felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): add the pkexec app abs.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-20 23:24:15 +01:00
parent 7a3a1f7725
commit 96defe021c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
8 changed files with 85 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/apt/synaptic
View file

@ -48,7 +48,7 @@ profile synaptic @{exec_path} {
@{bin}/dpkg-preconfigure rPx,
@{bin}/localepurge rPx,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/pkexec rPx,
@{bin}/pkexec rCx -> pkexec,
@{bin}/ps rPx,
@{bin}/software-properties-gtk rPx,
@{bin}/tasksel rPx,
@ -110,6 +110,13 @@ profile synaptic @{exec_path} {
deny @{bin}/gdbus x,
deny @{user_share_dirs}/gvfs-metadata/{*,} r,
profile pkexec {
include <abstractions/base>
include <abstractions/app/pkexec>
include if exists <local/synaptic_pkexec>
}
include if exists <local/synaptic>
}

3
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -82,8 +82,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
profile pkexec {
include <abstractions/base>
@{bin}/pkexec mr,
include <abstractions/app/pkexec>
include if exists <local/gnome-system-monitor_pkexec>
}

9
apparmor.d/groups/ubuntu/apport-gtk
View file

@ -48,7 +48,7 @@ profile apport-gtk @{exec_path} {
@{bin}/ldd rix,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/md5sum rix,
@{bin}/pkexec rPx, # TODO: rCx or something
@{bin}/pkexec rCx -> pkexec,
@{bin}/systemctl rCx -> systemctl,
@{bin}/systemd-detect-virt rPx,
@{bin}/uname rix,
@ -124,6 +124,13 @@ profile apport-gtk @{exec_path} {
include if exists <local/apport-gtk_gdb>
}
profile pkexec {
include <abstractions/base>
include <abstractions/app/pkexec>
include if exists <local/apport-gtk_pkexec>
}
profile systemctl {
include <abstractions/base>
include <abstractions/app/systemctl>

11
apparmor.d/groups/ubuntu/update-notifier
View file

@ -53,7 +53,7 @@ profile update-notifier @{exec_path} {
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/pkexec rPx, # TODO: rCx or rix to run /usr/lib/update-notifier/package-system-locked
@{bin}/pkexec rCx -> pkexec,
@{bin}/snap rPUx,
@{bin}/software-properties-gtk rPx,
@{bin}/systemctl rCx -> systemctl,
@ -85,6 +85,15 @@ profile update-notifier @{exec_path} {
@{PROC}/@{pids}/mountinfo r,
owner @{PROC}/@{pid}/fd/ r,
profile pkexec {
include <abstractions/base>
include <abstractions/app/pkexec>
@{lib}/update-notifier/package-system-locked Px,
include if exists <local/update-notifier_pkexec>
}
profile systemctl {
include <abstractions/base>
include <abstractions/app/systemctl>