felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

general_initial

Browse source
This commit is contained in:
nobody43 2023-02-19 23:40:41 +00:00 • committed by Alex
parent 3eb8dd2811
commit a873af1f26
36 changed files with 640 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

17
apparmor.d/groups/apps/thunderbird
View file

@ -43,6 +43,8 @@ profile thunderbird @{exec_path} {
ptrace peer=@{profile_name},
unix (send, receive) type=stream peer=(addr=none, label=xorg),
network inet dgram,
network inet6 dgram,
network inet stream,
@ -76,6 +78,21 @@ profile thunderbird @{exec_path} {
member={Change,Notify}
peer=(name=ca.desrt.dconf),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktops
interface=org.freedesktop.portal.Settings
member=Read
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/login[0-9]*
interface=org.freedesktop.login[0-9]*.Manager
member={UserAdded,UserRemoved}
peer=(name=:*, label=systemd-logind),
dbus bind bus=session
name=org.mozilla.thunderbird.*,

17
apparmor.d/groups/browsers/firefox
View file

@ -12,7 +12,7 @@ include <tunables/global>
@{firefox_config_dirs} = @{HOME}/.mozilla/
@{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}{-bin,}
profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
@ -51,7 +51,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus),
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/ScreenSaver
interface=org.freedesktop.ScreenSaver
@ -110,17 +110,17 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/mozilla/firefox/Remote
interface=org.mozilla.firefox
member=OpenURL
peer=(name=org.mozilla.firefox.* label=firefox),
peer=(name=org.mozilla.firefox.* label=@{profile_name}),
dbus receive bus=session path=/org/mozilla/firefox/Remote
interface=org.mozilla.firefox
member=OpenURL
peer=(name=:* label=firefox),
peer=(name=:* label=@{profile_name}),
dbus bind bus=session
dbus bind bus=session
name=org.mpris.MediaPlayer2.firefox.*,
dbus bind bus=session
dbus bind bus=session
name=org.mozilla.firefox.*,
deny dbus send bus=system path=/org/freedesktop/hostname[0-9]*,
@ -173,6 +173,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
/etc/xul-ext/kwallet5.js r,
owner @{HOME}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/ w,
owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ w,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,
@ -259,6 +261,9 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
owner /dev/tty[0-9]* rw, # File Inherit
# X-tiny
/tmp/.X0-lock r,
# Silencer
deny @{firefox_lib_dirs}/** w,
deny @{run}/user/@{uid}/gnome-shell-disable-extensions w,

5
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -35,7 +35,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,GetConnectionUnixUser}
member={RequestName,ReleaseName,GetConnectionUnixUser}
peer=(name=org.freedesktop.DBus),
dbus bind bus=system
@ -50,7 +50,8 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
/{usr/,}{s,}bin/userdel rPx,
/{usr/,}bin/passwd rPx,
/{usr/,}bin/chage rPx,
/usr/share/language-tools/language-validate rPx,
/usr/share/language-tools/language-validate rPx,
/usr/share/language-tools/set-language-helper rPUx,
/usr/share/accountsservice/{,**} r,
/usr/share/dbus-1/interfaces/*.xml r,

12
apparmor.d/groups/freedesktop/at-spi2-registryd
View file

@ -17,6 +17,8 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup) peer=gdm*,
signal (receive) set=(term hup kill) peer=dbus-daemon,
unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*", label="{xorg,xkbcomp}"),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
@ -45,12 +47,12 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*, label="{gnome-extension-ding,gnome-control-center}"),
peer=(name=:*), # all peer's labels
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=:*, label="{gnome-extension-ding,gnome-control-center,spice-vdagent}"),
peer=(name=:*), # all peer's labels
dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
@ -60,17 +62,17 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=GetRegisteredEvents
peer=(name=:*, label=gnome-control-center),
peer=(name=:*), # all peer's labels
dbus receive bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=:*, label="{gnome-control-center,xdg-desktop-portal-*}"),
peer=(name=:*), # all peer's labels
dbus send bus=session path=/org/a11y/bus
interface=org.a11y.Bus
member=GetAddress
peer=(name=org.a11y.Bus, label=at-spi-bus-launcher),
peer=(name=org.a11y.Bus, label="{at-spi-bus-launcher,unconfined}"),
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable

17
apparmor.d/groups/freedesktop/colord
View file

@ -18,7 +18,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName},
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName,ReleaseName},
dbus (send,receive) bus=system path=/org/freedesktop/ColorManager{,/**}
interface=org.freedesktop.ColorManager*,
@ -30,8 +30,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.PolicyKit[0-9].Authority
member=Changed
peer=(name=:*, label=polkitd),
peer=(name=:*, label=polkitd), # all members
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.DBus.Properties
@ -43,10 +42,15 @@ profile colord @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label="{gsd-color,colord-sane,gnome-control-center}"),
dbus (send, receive) bus=system path=/org/freedesktop/ColorManager
dbus send bus=system path=/org/freedesktop/ColorManager
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=colord),
peer=(name=:*, label=@{profile_name}),
dbus receive bus=system path=/org/freedesktop/ColorManager/**
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=@{profile_name}),
dbus bind bus=system
name=org.freedesktop.ColorManager,
@ -67,8 +71,9 @@ profile colord @{exec_path} flags=(attach_disconnected) {
owner /var/lib/colord/.cache/** rw,
owner /var/lib/colord/{mapping,storage}.db{,-journal} rwk,
@{system_share_dirs}/mime/mime.cache r,
/var/lib/gdm{3,}/.local/share/icc/edid-*.icc r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
@{system_share_dirs}/mime/mime.cache r,
@{user_share_dirs}/icc/edid-*.icc r,

8
apparmor.d/groups/freedesktop/colord-sane
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/{,colord/}colord-sane
profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
profile colord-sane @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>
@ -26,7 +26,7 @@ profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
member={GetAPIVersion,GetState,ServiceBrowserNew,Ping}
peer=(name=org.freedesktop.Avahi),
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]*
interface=org.freedesktop.Avahi.ServiceBrowser
member={CacheExhausted,AllForNow},
@ -46,7 +46,11 @@ profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
@{sys}/bus/scsi/devices/ r,
@{sys}/devices/pci[0-9]*/**/{vendor,model,type} r,
@{PROC}/sys/dev/parport/parport[0-9]*/base-addr r,
@{PROC}/sys/dev/parport/parport[0-9]*/irq r,
@{PROC}/sys/dev/parport/ r,
/dev/parport[0-9]* r,
include if exists <local/colord-sane>
}

2
apparmor.d/groups/freedesktop/colord-session
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/{,colord/}colord-session
profile colord-session @{exec_path} flags=(complain) {
profile colord-session @{exec_path} {
include <abstractions/base>
@{exec_path} mr,

7
apparmor.d/groups/freedesktop/dconf-service
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/{,dconf/}dconf-service
@{exec_path} = @{libexec}/{,dconf/}dconf-service
profile dconf-service @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-session-strict>
@ -22,13 +22,12 @@ profile dconf-service @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Notify
peer=(name=org.freedesktop.DBus), # all peer's labels
peer=(name=org.freedesktop.DBus), # all members and peer's labels
dbus receive bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Change
peer=(name=:*, label=gnome-control-center),
peer=(name=:*), # all peer's labels
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable

12
apparmor.d/groups/freedesktop/polkitd
View file

@ -21,13 +21,17 @@ profile polkitd @{exec_path} {
ptrace (read),
dbus (send) bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit1/*
interface=org.freedesktop.{DBus.Introspectable,DBus.Properties,PolicyKit1.*}, # all members
dbus (send) bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/gnome/PolicyKit1/*
interface=org.freedesktop.PolicyKit1.AuthenticationAgent
peer=(name=:*), # all members
dbus (bind) bus=system
name=org.freedesktop.PolicyKit1,

3
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -22,6 +22,7 @@ profile pulseaudio @{exec_path} {
include <abstractions/hosts_access>
include <abstractions/nameservice-strict>
include <abstractions/X-strict>
include <abstractions/freedesktop.org>
ptrace (trace) peer=@{profile_name},
@ -113,10 +114,8 @@ profile pulseaudio @{exec_path} {
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
/{usr/,}lib/pulse-*/modules/*.so mr,
/usr/share/applications/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/pulseaudio/{,**} r,
/usr/share/ubuntu/applications/{,*} r,
/var/lib/snapd/desktop/applications/ r,

