feat(profiles): general update.
This commit is contained in:
Alexandre Pujol
parent
fabddee9d6
commit
a90cdbe879
23 changed files with 97 additions and 35 deletions
|
|
@ -14,11 +14,14 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/video>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
network netlink raw,
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member=GetConnectionUnixProcessID
|
||||
|
|
@ -41,7 +44,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/pactl rPx,
|
||||
/{usr/,}bin/pactl rix,
|
||||
/{usr/,}bin/pipewire-media-session rPx,
|
||||
|
||||
/usr/share/pipewire/pipewire*.conf r,
|
||||
|
|
@ -51,16 +54,23 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
|
|||
/etc/pipewire/pipewire.conf r,
|
||||
/etc/pipewire/pipewire.conf.d/{,*} r,
|
||||
|
||||
/var/lib/gdm/.config/pulse/cookie rk,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
|
||||
owner @{run}/user/@{uid}/pipewire-[0-9]*.lock rwk,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/board_vendor r,
|
||||
@{run}/udev/data/c50[0-9]:[0-9]* r,
|
||||
@{run}/udev/data/c81:[0-9]* r, # For video4linux
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/media/devices/ r,
|
||||
@{sys}/devices/**/device:*/**/path r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{idVendor,idProduct,removable,uevent} r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_vendor r,
|
||||
|
||||
/dev/video[0-9]* rw,
|
||||
/dev/media[0-9]* rw,
|
||||
|
||||
include if exists <local/pipewire>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,10 +24,10 @@ profile update-desktop-database @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/usr/share/*/*.desktop r,
|
||||
|
||||
/var/lib/flatpak/{app/**/,}export/share/applications/{,**/} r,
|
||||
/var/lib/flatpak/{app/**/,}export/share/applications/**.desktop r,
|
||||
/var/lib/flatpak/{app/**/,}export/share/applications/.mimeinfo.cache.* rw,
|
||||
/var/lib/flatpak/{app/**/,}export/share/applications/mimeinfo.cache w,
|
||||
/var/lib/flatpak/{app/**/,}export{s,}/share/applications/{,**/} r,
|
||||
/var/lib/flatpak/{app/**/,}export{s,}/share/applications/**.desktop r,
|
||||
/var/lib/flatpak/{app/**/,}export{s,}/share/applications/.mimeinfo.cache.* rw,
|
||||
/var/lib/flatpak/{app/**/,}export{s,}/share/applications/mimeinfo.cache w,
|
||||
|
||||
/var/lib/snapd/desktop/applications/{,**/} r,
|
||||
/var/lib/snapd/desktop/applications/**.desktop r,
|
||||
|
|
|
|||
|
|
@ -82,6 +82,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{run}/faillock/[a-zA-z0-9]* rwk,
|
||||
@{run}/gdm{3,}/custom.conf r,
|
||||
@{run}/motd.d/{,*} r,
|
||||
@{run}/systemd/sessions/* r,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
|
|
|||
|
|
@ -14,10 +14,13 @@ profile gnome-extension-manager @{exec_path} {
|
|||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/vulkan>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -29,9 +32,16 @@ profile gnome-extension-manager @{exec_path} {
|
|||
|
||||
/{usr/,}bin/gjs-console rix,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
|
||||
/{usr/,}lib/gio-launch-desktop rPx -> child-open,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/gnome-shell/org.gnome.Shell.Extensions r,
|
||||
/usr/share/themes/{,**} r,
|
||||
/usr/share/X11/xkb/{,**} r,
|
||||
|
||||
# Silencer
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
|
||||
include if exists <local/gnome-extension-manager>
|
||||
}
|
||||
|
|
@ -11,15 +11,16 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/app-launcher-user>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/dbus-accessibility-strict>
|
||||
include <abstractions/dbus-network-manager-strict>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dbus-accessibility-strict>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/ibus>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
@ -29,6 +30,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/video>
|
||||
include <abstractions/vulkan>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
|
|
@ -511,13 +513,15 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
|||
/etc/xdg/menus/gnome-applications.menu r,
|
||||
|
||||
/var/lib/gdm{3,}/.cache/ w,
|
||||
/var/lib/gdm{3,}/.cache/event-sound-cache.tdb.*.x86_64-pc-linux-gnu rwk,
|
||||
/var/lib/gdm{3,}/.cache/gstreamer-[0-9]*/ rw,
|
||||
/var/lib/gdm{3,}/.cache/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
|
||||
/var/lib/gdm{3,}/.cache/libgweather/ r,
|
||||
/var/lib/gdm{3,}/.cache/mesa_shader_cache/ rw,
|
||||
/var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw,
|
||||
/var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/@{hex} rw,
|
||||
/var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/@{hex}.tmp rwk,
|
||||
