors} r,
|
||||
|
||||
@{run}/udev/data/+usb:* r,
|
||||
@{run}/udev/data/c189:* r, # for /dev/bus/usb/**
|
||||
|
||||
/dev/bus/usb/ r,
|
||||
/dev/fuse rw,
|
||||
|
||||
|
||||
profile fusermount {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To mount anything:
|
||||
capability sys_admin,
|
||||
|
||||
/{usr/,}bin/fusermount{,3} mr,
|
||||
|
||||
/etc/fuse.conf r,
|
||||
|
||||
/dev/fuse rw,
|
||||
|
||||
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/,
|
||||
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/*/,
|
||||
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/obexautofs>
|
||||
}
|
||||
21
apparmor.d/profiles-m-r/obexctl
Normal file
21
apparmor.d/profiles-m-r/obexctl
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/obexctl
|
||||
profile obexctl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/inputrc r,
|
||||
|
||||
owner @{user_cache_dirs}/.obexctl_history rw,
|
||||
owner @{user_cache_dirs}/.obexctl_history-@{pid}.tmp rw,
|
||||
|
||||
include if exists <local/obexctl>
|
||||
}
|
||||
26
apparmor.d/profiles-m-r/obexd
Normal file
26
apparmor.d/profiles-m-r/obexd
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{libexec}/bluetooth/obexd
|
||||
profile obexd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network bluetooth stream,
|
||||
network bluetooth seqpacket,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/obexd/ rw,
|
||||
owner @{user_cache_dirs}/obexd/* rw,
|
||||
|
||||
owner @{HOME}/bluetooth/* rw,
|
||||
|
||||
include if exists <local/obexd>
|
||||
}
|
||||
53
apparmor.d/profiles-m-r/obexfs
Normal file
53
apparmor.d/profiles-m-r/obexfs
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/obexfs
|
||||
profile obexfs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
network bluetooth raw,
|
||||
network bluetooth seqpacket,
|
||||
network bluetooth stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/fusermount{,3} rCx -> fusermount,
|
||||
|
||||
owner @{HOME}/*/ r,
|
||||
owner @{HOME}/*/*/ r,
|
||||
|
||||
mount fstype=fuse.obexfs -> @{HOME}/*/,
|
||||
mount fstype=fuse.obexfs -> @{HOME}/*/*/,
|
||||
|
||||
/dev/fuse rw,
|
||||
|
||||
|
||||
profile fusermount {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To mount anything:
|
||||
capability sys_admin,
|
||||
|
||||
network bluetooth stream,
|
||||
|
||||
/{usr/,}bin/fusermount{,3} mr,
|
||||
|
||||
/etc/fuse.conf r,
|
||||
|
||||
/dev/fuse rw,
|
||||
|
||||
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/,
|
||||
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/*/,
|
||||
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/obexfs>
|
||||
}
|
||||
16
apparmor.d/profiles-m-r/obexpush-atd
Normal file
16
apparmor.d/profiles-m-r/obexpush-atd
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/obexpush_atd
|
||||
profile obexpush-atd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/obexpush-atd>
|
||||
}
|
||||
27
apparmor.d/profiles-m-r/obexpushd
Normal file
27
apparmor.d/profiles-m-r/obexpushd
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/obexpushd
|
||||
profile obexpushd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
# For listening on tcp/*:650
|
||||
capability net_bind_service,
|
||||
|
||||
network bluetooth stream,
|
||||
network irda stream,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# For receiving files
|
||||
owner @{HOME}/bluetooth/* w,
|
||||
|
||||
include if exists <local/obexpushd>
|
||||
}
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2015-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/pipewire
|
||||
profile pipewire @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/pipewire/pipewire.conf r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/etc/pipewire/client.conf r,
|
||||
/etc/pipewire/pipewire-pulse.conf.d/{,*} r,
|
||||
/etc/pipewire/pipewire.conf r,
|
||||
/etc/pipewire/pipewire.conf.d/{,*} r,
|
||||
|
||||
owner @{run}/user/@{uid}/pipewire-[0-9]*.lock rwk,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/board_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_vendor r,
|
||||
|
||||
/ r,
|
||||
|
||||
/dev/video[0-9]* rw,
|
||||
|
||||
include if exists <local/pipewire>
|
||||
}
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2015-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/pipewire-media-session
|
||||
profile pipewire-media-session @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
network bluetooth raw,
|
||||
network bluetooth seqpacket,
|
||||
network bluetooth stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/alsa-card-profile/{,**} r,
|
||||
/usr/share/pipewire/*.conf r,
|
||||
/usr/share/pipewire/media-session.d/{,**} r,
|
||||
/usr/share/spa-*/bluez[0-9]*/{,*} r,
|
||||
|
||||
/etc/pipewire/*.conf r,
|
||||
/etc/pipewire/media-session.d/*.conf r,
|
||||
|
||||
owner @{HOME}/.local/state/ rw,
|
||||
owner @{HOME}/.local/state/pipewire/{,**} rw,
|
||||
owner @{user_config_dirs}/pipewire/ rw,
|
||||
owner @{user_config_dirs}/pipewire/** rw,
|
||||
owner @{user_config_dirs}/pulse/ rw,
|
||||
|
||||
@{run}/udev/data/+sound:card[0-9]* r, # For sound
|
||||
@{run}/udev/data/c116:[0-9]* r, # for ALSA
|
||||
|
||||
@{sys}/class/sound/ r,
|
||||
@{sys}/class/video4linux/ r,
|
||||
|
||||
@{sys}/devices/**/sound/**/uevent r,
|
||||
@{sys}/devices/pci[0-9]*/**/video4linux/video[0-9]*/uevent r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]*/meminfo r,
|
||||
@{sys}/devices/pci[0-9]*/**/modalias r,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
/dev/video[0-9]* rw,
|
||||
|
||||
include if exists <local/pipewire-media-session>
|
||||
}
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2015-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/pipewire-pulse
|
||||
profile pipewire-pulse @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/pactl rix,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/etc/pipewire/client.conf r,
|
||||
/etc/pipewire/pipewire-pulse.conf r,
|
||||
/etc/pipewire/pipewire-pulse.conf.d/{,*} r,
|
||||
/usr/share/pipewire/client.conf r,
|
||||
/usr/share/pipewire/pipewire-pulse.conf r,
|
||||
|
||||
owner @{run}/user/@{uid}/pulse/pid w,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/board_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_vendor r,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
|
||||
include if exists <local/pipewire-pulse>
|
||||
}
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/polkit-[0-9]/polkit-agent-helper-[0-9]
|
||||
@{exec_path} += @{libexec}/polkit-agent-helper-[0-9]
|
||||
profile polkit-agent-helper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability audit_write,
|
||||
capability dac_override,
|
||||
capability net_admin,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_nice,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
signal (receive) set=(term, kill) peer=polkit-*-authentication-agent,
|
||||
signal (receive) set=(term, kill) peer=gnome-shell,
|
||||
signal (receive) set=(term, kill) peer=pkexec,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
@{run}/faillock/[a-zA-z0-9]* rwk,
|
||||
|
||||
include if exists <local/polkit-agent-helper>
|
||||
}
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/@{multiarch}/libexec/polkit-kde-authentication-agent-[0-9]
|
||||
profile polkit-kde-authentication-agent @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/X>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/wayland>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/mesa>
|
||||
|
||||
signal (send) set=(term, kill) peer=polkit-agent-helper,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr,
|
||||
|
||||
@{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{user_config_dirs}/qt5ct/{,**} r,
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
owner @{user_config_dirs}/kdeglobals r,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
|
||||
/dev/shm/#[0-9]*[0-9] rw,
|
||||
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
owner /tmp/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#[0-9]*[0-9],
|
||||
|
||||
include if exists <local/polkit-kde-authentication-agent>
|
||||
}
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/@{multiarch}/polkit-mate/polkit-mate-authentication-agent-[0-9]
|
||||
profile polkit-mate-authentication-agent @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
|
||||
signal (send) set=(term, kill) peer=polkit-agent-helper,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
|
||||
|
||||
@{PROC}/1/cgroup r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
/usr/share/X11/xkb/** r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/polkit-mate-authentication-agent>
|
||||
}
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/polkit-1/polkitd
|
||||
@{exec_path} += @{libexec}/polkitd
|
||||
profile polkitd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
capability sys_ptrace,
|
||||
audit deny capability net_admin,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
||||
# System rules
|
||||
/etc/polkit-1/rules.d/ r,
|
||||
/etc/polkit-1/rules.d/[0-9][0-9]-*.rules r,
|
||||
|
||||
# Vendor rules
|
||||
/usr/share/polkit-1/rules.d/ r,
|
||||