46
apparmor.d/groups/gnome/gnome-keyring-daemon
View file

@ -29,7 +29,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
member=Get
peer=(name=org.freedesktop.login[0-9]),
dbus receive bus=system path=/org/freedesktop/login[0-9]/session/_[0-9]*
dbus receive bus=system path=/org/freedesktop/login[0-9]/session/*
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*, label=systemd-logind),
@ -41,8 +41,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
dbus (send, receive) bus=session path=/org/gnome/keyring/daemon
interface=org.gnome.keyring.Daemon
member=GetControlDirectory
peer=(name="{org.gnome.keyring,:*}", label=gnome-keyring-daemon), # itself
peer=(name="{org.gnome.keyring,:*}", label=@{profile_name}), # all members
dbus receive bus=session path=/org/freedesktop/secrets
interface=org.freedesktop.DBus.Properties
@ -54,6 +53,41 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
member=SearchItems
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop/secrets/aliases/default
interface=org.freedesktop.Secret.Collection
member=CreateItem
peer=(name=:*),
dbus receive bus=session path=/org/freedesktop/secrets/aliases/default
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/secrets/collection/login
interface=org.freedesktop.Secret.Collection
member=ItemCreated
peer=(name=org.freedesktop.DBus),
dbus send bus=session path=/org/freedesktop/secrets/collection/login
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=org.freedesktop.DBus),
dbus receive bus=session path=/org/freedesktop/secrets
interface=org.freedesktop.Secret.Service
member={ReadAlias,OpenSession}
peer=(name=:*),
dbus receive bus=session path=/org/freedesktop/secrets/collection/login/[0-9]*
interface=org.freedesktop.Secret.Item
member=GetSecret
peer=(name=:*),
dbus receive bus=session path=/org/freedesktop/secrets{,/collection/**}
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*),
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.DBus.Properties
member=GetAll
@ -64,6 +98,11 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop/secrets
interface=org.freedesktop.Secret.Service
member={GetSecrets,SearchItems}
peer=(name=:*), # label="{unconfined,remmina}"),
dbus bind bus=session
name=org.gnome.keyring,
@ -88,6 +127,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.local/ w,
owner @{HOME}/.local/share/ w,
owner @{HOME}/.xsession-errors w,
owner @{run}/user/@{uid}/keyring/ rw,
owner @{run}/user/@{uid}/keyring/* rw,

17
apparmor.d/groups/gnome/tracker-extract
View file

@ -18,6 +18,7 @@ profile tracker-extract @{exec_path} {
include <abstractions/opencl-nvidia>
include <abstractions/openssl>
include <abstractions/X-strict>
include <abstractions/freedesktop.org>
network netlink raw,
@ -28,20 +29,22 @@ profile tracker-extract @{exec_path} {
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.DBus.Peer
member=Ping
peer=(name=org.freedesktop.Tracker3.Miner.Files),
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.Tracker3.Endpoint
member=Query
peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner),
peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner), # all members
dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.Tracker3.Endpoint
member=GraphUpdated
peer=(name=:*, label=tracker-miner),
peer=(name=:*, label=tracker-miner), # all members
dbus send bus=session path=/org/freedesktop/Tracker3/Miner/**
interface=org.freedesktop.Tracker3.Miner
peer=(name=org.freedesktop.DBus, label=tracker-miner), # all members
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
@ -63,8 +66,6 @@ profile tracker-extract @{exec_path} {
@{exec_path} mr,
/usr/share/applications/*.desktop r,
/usr/share/applications/mimeinfo.cache r,
/usr/share/dconf/profile/gdm r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/hwdata/*.ids r,
@ -85,6 +86,8 @@ profile tracker-extract @{exec_path} {
/var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp*} rw,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/lightdm/.cache/gstreamer-1.0/registry.*.bin{,.tmp??????} r,
/var/lib/flatpak/exports/share/applications/mimeinfo.cache r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
/var/lib/snapd/desktop/applications/*.desktop r,

13
apparmor.d/groups/gnome/tracker-miner
View file

@ -58,12 +58,14 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.Tracker3.Endpoint
member=GraphUpdated
peer=(name=org.freedesktop.DBus, label=tracker-extract),
peer=(name=org.freedesktop.DBus, label=tracker-extract), # all members
dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
interface=org.freedesktop.Tracker3.Endpoint
member=Query
peer=(name=:*, label=tracker-extract), # all members
dbus receive bus=session path=/org/freedesktop/Tracker3/Miner/**
interface=org.freedesktop.Tracker3.Miner
peer=(name=:*, label=tracker-extract),
dbus receive bus=session path=/{,org}
@ -82,7 +84,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
/usr/share/gvfs/remote-volume-monitors/{,*.monitor} r,
/usr/share/tracker3-miners/{,**} r,
/usr/share/tracker3/{,**} r,
/usr/share/ubuntu/applications/ r,
/etc/fstab r,
@ -94,6 +95,10 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm{3,}/.local/share/applications/ r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/lightdm/.config/dconf/user r,
/var/lib/lightdm/.cache/tracker3/files/meta.db{,-wal} rwk,
/var/lib/lightdm/.cache/tracker3/files/no-need-mtime-check.txt{,.??????} rw,
owner /var/tmp/etilqs_@{hex} rw,
# Allow to search user files

3
apparmor.d/groups/network/networkd-dispatcher
View file

@ -12,6 +12,7 @@ profile networkd-dispatcher @{exec_path} {
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
include <abstractions/python>
include <abstractions/openssl>
dbus receive bus=system path=/org/freedesktop/network1/link/*
interface=org.freedesktop.DBus.Properties
@ -31,4 +32,4 @@ profile networkd-dispatcher @{exec_path} {
owner @{PROC}/@{pid}/mounts r,
include if exists <local/networkd-dispatcher>
}
}

2
apparmor.d/groups/systemd/networkctl
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/networkctl
profile networkctl @{exec_path} flags=(attach_disconnected,complain) {
profile networkctl @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>

40
apparmor.d/groups/systemd/systemd-machined
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-machined
profile systemd-machined @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/systemd-common>
capability chown,
@ -23,6 +24,44 @@ profile systemd-machined @{exec_path} {
capability sys_chroot,
capability sys_ptrace,
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetConnectionUnixUser
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus send bus=system path=/org/freedesktop/systemd1/{,{unit,job}/*}
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.systemd1),
dbus receive bus=system path=/org/freedesktop/systemd1{,/{unit,job}/*}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
member={StopUnit,UnrefUnit,StartTransientUnit,Subscribe}
peer=(name=org.freedesktop.systemd1),
dbus receive bus=system path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
member={JobRemoved,UnitRemoved,Reloading}
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/machine1
interface=org.freedesktop.machine1.Manager
member={TerminateMachine,GetMachineByPID,CreateMachineWithNetwork}
peer=(name=:*, label=libvirtd),
dbus receive bus=system path=/org/freedesktop/machine1/machine/*
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=:*, label=libvirtd),
dbus bind bus=system
name=org.freedesktop.machine1,
@{exec_path} mr,
/var/lib/machines/{,**} rw,
@ -30,6 +69,7 @@ profile systemd-machined @{exec_path} {
@{run}/systemd/machines/{,**} rw,
@{run}/systemd/userdb/io.systemd.Machine rw,
@{run}/systemd/notify w,
include if exists <local/systemd-machined>
}

5
apparmor.d/groups/virt/virtlogd
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/virtlogd
@{exec_path} = /{usr/,}{s,}bin/virtlogd
profile virtlogd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/openssl>
@ -30,6 +30,7 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
@{run}/libvirt/common/system.token rwk,
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{run}/libvirt/virtlogd-sock rw,
@{run}/virtlogd.pid rwk,
@{sys}/devices/system/node/ r,
@ -43,4 +44,4 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
/dev/dri/ r,
include if exists <local/virtlogd>
}
}