/var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
|
||||
/var/lib/gdm{3,}/.cache/libgweather/ r,
|
||||
/var/lib/gdm{3,}/.cache/event-sound-cache.tdb.*.x86_64-pc-linux-gnu rwk,
|
||||
/var/lib/gdm{3,}/.config/dconf/user r,
|
||||
/var/lib/gdm{3,}/.config/ibus/ rw,
|
||||
/var/lib/gdm{3,}/.config/ibus/bus/ rw,
|
||||
|
|
@ -527,6 +531,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
|||
/var/lib/gdm{3,}/.config/pulse/cookie rwk,
|
||||
/var/lib/gdm{3,}/.local/share/applications/{,**} r,
|
||||
/var/lib/gdm{3,}/.local/share/gnome-shell/ rw,
|
||||
/var/lib/gdm{3,}/.local/share/icc/{,*} rw,
|
||||
|
||||
/var/lib/gdm{3,}/greeter-dconf-defaults r,
|
||||
|
||||
/var/lib/AccountsService/icons/* r,
|
||||
|
|
@ -553,6 +559,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{user_share_dirs}/gnome-shell/{,**} rw,
|
||||
owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
|
||||
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
owner @{user_share_dirs}/icc/{,*} rw,
|
||||
owner @{user_share_dirs}/sounds/__custom/index.theme r,
|
||||
|
||||
owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r,
|
||||
|
|
@ -638,6 +645,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
|
|||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
/dev/input/event[0-9]* rw,
|
||||
/dev/media[0-9]* rw,
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/gnome-shell>
|
||||
|
|
|
|||
|
|
@ -67,8 +67,9 @@ profile gnome-software @{exec_path} {
|
|||
/var/lib/PackageKit/prepared-update r,
|
||||
|
||||
owner @{HOME}/.var/app/{,**/} r,
|
||||
owner @{user_cache_dirs}/gnome-software/{,**} rw,
|
||||
owner @{user_cache_dirs}/flatpak/system-cache/{,**} rw,
|
||||
owner @{user_cache_dirs}/gnome-software/{,**} rw,
|
||||
owner @{user_share_dirs}/ r,
|
||||
owner @{user_share_dirs}/flatpak/repo/{,**} rw,
|
||||
|
||||
/var/tmp/flatpak-cache-*/ rw,
|
||||
|
|
|
|||
|
|
@ -39,6 +39,8 @@ profile gnome-terminal-server @{exec_path} {
|
|||
|
||||
/etc/shells r,
|
||||
|
||||
owner @{user_config_dirs}/*xdg-terminals.list* rw,
|
||||
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
||||
owner @{run}/user/@{uid}/wayland-[0-9]* rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/trash>
|
||||
include <abstractions/vulkan>
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/hostname[0-9]
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
|
|
|
|||
|
|
@ -6,7 +6,8 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = "/opt/Mullvad VPN/resources/mullvad-daemon"
|
||||
@{exec_path} = /{usr/,}bin/mullvad-daemon
|
||||
@{exec_path} += "/opt/Mullvad VPN/resources/mullvad-daemon"
|
||||
profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
|
|||
|
|
@ -113,6 +113,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
|
|||
@{run}/systemd/users/@{uid} rw,
|
||||
|
||||
@{sys}/class/drm/ r,
|
||||
@{sys}/class/power_supply/ r,
|
||||
@{sys}/devices/** r,
|
||||
@{sys}/devices/**/brightness rw,
|
||||
@{sys}/devices/virtual/tty/tty[0-9]*/active r,
|
||||
|
|
|
|||
|
|
@ -18,11 +18,12 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
|
|||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability kill,
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability kill,
|
||||
capability sys_ptrace,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -42,6 +43,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
|
|||
pivot_root oldroot=/var/lib/docker/overlay*/**/.pivot_root[0-9]*/ /var/lib/docker/overlay2/**/,
|
||||
pivot_root oldroot=/var/lib/docker/tmp/**/.pivot_root[0-9]*/ /var/lib/docker/tmp/**/,
|
||||
|
||||
ptrace (read) peer=docker-*,
|
||||
ptrace (read) peer=unconfined,
|
||||
|
||||
signal (send) set=kill peer=docker-*,
|
||||
|
|
@ -62,7 +64,6 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
|
|||
# TODO: should be in a sub profile started with pivot_root, not supported yet.
|
||||
/{,**} rw,
|
||||
deny /boot/{,**} rw,
|
||||
deny /dev/{,**} rw,
|
||||
deny /media/{,**} rw,
|
||||
deny /mnt/{,**} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -122,7 +122,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
|
|||
/{usr/,}bin/qemu-img rUx, # TODO: Integration with virt-aa-helper
|
||||
/{usr/,}lib/libvirt/virt-aa-helper rPx,
|
||||
|
||||
/etc/libvirt/hooks/** rmix,
|
||||
/etc/libvirt/hooks/** rPUx,
|
||||
/etc/xen/scripts/** rmix,
|
||||
/var/lib/libvirt/virtd* rix,
|
||||
|
||||
|
|
@ -175,6 +175,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/udev/data/c24[0-9]:[0-9]* r,
|
||||
@{run}/udev/data/c50[0-9]:[0-9]* r,
|
||||
@{run}/udev/data/c51[0-9]:[0-9]* r,
|
||||
@{run}/udev/data/c90:[0-9]* r,
|
||||
@{run}/udev/data/n[0-9]* r,
|
||||
|
||||
@{sys}/bus/[a-z]*/devices/ r,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue