felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): start using new abstractions (2)

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-19 23:42:30 +00:00
parent b7140c9b2b
commit a79a3f3311
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
52 changed files with 68 additions and 313 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/groups/kde/DiscoverNotifier
View file

@ -9,13 +9,10 @@ include <tunables/global>
@{exec_path} = @{lib}/DiscoverNotifier
profile DiscoverNotifier @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
network inet dgram,
network inet6 dgram,

4
apparmor.d/groups/kde/baloo
View file

@ -12,10 +12,8 @@ profile baloo @{exec_path} {
include <abstractions/deny-sensitive-home>
include <abstractions/disks-read>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/desktop>
include <abstractions/private-files-strict>
include <abstractions/qt5>
network netlink raw,

5
apparmor.d/groups/kde/baloorunner
View file

@ -9,13 +9,10 @@ include <tunables/global>
@{exec_path} = @{lib}/baloorunner
profile baloorunner @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
@{exec_path} mr,

5
apparmor.d/groups/kde/dolphin
View file

@ -11,13 +11,11 @@ profile dolphin @{exec_path} {
include <abstractions/base>
include <abstractions/deny-sensitive-home>
include <abstractions/devices-usb>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
include <abstractions/X-strict>
network netlink raw,
@ -36,7 +34,6 @@ profile dolphin @{exec_path} {
/usr/share/kio/{,**} r,
/usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/{,**} r,
/usr/share/mime/ r,
/etc/fstab r,
/etc/machine-id r,

6
apparmor.d/groups/kde/kaccess
View file

@ -9,11 +9,9 @@ include <tunables/global>
@{exec_path} = @{bin}/kaccess
profile kaccess @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
@{exec_path} mr,
@ -41,8 +39,6 @@ profile kaccess @{exec_path} {
owner /tmp/xauth_@{rand6} r,
owner @{run}/user/@{uid}/xauth_@{rand6} r,
@{sys}/devices/@{pci}/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
/dev/tty r,

1
apparmor.d/groups/kde/kactivitymanagerd
View file

@ -24,7 +24,6 @@ profile kactivitymanagerd @{exec_path} {
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/kf5/kactivitymanagerd/{,**} r,
/usr/share/kservices5/{,**} r,
/usr/share/mime/{,**} r,
/etc/xdg/kdeglobals r,
/etc/machine-id r,

8
apparmor.d/groups/kde/kalendarac
View file

@ -9,14 +9,11 @@ include <tunables/global>
@{exec_path} = @{bin}/kalendarac
profile kalendarac @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
@{exec_path} mr,
@ -54,9 +51,6 @@ profile kalendarac @{exec_path} {
owner @{run}/user/@{uid}/pulse/ r,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/sys/kernel/core_pattern r,
/dev/tty r,

4
apparmor.d/groups/kde/kiod5
View file

@ -9,11 +9,9 @@ include <tunables/global>
@{exec_path} = @{lib}/kf5/kiod5
profile kiod5 @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/vulkan>
network netlink raw,

10
apparmor.d/groups/kde/kioslave5
View file

@ -10,19 +10,15 @@ include <tunables/global>
profile kioslave5 @{exec_path} {
include <abstractions/base>
include <abstractions/deny-sensitive-home>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/nvidia>
include <abstractions/openssl>
include <abstractions/qt5>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/trash>
include <abstractions/vulkan>
network inet dgram,
network inet6 dgram,
@ -47,7 +43,6 @@ profile kioslave5 @{exec_path} {
/usr/share/kio_desktop/directory.desktop r,
/usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/*.desktop r,
/usr/share/mime/ r,
/usr/share/remoteview/* r,
/etc/fstab r,
@ -103,9 +98,6 @@ profile kioslave5 @{exec_path} {
owner @{run}/user/@{uid}/kio_desktop*kioworker.socket rwl,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,

4
apparmor.d/groups/kde/kscreenlocker-greet
View file

@ -11,17 +11,15 @@ include <tunables/global>
@{exec_path} += @{lib}/@{multiarch}/libexec/kscreenlocker_greet
profile kscreenlocker-greet @{exec_path} {
include <abstractions/base>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>
include <abstractions/X>
include <abstractions/vulkan>
network netlink raw,

7
apparmor.d/groups/kde/ksmserver
View file

@ -10,13 +10,11 @@ include <tunables/global>
profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/dri-common>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
include <abstractions/X-strict>
signal (send) set=(usr1,term) peer=kscreenlocker-greet,
@ -36,7 +34,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/knotifications5/*.notifyrc r,
/usr/share/kservices5/{,**} r,
/usr/share/mime/{,**} r,
/etc/xdg/menus/applications-merged/ r,
/etc/machine-id r,
@ -70,8 +67,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{run}/user/@{uid}/KSMserver__[0-9] rw,
owner @{run}/user/@{uid}/xauth_@{rand6} rl,
@{sys}/devices/@{pci}/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
@{PROC}/sys/kernel/core_pattern r,
/dev/tty r,

5
apparmor.d/groups/kde/ksplashqml
View file

@ -9,13 +9,10 @@ include <tunables/global>
@{exec_path} = @{bin}/ksplashqml
profile ksplashqml @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/vulkan>
include <abstractions/qt5-shader-cache>
@{exec_path} mr,

5
apparmor.d/groups/kde/kwalletd5
View file

@ -12,17 +12,14 @@ profile kwalletd5 @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/consoles>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/graphics>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5>
include <abstractions/vulkan>
include <abstractions/wayland>
include <abstractions/X-strict>

3
apparmor.d/groups/kde/kwalletmanager5
View file

@ -12,12 +12,11 @@ profile kwalletmanager5 @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/consoles>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/graphics>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write>

7
apparmor.d/groups/kde/kwin_wayland
View file

@ -9,15 +9,12 @@ include <tunables/global>
@{exec_path} = @{bin}/kwin_wayland
profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-write>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
include <abstractions/vulkan>
include <abstractions/wayland>
capability sys_nice,
@ -43,7 +40,6 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
/usr/share/kservicetypes5/{,*.desktop} r,
/usr/share/kwin/{,**} r,
/usr/share/libinput/{,**} r,
/usr/share/mime/ r,
/usr/share/plasma/desktoptheme/default/{metadata.json,plasmarc} r,
/usr/share/qt/translations/*.qm r,
/usr/share/X11/xkb/{,**} r,
@ -55,7 +51,6 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
/usr/share/plasma/desktoptheme/default/** r,
/usr/share/desktop-directories/*.directory r,
owner /var/lib/sddm/.cache/#@{int} rwk,
owner /var/lib/sddm/.cache/fontconfig/* rwk,
owner /var/lib/sddm/.cache/fontconfig/*-le64.cache-@{int}{,TMP-@{rand6},NEW,LCK} w,

5
apparmor.d/groups/kde/kwin_x11
View file

@ -10,15 +10,12 @@ include <tunables/global>
profile kwin_x11 @{exec_path} {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>
include <abstractions/vulkan>
network inet dgram,
network inet6 dgram,

6
apparmor.d/groups/kde/plasma-browser-integration-host
View file

@ -9,14 +9,11 @@ include <tunables/global>
@{exec_path} = @{bin}/plasma-browser-integration-host
profile plasma-browser-integration-host @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5>
include <abstractions/vulkan>
capability sys_ptrace,
@ -25,7 +22,6 @@ profile plasma-browser-integration-host @{exec_path} {
@{exec_path} mr,
/usr/share/kservices5/{,**} r,
/usr/share/mime/ r,
/etc/xdg/menus/ r,
/etc/xdg/taskmanagerrulesrc r,

5
apparmor.d/groups/kde/plasma-discover
View file

@ -10,16 +10,13 @@ include <tunables/global>
profile plasma-discover @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/qt5-shader-cache>
include <abstractions/ssl_certs>
include <abstractions/vulkan>
network inet dgram,
network inet6 dgram,

8
apparmor.d/groups/kde/plasmashell
View file

@ -17,18 +17,15 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
include <abstractions/consoles>
include <abstractions/devices-usb>
include <abstractions/disks-read>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/enchant>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>
include <abstractions/recent-documents-write>
include <abstractions/thumbnails-cache-read>
include <abstractions/vulkan>
include <abstractions/X-strict>
network inet dgram,
@ -70,7 +67,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
/usr/share/kservicetypes5/{,**} r,
/usr/share/lshw/artwork/logo.svg r,
/usr/share/metainfo/{,**} r,
/usr/share/mime/{,**} r,
/usr/share/plasma/{,**} r,
/usr/share/solid/actions/{,**} r,
/usr/share/swcatalog/{,**} r,
@ -174,8 +170,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
@{sys}/devices/@{pci}/name r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/ r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{sys}/devices/virtual/thermal/**/{name,type} r,
@{PROC}/ r,

3
apparmor.d/groups/kde/sddm-greeter
View file

@ -13,9 +13,8 @@ profile sddm-greeter @{exec_path} {
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl>
include <abstractions/graphics>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>

1
apparmor.d/groups/kde/startplasma
View file

@ -28,7 +28,6 @@ profile startplasma @{exec_path} {
/usr/share/knotifications5/{,**} r,
/usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/{,**} r,
/usr/share/mime/{,**} r,
/usr/share/plasma/{,**} r,
/etc/machine-id r,

6
apparmor.d/groups/kde/systemsettings
View file

@ -9,15 +9,12 @@ include <tunables/global>
@{exec_path} = @{bin}/systemsettings
profile systemsettings @{exec_path} {
include <abstractions/base>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache>
include <abstractions/qt5>
include <abstractions/vulkan>
network netlink raw,
@ -30,7 +27,6 @@ profile systemsettings @{exec_path} {
/usr/share/kservices5/{,**} r,
/usr/share/kservicetypes5/{,**} r,
/usr/share/kxmlgui5/systemsettings/systemsettingsui.rc r,
/usr/share/mime/ r,
/usr/share/plasma/{,**} r,
/usr/share/systemsettings/{,**} r,
/usr/share/kinfocenter/{,**} r,