felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): start using new abstractions (2)

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-19 23:42:30 +00:00
parent b7140c9b2b
commit a79a3f3311
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
52 changed files with 68 additions and 313 deletions
Download patch file Download diff file Expand all files Collapse all files

14
apparmor.d/profiles-a-f/code
View file

@ -14,16 +14,11 @@ profile code flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/chromium-common>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/opencl-intel>
include <abstractions/opencl-mesa>
include <abstractions/opencl-nvidia>
include <abstractions/ssl_certs>
include <abstractions/vulkan>
capability sys_ptrace,
@ -61,13 +56,11 @@ profile code flags=(attach_disconnected) {
@{lib}/go/bin/* rPUx,
@{bin}/python[0-9]* rUx
/etc/libva.conf r,
/etc/shells r,
/etc/lsb-release r,
owner @{HOME}/@{XDG_SSH_DIR}/config r,
owner @{code_config_dirs}/ rw,
owner @{code_config_dirs}/** rwkl -> @{code_config_dirs}/**,
owner @{user_projects_dirs}/ r,
@ -85,8 +78,7 @@ profile code flags=(attach_disconnected) {
@{sys}/devices/system/cpu/present r,
@{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/tty/tty[0-9]*/active r,
@{sys}/devices/@{pci}/irq r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
@{PROC}/ r,
@{PROC}/@{pid}/fd/ r,

21
apparmor.d/profiles-a-f/element
View file

@ -11,19 +11,12 @@ profile element @{exec_path} {
include <abstractions/base>
include <abstractions/chromium-common>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/desktop>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/nvidia>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
include <abstractions/video>
include <abstractions/vulkan>
include <abstractions/X-strict>
capability sys_ptrace,
@ -49,26 +42,16 @@ profile element @{exec_path} {
/usr/share/webapps/element/{,**} r,
/etc/libva.conf r,
/etc/element/{,**} r,
/etc/webapps/element/{,**} r,
owner @{user_config_dirs}/ r,
owner @{user_config_dirs}/Element/ rw,
owner @{user_config_dirs}/Element/** rwkl -> @{user_config_dirs}/Element/**,
owner @{user_config_dirs}/pulse/client.conf r,
owner @{user_config_dirs}/pulse/cookie rk,
@{sys}/bus/pci/devices/ r,
@{sys}/devices/@{pci}/class r,
@{sys}/devices/@{pci}/resource r,
@{sys}/devices/@{pci}/irq r,
@{sys}/devices/system/cpu/cpu@{int}/cache/{,**} r,
@{sys}/devices/system/cpu/cpu@{int}/topology/{,**} r,
@{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/system/cpu/present r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
@{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_{cur,min,max}_freq r,
@{PROC}/ r,
@{PROC}/sys/fs/inotify/max_user_watches r,

11
apparmor.d/profiles-a-f/file-roller
View file

@ -12,14 +12,10 @@ profile file-roller @{exec_path} {
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/dconf-write>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/desktop>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/user-write>
include <abstractions/wayland>
include <abstractions/X-strict>
# dbus: own bus=session name=org.gnome.ArchiveManager1
# dbus: own bus=session name=org.gnome.FileRoller
@ -42,10 +38,5 @@ profile file-roller @{exec_path} {
@{open_path} rPx -> child-open,
/usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r,
/etc/gtk-3.0/settings.ini r,
include if exists <local/file-roller>
}