refractor(abs): move common and app abstraction to their own abstractions subfolder.
As the number of abstraction is increasing, it is valuable to separate "base" abstractions to programs specific ones.
This commit is contained in:
Alexandre Pujol
parent
92f83d9e8d
commit
b88b8b8c26
158 changed files with 226 additions and 198 deletions
|
|
@ -11,8 +11,8 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/bwrap
|
||||
profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap>
|
||||
include <abstractions/bwrap-app>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/common/app>
|
||||
include <abstractions/dbus>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
|
||||
profile bwrap-app flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap-app>
|
||||
include <abstractions/common/app>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
|
||||
network inet dgram,
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ include <tunables/global>
|
|||
|
||||
profile default-sudo @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/sudo>
|
||||
include <abstractions/app/sudo>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ profile calibre @{exec_path} {
|
|||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.a11y>
|
||||
include <abstractions/bus/org.gtk.vfs.MountTracker>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ profile discord @{exec_path} {
|
|||
include <abstractions/mesa>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
|
||||
signal (send) set=(kill, term) peer=@{profile_name}//lsb_release,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ include <tunables/global>
|
|||
profile freetube @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ include <tunables/global>
|
|||
profile signal-desktop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt @{bin}/apt-get @{bin}/aptd
|
||||
profile apt @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/bus/org.freedesktop.PackageKit>
|
||||
|
|
@ -220,7 +220,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-cache
|
||||
profile apt-cache @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-cdrom
|
||||
profile apt-cdrom @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-config
|
||||
profile apt-config @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile apt-extracttemplates @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-file
|
||||
profile apt-file @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/perl>
|
||||
|
||||
@{exec_path} r,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-forktracer
|
||||
profile apt-forktracer @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/python>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/apt/apt-helper
|
||||
profile apt-helper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
@ -21,7 +21,7 @@ profile apt-helper @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-mark
|
||||
profile apt-mark @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile apt-show-versions @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/perl>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
@{exec_path} r,
|
||||
@{bin}/perl r,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
# To remove the following errors:
|
||||
# W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ include <tunables/global>
|
|||
@{exec_path} += @{lib}/command-not-found
|
||||
profile command-not-found @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile debtags @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/python>
|
||||
|
||||
#capability sys_tty_config,
|
||||
|
|
|
|||
|
|
@ -78,7 +78,7 @@ profile dpkg @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/dpkg_systemctl>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -23,7 +23,9 @@ profile dpkg-preconfigure @{exec_path} {
|
|||
@{bin}/{,e}grep rix,
|
||||
@{bin}/locale rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/sort rix,
|
||||
@{bin}/stty rix,
|
||||
@{bin}/tr rix,
|
||||
|
||||
@{bin}/dpkg rPx -> child-dpkg,
|
||||
@{bin}/apt-extracttemplates rPx,
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ profile querybts @{exec_path} {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/reportbug
|
||||
profile reportbug @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
|
|
@ -109,7 +109,7 @@ profile reportbug @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/reportbug_systemctl>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ profile synaptic @{exec_path} {
|
|||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To remove the following errors:
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/unattended-upgrade
|
||||
profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/update-apt-xapian-index
|
||||
profile update-apt-xapian-index @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/python>
|
||||
|
||||
@{exec_path} r,
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile brave @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
unix (send, receive) type=stream peer=(label=brave-crashpad-handler),
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile chrome @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile chromium @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile opera @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ profile child-systemctl flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability mknod,
|
||||
|
|
|
|||
|
|
@ -84,7 +84,7 @@ profile gdm-xsession @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ include <tunables/global>
|
|||
|
||||
profile gnome-desktop-thumbnailers flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/gnome-strict>
|
||||
include <abstractions/gstreamer>
|
||||
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile bwrap flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap>
|
||||
include <abstractions/common/bwrap>
|
||||
|
||||
signal (receive) set=(kill) peer=loupe,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile grub-sort-version @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
include if exists <abstractions/apt-common>
|
||||
include if exists <abstractions/common/apt>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
|
|
|
|||
|
|
@ -154,7 +154,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/NetworkManager_systemctl>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /opt/Mullvad*/mullvad-gui
|
||||
profile mullvad-gui @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
|
|
@ -49,7 +49,7 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -70,7 +70,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -88,7 +88,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -186,7 +186,7 @@ profile pacman @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ profile pacman-hook-systemd @{exec_path} {
|
|||
|
||||
profile systemctl flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ profile bootctl @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ profile busctl @{exec_path} {
|
|||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_ptrace,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/localectl
|
||||
profile localectl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile loginctl @{exec_path} {
|
|||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.login1.Session>
|
||||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-analyze @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_resource,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-backlight
|
||||
profile systemd-backlight @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-binfmt
|
||||
profile systemd-binfmt @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-cgtop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
# userns,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/systemd-cryptsetup @{lib}/systemd/systemd-cryptsetup
|
||||
profile systemd-cryptsetup @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability ipc_lock,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/systemd-escape
|
||||
profile systemd-escape @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-fsck @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-fsckd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_tty_config,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-bless-boot-generator
|
||||
profile systemd-generator-bless-boot @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-generator-cryptsetup @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-debug-generator
|
||||
profile systemd-generator-debug @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-fstab-generator
|
||||
profile systemd-generator-fstab @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-generator-getty @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-generator-gpt-auto @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-hibernate-resume-generator
|
||||
profile systemd-generator-hibernate-resume @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-integritysetup-generator
|
||||
profile systemd-generator-integritysetup @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-run-generator
|
||||
profile systemd-generator-run @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
ptrace (read) peer=@{systemd},
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-system-update-generator
|
||||
profile systemd-generator-system-update @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/user-generators/systemd-xdg-autostart-generator
|
||||
profile systemd-generator-user-autostart @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/user-environment-generators/*
|
||||
profile systemd-generator-user-environment @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-veritysetup-generator
|
||||
profile systemd-generator-veritysetup @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
ptrace (read) peer=@{systemd},
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/bus-system>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-homework @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.PolicyKit1>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_admin, # To set a hostname
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-journald @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability audit_control,
|
||||
capability audit_read,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
# Needed?
|
||||
audit capability net_admin,
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/devices-usb>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ profile systemd-machined @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-makefs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-modules-load
|
||||
profile systemd-modules-load @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_module,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.hostname1>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability net_bind_service,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-networkd-wait-online
|
||||
profile systemd-networkd-wait-online @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability dac_override,
|
||||
capability kill,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-portabled
|
||||
profile systemd-portabled @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-random-seed
|
||||
profile systemd-random-seed @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-remount-fs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_bind_service,
|
||||
capability net_raw,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-rfkill
|
||||
profile systemd-rfkill @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_ptrace,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-shutdown
|
||||
profile systemd-shutdown @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability kill,
|
||||
capability sys_boot,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ profile systemd-sleep @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-socket-proxyd
|
||||
profile systemd-socket-proxyd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-sulogin-shell
|
||||
profile systemd-sulogin-shell @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-sysctl @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-sysusers @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-timedated @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_time,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_time,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/systemd-tmpfiles
|
||||
profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability chown,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-tty-ask-password-agent @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability dac_override,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
@ -132,7 +132,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
|
|||
|
||||
profile systemctl flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_ptrace,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-update-utmp
|
||||
profile systemd-update-utmp @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue