felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-12 22:26:47 +01:00
parent 9e7c4c7ec8
commit ab7f45bc31
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
26 changed files with 53 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/bus/dbus-session
View file

@ -4,7 +4,7 @@
# Profile for session dbus, regardless of the dbus implementation used.
# It does not specify an attachment path as it would be the same than
# "dbus-system". It is intended to be used only via "Px ->" or via
# "dbus-system". It is intended to be used only via "Px ->" or via
# systemd drop-in AppArmorProfile= setting.
abi <abi/3.0>,
@ -24,9 +24,7 @@ profile dbus-session flags=(attach_disconnected) {
unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none),
signal (receive) set=(term hup) peer=gdm-session-worker,
signal (receive) set=(term hup) peer=gdm-session,
signal (receive) set=(term hup) peer=gdm,
signal (receive) set=(term hup) peer=gdm{,-*},
signal (send) set=(term hup kill) peer=dbus-accessibility,
signal (send) set=(term hup kill) peer=dconf-service,
signal (send) set=(term hup kill) peer=xdg-*,

3
apparmor.d/groups/gnome/gnome-control-center
View file

@ -153,6 +153,9 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/temp* r,
@{sys}/firmware/acpi/pm_profile r,
@{sys}/fs/cgroup/user.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw,
@{PROC}/cmdline r,

9
apparmor.d/groups/gnome/gnome-shell
View file

@ -181,16 +181,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/glib-compile-schemas rPx,
@{bin}/ibus-daemon rPx,
@{bin}/Xwayland rPx,
@{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx,
@{lib}/mutter-x11-frames rPx,
#aa:exec polkit-agent-helper
@{sh_path} rCx -> shell,
@{lib}/gio-launch-desktop rCx -> open,
@{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open,
# nm-openvpn-auth-dialog
@{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx,
@{user_share_dirs}/gnome-shell/extensions/*/** rPUx,
/usr/share/gnome-shell/extensions/*/** rPUx,
@ -294,11 +292,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw,
owner @{run}/user/@{uid}/systemd/notify rw,
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
owner /dev/shm/.org.chromium.Chromium.@{rand6} r,
owner /dev/shm/wayland.mozilla.ipc.@{int} rw,
/tmp/.X@{int}-lock rw,
/tmp/dbus-@{rand8} rw,
owner @{tmp}/.org.chromium.Chromium.@{rand6} r,
owner @{tmp}/@{rand6}.shell-extension.zip rw,
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,

6
apparmor.d/groups/gnome/nautilus
View file

@ -33,17 +33,13 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
#aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell
#aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
#aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus.Properties
member={GetAll,ListActivatableNames}
peer=(name=org.freedesktop.DBus, label=dbus-session),
dbus send bus=session path=/org/gtk/Notifications
interface=org.gtk.Notifications
member=AddNotification
peer=(name=org.gtk.Notifications, label=gnome-shell),
dbus (send, receive) bus=session path=/org/gtk/Application/CommandLine
interface=org.gtk.private.CommandLine
member=Print

2
apparmor.d/groups/kde/kreadconfig
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/kreadconfig5
@{exec_path} = @{bin}/kreadconfig{,5}
profile kreadconfig @{exec_path} {
include <abstractions/base>
include <abstractions/kde-strict>

1
apparmor.d/groups/kde/kwalletmanager
View file

@ -45,7 +45,6 @@ profile kwalletmanager @{exec_path} {
@{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/cmdline r,
/dev/shm/ r,
/dev/shm/#@{int} rw,
include if exists <local/kwalletmanager>

2
apparmor.d/groups/kde/plasma-discover
View file

@ -29,7 +29,7 @@ profile plasma-discover @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/kreadconfig5 rPx,
@{bin}/kreadconfig{,5} rPx,
@{bin}/gpg rCx -> gpg,
@{bin}/gpgconf rCx -> gpg,

7
apparmor.d/groups/network/wg
View file

@ -11,11 +11,18 @@ profile wg @{exec_path} {
include <abstractions/base>
capability net_admin,
capability net_bind_service,
network inet dgram,
network inet stream,
network inet6 dgram,
network inet6 stream,
network netlink raw,
@{exec_path} mr,
/etc/wireguard/{,**} rw,
include if exists <local/wg>
}

4
apparmor.d/groups/network/wg-quick
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile wg-quick @{exec_path} {
include <abstractions/base>
capability dac_read_search,
capability net_admin,
network netlink raw,
@ -21,7 +22,8 @@ profile wg-quick @{exec_path} {
@{bin}/ip rPx,
@{bin}/nft rix,
@{bin}/readlink rix,
@{bin}/resolvectl rPx,
@{bin}/resolvconf rPx,
@{bin}/resolvectl rPUx,
@{bin}/sort rix,
@{bin}/stat rix,
@{bin}/sysctl rix,

2
apparmor.d/groups/pacman/makepkg
View file

@ -48,6 +48,8 @@ profile makepkg @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
owner @{tmp}/.git_vtag_tmp@{rand6} rw,
owner @{run}/user/@{uid}/ r,
owner @{run}/user/@{uid}/gnupg/ r,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw,