felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): replace some rule by the new directives.

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-15 22:26:35 +00:00
parent 66a4a17924
commit b1212c6e62
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
26 changed files with 42 additions and 292 deletions
Download patch file Download diff file Expand all files Collapse all files

14
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -23,19 +23,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
ptrace (read) peer=unconfined,
dbus bind bus=system name=org.freedesktop.Accounts,
dbus receive bus=system path=/org/freedesktop/Accounts{,/User@{uid}}
interface=org.freedesktop.Accounts*
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/Accounts{,/User@{uid}}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.Accounts.User
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.DBus),
# dbus: own bus=system name=org.freedesktop.Accounts
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus

29
apparmor.d/groups/freedesktop/at-spi2-registryd
View file

@ -21,42 +21,21 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term hup kill) peer=dbus-daemon,
signal (receive) set=(term hup kill) peer=gdm*,
dbus bind bus=accessibility name=org.a11y.atspi.Registry,
dbus send bus=session path=/org/a11y/bus
interface=org.a11y.Bus
member=GetAddress
peer=(name=org.a11y.Bus, label=dbus-daemon),
# dbus: own bus=accessibility name=org.a11y.atspi.{R,r}egistry
dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.freedesktop.DBus.Properties
member=Set
peer=(name=:*), # all peer's labels
peer=(name=:*),
dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root
interface=org.a11y.atspi.Socket
member=Embed
peer=(name=:*), # all peer's labels
dbus receive bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member={GetRegisteredEvents,EventListenerDeregistered}
peer=(name=:*), # all peer's labels
dbus send bus=accessibility path=/org/a11y/atspi/registry
interface=org.a11y.atspi.Registry
member={GetRegisteredEvents,EventListenerDeregistered}
peer=(name=org.freedesktop.DBus), # all peer's labels
peer=(name=:*),
dbus receive bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
interface=org.a11y.atspi.DeviceEventController
member={GetKeystrokeListeners,GetDeviceEventListeners}
peer=(name=:*), # all peer's labels
dbus send bus=accessibility path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus, label=at-spi-bus-launcher),
peer=(name=:*),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable

11
apparmor.d/groups/freedesktop/colord
View file

@ -17,16 +17,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus bind bus=system name=org.freedesktop.ColorManager,
dbus receive bus=system path=/org/freedesktop/ColorManager{,/**}
interface=org.freedesktop.ColorManager
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/ColorManager{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus send bus=system path=/org/freedesktop/ColorManager{,/**}
interface=org.freedesktop.ColorManager
peer=(name=org.freedesktop.DBus),
# dbus: own bus=system name=org.freedesktop.ColorManager
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus

11
apparmor.d/groups/freedesktop/geoclue
View file

@ -24,16 +24,7 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
network inet6 stream,
network netlink raw,
dbus bind bus=system name=org.freedesktop.GeoClue2,
dbus send bus=system path=/org/freedesktop/GeoClue2/*
interface=org.freedesktop.DBus.Properties
peer=(name="{:*,org.freedesktop.DBus}"),
dbus receive bus=system path=/org/freedesktop/GeoClue2/*
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/GeoClue2/*
interface=org.freedesktop.GeoClue2.Manager
peer=(name=:*),
# dbus: own bus=system name=org.freedesktop.GeoClue2
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus

2
apparmor.d/groups/freedesktop/pipewire
View file

@ -23,7 +23,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus bind bus=session name=org.pulseaudio.Server,
# dbus: own bus=session name=org.pulseaudio.Server
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus

9
apparmor.d/groups/freedesktop/polkitd
View file

@ -21,14 +21,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
ptrace (read),
dbus (bind) bus=system name=org.freedesktop.PolicyKit1,
dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit1/*
interface=org.freedesktop.{DBus.Introspectable,DBus.Properties,PolicyKit1.*}, # all members
dbus send bus=system path=/org/gnome/PolicyKit1/*
interface=org.freedesktop.PolicyKit1.AuthenticationAgent
peer=(name=:*), # all members
# dbus: own bus=system name=org.freedesktop.PolicyKit1
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus

8
apparmor.d/groups/freedesktop/upowerd
View file

@ -17,13 +17,7 @@ profile upowerd @{exec_path} flags=(attach_disconnected) {
network netlink raw,
dbus bind bus=system name=org.freedesktop.UPower,
dbus receive bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.UPower{,.*}
peer=(name=:*),
dbus receive bus=system path=/org/freedesktop/UPower{,/**}
interface=org.freedesktop.DBus.Properties
peer=(name=:*),
# dbus: own bus=system name=org.freedesktop.UPower
@{exec_path} mr,

13
apparmor.d/groups/freedesktop/xdg-document-portal
View file

@ -24,24 +24,13 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
unix (send receive) type=stream peer=(label=xdg-document-portal//fusermount),
dbus receive bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.portal.Documents
member=GetMountPoint
peer=(name=:*),
# dbus: own bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=xdg-desktop-portal),
dbus bind bus=session
name=org.freedesktop.portal.Documents,
@{exec_path} mr,
@{bin}/flatpak rPUx,