/usr/share/polkit-1/rules.d/*.rules r,
|
||||
|
||||
# Vendor policies
|
||||
/usr/share/polkit-1/actions/ r,
|
||||
/usr/share/polkit-1/actions/*.policy r,
|
||||
/usr/share/polkit-1/actions/*.policy.choice r,
|
||||
|
||||
owner /var/lib/polkit-1/.cache/ rw,
|
||||
|
||||
@{run}/systemd/sessions/* r,
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
# Silencer
|
||||
deny /.cache/ rw,
|
||||
|
||||
include if exists <local/polkitd>
|
||||
}
|
||||
|
|
@ -1,170 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/pulseaudio
|
||||
profile pulseaudio @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
signal (receive) peer=pacmd,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
network bluetooth stream,
|
||||
network bluetooth seqpacket,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
|
||||
/{usr/,}lib{exec,}/pulse/gsettings-helper mrix,
|
||||
|
||||
# PulseAudio files
|
||||
/usr/share/pulseaudio/{,**} r,
|
||||
/{usr/,}lib/pulse-*/modules/*.so mr,
|
||||
|
||||
# PulseAudio home config files
|
||||
owner @{user_config_dirs}/pulse/{,**} rw,
|
||||
owner @{user_config_dirs}/dconf/user r,
|
||||
|
||||
# Needed when PulseAudio is started via the start-pulseaudio-x11 script
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# Needed when PulseAudio is started via gdm
|
||||
owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.* r,
|
||||
owner @{HOME}/.ICEauthority r,
|
||||
|
||||
# TCP wrap
|
||||
/etc/hosts.{allow,deny} r,
|
||||
|
||||
owner @{run}/user/@{uid}/ rw,
|
||||
owner @{run}/user/@{uid}/pulse/{,*} rw,
|
||||
owner @{run}/user/@{uid}/pulse/*.lock k,
|
||||
|
||||
/usr/share/applications/{,**} r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/sound/ r,
|
||||
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,
|
||||
@{run}/udev/data/+sound* r,
|
||||
@{run}/udev/data/c116:[0-9]* r, # For ALSA
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]/meminfo r,
|
||||
|
||||
deny @{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/ICEauthority r,
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
|
||||
owner @{PROC}/@{pids}/fd/ r,
|
||||
owner @{PROC}/@{pids}/stat r,
|
||||
|
||||
# DBus
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,ReleaseName}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus (receive)
|
||||
bus=session
|
||||
path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={Hello,RequestName,ReleaseName}
|
||||
peer=(name=:*),
|
||||
|
||||
dbus (receive)
|
||||
bus=session
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
member=Introspect,
|
||||
|
||||
dbus (bind)
|
||||
bus=session
|
||||
name=org.freedesktop.ReserveDevice[0-9].Audio[0-9],
|
||||
|
||||
dbus (bind)
|
||||
bus=session
|
||||
name=org.PulseAudio[0-9],
|
||||
|
||||
dbus (bind)
|
||||
bus=session
|
||||
name=org.pulseaudio*,
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={Hello,AddMatch,RemoveMatch}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/org/freedesktop/RealtimeKit[0-9]
|
||||
member={Get,MakeThreadHighPriority,MakeThreadRealtime}
|
||||
peer=(name=org.freedesktop.RealtimeKit[0-9]),
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.DBus.ObjectManager
|
||||
member=GetManagedObjects
|
||||
peer=(name=org.bluez),
|
||||
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.X11-unix/*),
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.ICE-unix/*),
|
||||
|
||||
# The orcexec.* file is JIT compiled code for various GStreamer elements.
|
||||
# If one is blocked the next is used instead.
|
||||
owner @{run}/user/@{uid}/orcexec.* mrw,
|
||||
#owner @{HOME}/orcexec.* mrw,
|
||||
#owner /tmp/orcexec.* mrw,
|
||||
|
||||
# For GDM
|
||||
owner /var/lib/gdm{[1-9],}/.config/pulse/{,**} rw,
|
||||
owner /var/lib/gdm{[1-9],}/.config/pulse/cookie k,
|
||||
owner /var/lib/gdm{[1-9],}/.config/dconf/user r,
|
||||
|
||||
# For SDDM
|
||||
owner /var/lib/sddm/.config/pulse/ rw,
|
||||
owner /var/lib/sddm/.config/pulse/*-{device,stream}-volumes.tdb rw,
|
||||
owner /var/lib/sddm/.config/pulse/*-default-{sink,source} rw,
|
||||
owner /var/lib/sddm/.config/pulse/*-card-database.tdb rw,
|
||||
owner /var/lib/sddm/.config/pulse/cookie rwk,
|
||||
|
||||
# For lightdm
|
||||
owner /var/lib/lightdm/.config/pulse/{,**} rw,
|
||||
owner /var/lib/lightdm/.config/pulse/cookie k,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# Snap
|
||||
/var/lib/snapd/desktop/applications/ r,
|
||||
/usr/{local/,}share/ubuntu/applications/{,*} r,
|
||||
|
||||
include if exists <local/pulseaudio>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue