felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-06-23 11:25:17 +01:00
parent 2e127ace4b
commit ae71b323c2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
29 changed files with 80 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/apt/command-not-found
View file

@ -25,6 +25,8 @@ profile command-not-found @{exec_path} {
@{lib}/python3/dist-packages/CommandNotFound/**/__pycache__/*.cpython-@{int}.pyc.@{int} w,
@{lib}/ r,
/usr/share/command-not-found/{,**} r,
/var/lib/command-not-found/commands.db rwk,

2
apparmor.d/groups/children/child-dpkg
View file

@ -43,7 +43,7 @@ profile child-dpkg {
/var/lib/dpkg/tmp.ci/md5sums rw,
/var/lib/dpkg/triggers/Lock rw,
/var/lib/dpkg/updates/* rw,
/var/log/dpkg.log ra,
/var/log/dpkg.log rw,
# file_inherit
/tmp/#@{int} rw,

2
apparmor.d/groups/children/child-open
View file

@ -19,7 +19,7 @@ abi <abi/3.0>,
include <tunables/global>
profile child-open {
profile child-open flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-open>
include <abstractions/app/open>

2
apparmor.d/groups/children/child-open-browsers
View file

@ -15,7 +15,7 @@ abi <abi/3.0>,
include <tunables/global>
profile child-open-browsers {
profile child-open-browsers flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/open>

2
apparmor.d/groups/children/child-pager
View file

@ -28,6 +28,8 @@ profile child-pager {
@{system_share_dirs}/terminfo/{,**} r,
@{HOME}/.lesshst r,
owner @{HOME}/ r,
owner @{HOME}/.lesshs* rw,
owner @{HOME}/.terminfo/@{int}/* r,

4
apparmor.d/groups/freedesktop/pipewire
View file

@ -56,7 +56,6 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/pipewire-@{int}.lock rwk,
owner @{run}/user/@{uid}/pulse/pid rw,
@{run}/udev/data/c81:@{int} r, # For video4linux
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
@{sys}/bus/ r,
@ -65,12 +64,11 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/@{pci}/usb@{int}/**/{idVendor,idProduct,removable,uevent} r,
@{sys}/devices/**/device:*/**/path r,
@{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name,bios_vendor,board_vendor} r,
@{sys}/module/apparmor/parameters/enabled r, # deny ?
@{sys}/module/apparmor/parameters/enabled r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
/dev/media@{int} rw,
/dev/video@{int} rw,
include if exists <local/pipewire>
}

2
apparmor.d/groups/freedesktop/xwayland
View file

@ -18,6 +18,8 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup) peer=kwin_wayland,
signal (receive) set=(term hup) peer=login,
unix type=stream addr=none peer=(label=gnome-shell, addr=none),
@{exec_path} mrix,
@{sh_path} rix,

6
apparmor.d/groups/gnome/gjs-console
View file

@ -64,14 +64,16 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
/usr/share/gnome-shell/{,**} r,
/usr/share/icu/@{int}.@{int}/*.dat r,
/tmp/ r,
/var/tmp/ r,
owner @{gdm_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rwl,
owner @{gdm_cache_dirs}/gstreamer-1.0/ rw,
owner @{gdm_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw,
owner @{gdm_config_dirs}/dconf/user r,
owner @{GDM_HOME}/greeter-dconf-defaults r,
/tmp/ r,
/var/tmp/ r,
owner @{HOME}/ r,
owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
owner @{user_cache_dirs}/gstreamer-1.0/ rw,

2
apparmor.d/groups/gnome/gnome-control-center
View file

@ -153,7 +153,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/platform/**/uevent r,
@{sys}/devices/virtual/**/uevent r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
@{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/temp* r,
@{sys}/firmware/acpi/pm_profile r,
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw,

2
apparmor.d/groups/gnome/gnome-remote-desktop-daemon
View file

@ -19,7 +19,7 @@ profile gnome-remote-desktop-daemon @{exec_path} {
network inet stream,
network inet6 stream,
#aa:dbus own bus=session name=org.gnome.RemoteDesktop.User
#aa:dbus own bus=session name=org.gnome.RemoteDesktop
#aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm
@{exec_path} mr,

1
apparmor.d/groups/gnome/session-migration
View file

@ -13,6 +13,7 @@ profile session-migration @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/gsettings rPx,
/usr/share/session-migration/scripts/*.sh rix,
/usr/share/session-migration/{,**} r,

1
apparmor.d/groups/systemd/systemd-machine-id-setup
View file

@ -19,6 +19,7 @@ profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) {
ptrace (read),
mount options=(rw rshared) -> /,
mount options=(rw rslave) -> /,
umount /etc/machine-id,

1
apparmor.d/groups/systemd/systemd-udevd
View file

@ -93,6 +93,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
@{run}/udev/ rw,
@{run}/udev/** rwk,
@{run}/credentials/systemd-udev-load-credentials.service/ r,
@{run}/systemd/network/ r,
@{run}/systemd/network/*.link rw,
@{run}/systemd/notify rw,

2
apparmor.d/groups/systemd/systemd-user-runtime-dir
View file

@ -20,6 +20,8 @@ profile systemd-user-runtime-dir @{exec_path} {
capability net_admin,
capability sys_admin,
network unix stream,
mount fstype=tmpfs options=(rw,nosuid,nodev) -> @{run}/user/@{uid}/,
umount @{run}/user/@{uid}/,

9
apparmor.d/groups/ubuntu/do-release-upgrade
View file

@ -37,10 +37,15 @@ profile do-release-upgrade @{exec_path} {
/var/lib/ubuntu-release-upgrader/release-upgrade-available rw,
/var/lib/update-manager/* rw,
/var/cache/apt/pkgcache.bin{,.*} rw,
owner @{PROC}/@{pid}/fd/ r,
/var/cache/apt/ rw,
/var/cache/apt/pkgcache.bin rw,
/var/cache/apt/pkgcache.bin.@{rand6} rw,
/var/cache/apt/srcpkgcache.bin rw,
/var/cache/apt/srcpkgcache.bin.@{rand6} rw,
@{PROC}/@{pids}/mountinfo r,
owner @{PROC}/@{pid}/fd/ r,
include if exists <local/do-release-upgrade>
}

2
apparmor.d/groups/xfce/xfce-panel
View file

@ -23,7 +23,7 @@ profile xfce-panel @{exec_path} {
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
@{lib}/gio-launch-desktop rix,
@{bin}/sudo rCx -> root,
@{bin}/sudo rCx -> root,
/usr/share/desktop-directories/{,**} r,
/usr/share/livecheck/** r,

2
apparmor.d/groups/xfce/xfce-session
View file

@ -58,7 +58,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
profile systemctl flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/systemctl>
include if exists <local/xfce-session_systemctl>
}