felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update flatpak profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-08-22 18:15:38 +02:00
parent ec73d8349e
commit ba217a261e
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/flatpak/flatpak
View file

@ -40,14 +40,12 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
signal send peer=flatpak-app, signal send peer=flatpak-app,
#aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper
#aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
#aa:dbus talk bus=system name=org.freedesktop.Flatpak.SystemHelper label=flatpak-system-helper
#aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}"
dbus send bus=session path=/org/freedesktop/portal/documents #aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper
interface=org.freedesktop.portal.Documents #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal
member=GetMountPoint
peer=(name=org.freedesktop.portal.Documents, label="{xdg-document-portal,unconfined}"),
@{exec_path} mr, @{exec_path} mr,
@ -138,6 +136,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
@{bin}/gpgconf mr, @{bin}/gpgconf mr,
@{bin}/gpgsm mr, @{bin}/gpgsm mr,
@{bin}/gpg-agent rix, @{bin}/gpg-agent rix,
@{lib}/gnupg/scdaemon rix,
@{HOME}/@{XDG_GPG_DIR}/*.conf r, @{HOME}/@{XDG_GPG_DIR}/*.conf r,

4
apparmor.d/groups/flatpak/flatpak-app
View file

@ -48,6 +48,10 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
signal receive set=(int term) peer=flatpak-portal, signal receive set=(int term) peer=flatpak-portal,
signal receive set=(int term) peer=flatpak-session-helper, signal receive set=(int term) peer=flatpak-session-helper,
unix type=seqpacket peer=(label=dbus-session),
# unix type=seqpacket peer=(label=unconfined),
unix type=seqpacket peer=(label=xdg-dbus-proxy),
@{bin}/** rmix, @{bin}/** rmix,
@{lib}/** rmix, @{lib}/** rmix,
/app/** rmix, /app/** rmix,

6
apparmor.d/groups/flatpak/flatpak-portal
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile flatpak-portal @{exec_path} flags=(attach_disconnected) { profile flatpak-portal @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
capability sys_ptrace, capability sys_ptrace,
@ -22,6 +23,11 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=session name=org.freedesktop.portal.Flatpak #aa:dbus own bus=session name=org.freedesktop.portal.Flatpak
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr, @{exec_path} mr,
@{bin}/flatpak rPx, @{bin}/flatpak rPx,