diff --git a/apparmor.d/profiles-g-l/gparted b/apparmor.d/profiles-g-l/gparted index 93e65f0a2..d4511c62c 100644 --- a/apparmor.d/profiles-g-l/gparted +++ b/apparmor.d/profiles-g-l/gparted @@ -8,41 +8,35 @@ abi , include @{exec_path} = @{bin}/gparted -profile gparted @{exec_path} { +profile gparted @{exec_path} flags=(attach_disconnected) { include + include - ptrace (read), + ptrace read, @{exec_path} r, - @{bin}/ r, + @{bin}/ r, + @{coreutils_path} rix, @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/{m,g,}awk rix, - @{bin}/cut rix, - @{bin}/id rix, - @{bin}/ls rix, - @{bin}/mkdir rix, - @{bin}/pidof rix, - @{bin}/rm rix, - @{bin}/sed rix, - @{bin}/touch rix, + + @{bin}/killall5 rCx -> killall, + @{bin}/systemctl rCx -> systemctl, + @{bin}/udevadm rCx -> udevadm, + + @{bin}/pidof rPx, + @{bin}/pkexec rPx, + @{bin}/ps rPx, + @{bin}/xhost rPx, @{bin}/gpartedbin rPx, @{lib}/gparted/gpartedbin rPx, @{lib}/gpartedbin rPx, @{lib}/{,udisks2/}udisks2-inhibit rix, + @{run}/udev/rules.d/ rw, - @{run}/udev/rules.d/90-udisks-inhibit.rules rw, - - @{bin}/udevadm rCx -> udevadm, - @{bin}/killall5 rCx -> killall, - - @{bin}/ps rPx, - @{bin}/xhost rPx, - @{bin}/pkexec rPx, - @{bin}/systemctl rCx -> systemctl, + @{run}/udev/rules.d/@{int}-*.rules rw, # For shell pwd / r, @@ -57,7 +51,6 @@ profile gparted @{exec_path} { # file_inherit owner /dev/tty@{int} rw, - profile udevadm { include include @@ -80,11 +73,9 @@ profile gparted @{exec_path} { @{bin}/killall5 mr, - # The /proc/ dir is needed to avoid the following error: - # /proc: Permission denied - @{PROC}/ r, - @{PROC}/@{pids}/stat r, - @{PROC}/@{pids}/cmdline r, + @{PROC}/ r, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/cmdline r, include if exists } @@ -93,6 +84,8 @@ profile gparted @{exec_path} { include include + capability net_admin, + include if exists } diff --git a/apparmor.d/profiles-g-l/gpartedbin b/apparmor.d/profiles-g-l/gpartedbin index e56bb5733..a82bf8b47 100644 --- a/apparmor.d/profiles-g-l/gpartedbin +++ b/apparmor.d/profiles-g-l/gpartedbin @@ -14,7 +14,9 @@ profile gpartedbin @{exec_path} { include include include + include + capability dac_override, capability dac_read_search, capability ipc_lock, capability sys_admin, @@ -44,12 +46,11 @@ profile gpartedbin @{exec_path} { @{bin}/dumpe2fs rPx, @{bin}/e2fsck rPx, @{bin}/e2image rPx, - @{bin}/fsck.btrfs rPx, - @{bin}/fsck.fat rPx, + @{bin}/fsck.* rPUx, @{bin}/lvm rPUx, @{bin}/mdadm rPUx, @{bin}/mke2fs rPx, - @{bin}/mkfs.* rPx, + @{bin}/mkfs.* rPUx, @{bin}/mkntfs rPx, @{bin}/mkswap rPx, @{bin}/mtools rPx, @@ -60,11 +61,14 @@ profile gpartedbin @{exec_path} { @{bin}/swaplabel rPx, @{bin}/swapoff rPx, @{bin}/swapon rPx, + @{bin}/tune.* rPUx, @{bin}/tune2fs rPx, @{bin}/xfs_io rPUx, @{open_path} rPx -> child-open, + /etc/fstab r, + @{HOME}/.Xauthority r, owner @{HOME}/*.htm w,