felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): add trash-strict.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-27 22:06:07 +00:00
parent 197c1bd78a
commit bdb2b396b3
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
7 changed files with 88 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

82
apparmor.d/abstractions/trash-strict Normal file
View file

@ -0,0 +1,82 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2022 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Already upstreamed. Different because recent change does not play well
# with upstream's version.
# There is no 'owner' rule on expunged folders because some internally sandboxed
# app (using bwrap) run on a different private user.
owner @{user_config_dirs}/#@{int} rwk,
owner @{user_config_dirs}/trashrc rw,
owner @{user_config_dirs}/trashrc.* rwl,
owner @{user_config_dirs}/trashrc.lock rwk,
owner @{run}/user/@{uid}/#@{int} rw,
owner @{run}/user/@{uid}/trash.so*.@{int}.slave-socket rwl,
# Home trash location
owner @{user_share_dirs}/Trash/ rw,
owner @{user_share_dirs}/Trash/#@{int} rw,
owner @{user_share_dirs}/Trash/directorysizes{,.*} rwl -> @{user_share_dirs}/Trash/#@{int},
owner @{user_share_dirs}/Trash/files/{,**} rw,
owner @{user_share_dirs}/Trash/info/ rw,
owner @{user_share_dirs}/Trash/info/*.trashinfo{,.*} rw,
@{user_share_dirs}/Trash/expunged/ rw,
@{user_share_dirs}/Trash/expunged/@{int} rw,
@{user_share_dirs}/Trash/expunged/@{int}/ rw,
@{user_share_dirs}/Trash/expunged/@{int}/** rw,
# Partitions' trash location when the admin creates the .Trash/ folder in the top lvl dir
owner @{MOUNTS}/.Trash/ rw,
owner @{MOUNTS}/.Trash/@{uid}/ rw,
owner @{MOUNTS}/.Trash/@{uid}/#@{int} rw,
owner @{MOUNTS}/.Trash/@{uid}/directorysizes{,.*} rwl -> @{MOUNTS}/.Trash/@{uid}/#@{int},
owner @{MOUNTS}/.Trash/@{uid}/files/{,**} rw,
owner @{MOUNTS}/.Trash/@{uid}/info/ rw,
owner @{MOUNTS}/.Trash/@{uid}/info/*.trashinfo{,.*} rw,
@{MOUNTS}/.Trash/@{uid}/expunged/ rw,
@{MOUNTS}/.Trash/@{uid}/expunged/@{int} rw,
@{MOUNTS}/.Trash/@{uid}/expunged/@{int}/ rw,
@{MOUNTS}/.Trash/@{uid}/expunged/@{int}/** rw,
# Partitions' trash location when the admin doesn't create the .Trash/ folder in the top lvl dir
owner @{MOUNTS}/.Trash-@{uid}/ rw,
owner @{MOUNTS}/.Trash-@{uid}/#@{int} rw,
owner @{MOUNTS}/.Trash-@{uid}/directorysizes{,.*} rwl -> @{MOUNTS}/.Trash-@{uid}/#@{int},
owner @{MOUNTS}/.Trash-@{uid}/files/{,**} rw,
owner @{MOUNTS}/.Trash-@{uid}/info/ rw,
owner @{MOUNTS}/.Trash-@{uid}/info/*.trashinfo{,.*} rw,
@{MOUNTS}/.Trash-@{uid}/expunged/ rw,
@{MOUNTS}/.Trash-@{uid}/expunged/@{int} rw,
@{MOUNTS}/.Trash-@{uid}/expunged/@{int}/ rw,
@{MOUNTS}/.Trash-@{uid}/expunged/@{int}/** rw,
# Removable media's trash location when the admin creates the .Trash/ folder in the top lvl dir
owner @{MOUNTS}/*/.Trash/ rw,
owner @{MOUNTS}/*/.Trash/@{uid}/ rw,
owner @{MOUNTS}/*/.Trash/@{uid}/#@{int} rw,
owner @{MOUNTS}/*/.Trash/@{uid}/directorysizes{,.*} rwl -> @{MOUNTS}/*/.Trash/@{uid}/#@{int},
owner @{MOUNTS}/*/.Trash/@{uid}/files/{,**} rw,
owner @{MOUNTS}/*/.Trash/@{uid}/info/ rw,
owner @{MOUNTS}/*/.Trash/@{uid}/info/*.trashinfo{,.*} rw,
@{MOUNTS}/*/.Trash/@{uid}/expunged/ rw,
@{MOUNTS}/*/.Trash/@{uid}/expunged/@{int} rw,
@{MOUNTS}/*/.Trash/@{uid}/expunged/@{int}/ rw,
@{MOUNTS}/*/.Trash/@{uid}/expunged/@{int}/** rw,
# Removable media's trash location when the admin doesn't create the .Trash/ folder in the top lvl dir
owner @{MOUNTS}/*/.Trash-@{uid}/ rw,
owner @{MOUNTS}/*/.Trash-@{uid}/#@{int} rw,
owner @{MOUNTS}/*/.Trash-@{uid}/directorysizes{,.*} rwl -> @{MOUNTS}/*/.Trash-@{uid}/#@{int},
owner @{MOUNTS}/*/.Trash-@{uid}/files/{,**} rw,
owner @{MOUNTS}/*/.Trash-@{uid}/info/ rw,
owner @{MOUNTS}/*/.Trash-@{uid}/info/*.trashinfo{,.*} rw,
@{MOUNTS}/*/.Trash-@{uid}/expunged/ rw,
@{MOUNTS}/*/.Trash-@{uid}/expunged/@{int} rw,
@{MOUNTS}/*/.Trash-@{uid}/expunged/@{int}/ rw,
@{MOUNTS}/*/.Trash-@{uid}/expunged/@{int}/** rw,
include if exists <abstractions/trash-strict.d>