Profiles update.
This commit is contained in:
Alexandre Pujol
parent
f7a08b666d
commit
9c8c2144b8
26 changed files with 186 additions and 136 deletions
|
|
@ -1,20 +1,18 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{SYNC_DIR} = @{HOME}/Sync/
|
||||
@{SYNC_DIR} += @{MOUNTS}/*/syncthing/
|
||||
|
||||
@{exec_path} = /{usr/,}bin/syncthing
|
||||
profile syncthing @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -27,21 +25,20 @@ profile syncthing @{exec_path} {
|
|||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}bin/ip rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{user_config_dirs}/syncthing/ rw,
|
||||
owner @{user_config_dirs}/syncthing/** rwk,
|
||||
|
||||
@{SYNC_DIR}/{,**} rw,
|
||||
/usr/share/mime/{,*} r,
|
||||
|
||||
/etc/mime.types r,
|
||||
|
||||
@{PROC}/sys/net/core/somaxconn r,
|
||||
owner @{user_config_dirs}/syncthing/{,**} rwk,
|
||||
owner @{HOME}/@{XDG_DATA_HOME}/syncthing/{,**} rwk,
|
||||
|
||||
@{HOME}/ r,
|
||||
@{user_sync_dirs}/{,**} rw,
|
||||
|
||||
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
|
||||
|
||||
# Silecne the noise
|
||||
deny /etc/ssl/certs/java/ r,
|
||||
|
||||
@{PROC}/sys/net/core/somaxconn r,
|
||||
@{PROC}/@{pids}/net/route r,
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
|
|
@ -55,15 +52,14 @@ profile syncthing @{exec_path} {
|
|||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
/{usr/,}bin/firefox rPx,
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/syncthing>
|
||||
|
|
|
|||
|
|
@ -11,6 +11,9 @@ profile update-desktop-database @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/applications/{,**/} r,
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -11,23 +11,23 @@ include <tunables/global>
|
|||
@{exec_path} += /usr/share/virt-manager/virt-manager
|
||||
profile virt-manager @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/X>
|
||||
include <abstractions/vulkan>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/python>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/vulkan>
|
||||
include <abstractions/X>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
|
@ -42,8 +42,8 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
|
|||
/{usr/,}bin/getfacl rix,
|
||||
/{usr/,}bin/setfacl rix,
|
||||
|
||||
/{usr/,}{s,}bin/libvirtd rPx,
|
||||
/{usr/,}lib/spice-client-glib-usb-acl-helper rPx,
|
||||
/{usr/,}{s,}bin/libvirtd rPx,
|
||||
/{usr/,}lib/spice-client-glib-usb-acl-helper rPx,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/gtksourceview-4/{,**} r,
|
||||
|
|
@ -55,6 +55,9 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
|
|||
/usr/share/virtio/{,*} r,
|
||||
/var/lib/usbutils/*.ids r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/libnl/classid r,
|
||||
/etc/libva.conf r,
|
||||
|
|
@ -81,25 +84,24 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{HOME}/@{XDG_VM_DIR}/{,**} rw,
|
||||
owner @{MOUNTS}/*/@{XDG_VM_DIR}/{,**} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/@{pid}/net/route r,
|
||||
@{run}/mount/utab r,
|
||||
@{run}/udev/data/c51[0-9]:[0-9]* r,
|
||||
owner @{run}/user/@{uid}/libvirt/libvirtd.lock rwk,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/drm/ r,
|
||||
@{sys}/devices/virtual/drm/ttm/uevent r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
owner @{run}/user/@{uid}/libvirt/libvirtd.lock rwk,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/@{pids}/net/route r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/dev/video[0-9]* rw,
|
||||
|
||||
# Silence the noise
|
||||
deny /usr/share/virt-manager/{,**} w,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,6 +12,11 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected, complain) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{user_share_dirs}/gvfs-metadata/home r,
|
||||
owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
|
||||
owner @{user_share_dirs}/gvfs-metadata/root r,
|
||||
owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
|
||||
|
||||
owner @{run}/firejail/dbus/[0-9]*/[0-9]*-user rw,
|
||||
owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -46,6 +46,11 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{user_config_dirs}/mimeapps.list{,.new} rw,
|
||||
|
||||
owner @{user_share_dirs}/gvfs-metadata/home r,
|
||||
owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
|
||||
owner @{user_share_dirs}/gvfs-metadata/root r,
|
||||
owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue