felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

general_initial

Browse source
This commit is contained in:
nobody43 2023-02-19 23:40:41 +00:00 • committed by Alex
parent 3eb8dd2811
commit a873af1f26
36 changed files with 640 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -35,7 +35,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,GetConnectionUnixUser}
member={RequestName,ReleaseName,GetConnectionUnixUser}
peer=(name=org.freedesktop.DBus),
dbus bind bus=system
@ -50,7 +50,8 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
/{usr/,}{s,}bin/userdel rPx,
/{usr/,}bin/passwd rPx,
/{usr/,}bin/chage rPx,
/usr/share/language-tools/language-validate rPx,
/usr/share/language-tools/language-validate rPx,
/usr/share/language-tools/set-language-helper rPUx,
/usr/share/accountsservice/{,**} r,
/usr/share/dbus-1/interfaces/*.xml r,

12
apparmor.d/groups/freedesktop/at-spi2-registryd
View file

@ -17,6 +17,8 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup) peer=gdm*,
signal (receive) set=(term hup kill) peer=dbus-daemon,
unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*", label="{xorg,xkbcomp}"),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
@ -45,12 +47,12 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*, label="{gnome-extension-ding,gnome-control-center}"),
peer=(name=:*), # all peer's labels
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=:*, label="{gnome-extension-ding,gnome-control-center,spice-vdagent}"),
peer=(name=:*), # all peer's labels
dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
@ -60,17 +62,17 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member=GetRegisteredEvents
peer=(name=:*, label=gnome-control-center),
peer=(name=:*), # all peer's labels
dbus receive bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=:*, label="{gnome-control-center,xdg-desktop-portal-*}"),
peer=(name=:*), # all peer's labels
dbus send bus=session path=/org/a11y/bus
interface=org.a11y.Bus
member=GetAddress
peer=(name=org.a11y.Bus, label=at-spi-bus-launcher),
peer=(name=org.a11y.Bus, label="{at-spi-bus-launcher,unconfined}"),
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable

17
apparmor.d/groups/freedesktop/colord
View file

@ -18,7 +18,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName},
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName,ReleaseName},
dbus (send,receive) bus=system path=/org/freedesktop/ColorManager{,/**}
interface=org.freedesktop.ColorManager*,
@ -30,8 +30,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.PolicyKit[0-9].Authority
member=Changed
peer=(name=:*, label=polkitd),
peer=(name=:*, label=polkitd), # all members
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.DBus.Properties
@ -43,10 +42,15 @@ profile colord @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label="{gsd-color,colord-sane,gnome-control-center}"),
dbus (send, receive) bus=system path=/org/freedesktop/ColorManager
dbus send bus=system path=/org/freedesktop/ColorManager
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=colord),
peer=(name=:*, label=@{profile_name}),
dbus receive bus=system path=/org/freedesktop/ColorManager/**
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=@{profile_name}),
dbus bind bus=system
name=org.freedesktop.ColorManager,
@ -67,8 +71,9 @@ profile colord @{exec_path} flags=(attach_disconnected) {
owner /var/lib/colord/.cache/** rw,
owner /var/lib/colord/{mapping,storage}.db{,-journal} rwk,
@{system_share_dirs}/mime/mime.cache r,
/var/lib/gdm{3,}/.local/share/icc/edid-*.icc r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
@{system_share_dirs}/mime/mime.cache r,
@{user_share_dirs}/icc/edid-*.icc r,

8
apparmor.d/groups/freedesktop/colord-sane
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/{,colord/}colord-sane
profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
profile colord-sane @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/devices-usb>
@ -26,7 +26,7 @@ profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
member={GetAPIVersion,GetState,ServiceBrowserNew,Ping}
peer=(name=org.freedesktop.Avahi),
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]*
interface=org.freedesktop.Avahi.ServiceBrowser
member={CacheExhausted,AllForNow},
@ -46,7 +46,11 @@ profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
@{sys}/bus/scsi/devices/ r,
@{sys}/devices/pci[0-9]*/**/{vendor,model,type} r,
@{PROC}/sys/dev/parport/parport[0-9]*/base-addr r,
@{PROC}/sys/dev/parport/parport[0-9]*/irq r,
@{PROC}/sys/dev/parport/ r,
/dev/parport[0-9]* r,
include if exists <local/colord-sane>
}

2
apparmor.d/groups/freedesktop/colord-session
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/{,colord/}colord-session
profile colord-session @{exec_path} flags=(complain) {
profile colord-session @{exec_path} {
include <abstractions/base>
@{exec_path} mr,

7
apparmor.d/groups/freedesktop/dconf-service
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/{,dconf/}dconf-service
@{exec_path} = @{libexec}/{,dconf/}dconf-service
profile dconf-service @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-session-strict>
@ -22,13 +22,12 @@ profile dconf-service @{exec_path} flags=(attach_disconnected) {
dbus send bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Notify
peer=(name=org.freedesktop.DBus), # all peer's labels
peer=(name=org.freedesktop.DBus), # all members and peer's labels
dbus receive bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Change
peer=(name=:*, label=gnome-control-center),
peer=(name=:*), # all peer's labels
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable

12
apparmor.d/groups/freedesktop/polkitd
View file

@ -21,13 +21,17 @@ profile polkitd @{exec_path} {
ptrace (read),
dbus (send) bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=dbus-daemon),
dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit1/*
interface=org.freedesktop.{DBus.Introspectable,DBus.Properties,PolicyKit1.*}, # all members
dbus (send) bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/gnome/PolicyKit1/*
interface=org.freedesktop.PolicyKit1.AuthenticationAgent
peer=(name=:*), # all members
dbus (bind) bus=system
name=org.freedesktop.PolicyKit1,

3
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -22,6 +22,7 @@ profile pulseaudio @{exec_path} {
include <abstractions/hosts_access>
include <abstractions/nameservice-strict>
include <abstractions/X-strict>
include <abstractions/freedesktop.org>
ptrace (trace) peer=@{profile_name},
@ -113,10 +114,8 @@ profile pulseaudio @{exec_path} {
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
/{usr/,}lib/pulse-*/modules/*.so mr,
/usr/share/applications/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/pulseaudio/{,**} r,
/usr/share/ubuntu/applications/{,*} r,
/var/lib/snapd/desktop/applications/ r,