felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update kde profiles

Browse source 
see #811
This commit is contained in:
Alexandre Pujol 2025-08-15 10:34:48 +02:00
parent e09586e01d
commit c02674593d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
12 changed files with 32 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

16
apparmor.d/groups/freedesktop/xdg-desktop-portal-kde
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile xdg-desktop-portal-kde @{exec_path} {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/devices-usb-read>
include <abstractions/graphics>
include <abstractions/kde-globals-write>
include <abstractions/kde-strict>
@ -30,6 +31,12 @@ profile xdg-desktop-portal-kde @{exec_path} {
#aa:exec kioworker
/usr/share/plasma/look-and-feel/** r,
/usr/share/thumbnailers/{,**} r,
/etc/fstab r,
/etc/xdg/dolphinrc r,
/ r,
owner @{HOME}/ r,
@ -39,12 +46,21 @@ profile xdg-desktop-portal-kde @{exec_path} {
owner @{user_config_dirs}/autostart/org.kde.*.desktop r,
owner @{user_config_dirs}/breezerc r,
owner @{user_config_dirs}/kioslaverc r,
owner @{user_config_dirs}/kservicemenurc r,
owner @{user_config_dirs}/xdg-desktop-portal-kderc{,.*} rwlk,
owner @{user_state_dirs}/#@{int} rw,
owner @{user_state_dirs}/xdg-desktop-portal-kdestaterc rw,
owner @{user_state_dirs}/xdg-desktop-portal-kdestaterc.@{rand6} rwlk,
owner @{user_state_dirs}/xdg-desktop-portal-kdestaterc.lock rwk,
owner @{run}/user/@{uid}/#@{int} rw,
owner @{run}/user/@{uid}/xdg-desktop-portal-kde@{rand6}.*.socket rw,
owner @{PROC}/@{pid}/mountinfo r,
/dev/shm/ r,
/dev/tty r,
include if exists <local/xdg-desktop-portal-kde>

5
apparmor.d/groups/kde/kalendarac
View file

@ -34,6 +34,11 @@ profile kalendarac @{exec_path} {
owner @{user_config_dirs}/kalendaracrc.lock rwk,
owner @{user_config_dirs}/kmail2rc r,
owner @{user_state_dirs}/#@{int} rw,
owner @{user_state_dirs}/kalendaracstaterc rw,
owner @{user_state_dirs}/kalendaracstaterc.@{rand6} rwl,
owner @{user_state_dirs}/kalendaracstaterc.lock rwk,
/dev/tty r,
include if exists <local/kalendarac>

1
apparmor.d/groups/kde/kded
View file

@ -84,6 +84,7 @@ profile kded @{exec_path} {
/var/lib/dbus/machine-id r,
/ r,
@{efi}/ r,
owner @{HOME}/ r,
owner @{HOME}/.gtkrc-2.0 rw,

4
apparmor.d/groups/kde/kglobalacceld
View file

@ -18,15 +18,11 @@ profile kglobalacceld @{exec_path} {
/usr/share/kglobalaccel/{,**} r,
/etc/machine-id r,
/etc/xdg/menus/ r,
/etc/xdg/menus/applications-merged/ r,
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk,
owner @{user_config_dirs}/kglobalshortcutsrc* rwl,
owner @{user_config_dirs}/khotkeysrc r,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
@{PROC}/sys/kernel/random/boot_id r,

3
apparmor.d/groups/kde/ksmserver
View file

@ -49,9 +49,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{user_config_dirs}/ksmserverrc rw,
owner @{user_config_dirs}/ksmserverrc.@{rand6} rwl,
owner @{user_config_dirs}/ksmserverrc.lock rwk,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_config_dirs}/session/*_[0-9]*_[0-9]*_[0-9]* rw,
owner @{user_share_dirs}/kservices{5,6}/ r,
owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r,

3
apparmor.d/groups/kde/kwalletmanager
View file

@ -36,9 +36,6 @@ profile kwalletmanager @{exec_path} {
owner @{user_config_dirs}/kwalletrc rw,
owner @{user_config_dirs}/kwalletrc.* rwl -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/kwalletrc.lock rwk,
owner @{user_config_dirs}/session/#@{int} rw,
owner @{user_config_dirs}/session/kwalletmanager5_* rwl -> @{user_config_dirs}/session/#@{int},
owner @{user_config_dirs}/session/kwalletmanager5_*.lock rwk,
@{PROC}/@{pid}/mountinfo r,
@{PROC}/@{pid}/mounts r,

5
apparmor.d/groups/kde/kwin_x11
View file

@ -25,10 +25,12 @@ profile kwin_x11 @{exec_path} {
@{exec_path} mrix,
@{sh_path} rix,
@{bin}/kdialog rix,
@{lib}/kwin_killer_helper rix,
#aa:exec drkonqi
/usr/share/kwin-x11/{,**} r,
/usr/share/kwin/{,**} r,
/usr/share/plasma/desktoptheme/{,**} r,
@ -47,6 +49,7 @@ profile kwin_x11 @{exec_path} {
owner @{user_cache_dirs}/session/#@{int} rw,
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/kaccessrc r,
owner @{user_config_dirs}/kdedefaults/plasmarc r,
owner @{user_config_dirs}/kwinoutputconfig.json rw,
owner @{user_config_dirs}/kwinrc.lock rwk,
@ -54,8 +57,6 @@ profile kwin_x11 @{exec_path} {
owner @{user_config_dirs}/kwinrulesrc r,
owner @{user_config_dirs}/kxkbrc r,
owner @{user_config_dirs}/plasmarc r,
owner @{user_config_dirs}/session/#@{int} rw,
owner @{user_config_dirs}/session/kwin_* rwk,
owner @{user_share_dirs}/kwin/scripts/ r,

14
apparmor.d/groups/kde/okular
View file

@ -42,8 +42,6 @@ profile okular @{exec_path} {
/etc/fstab r,
/etc/xdg/dolphinrc r,
/etc/xdg/menus/ r,
/etc/xdg/menus/applications-merged/ r,
/ r,
@{MOUNTS}/ r,
@ -51,19 +49,17 @@ profile okular @{exec_path} {
owner @{user_cache_dirs}/okular/{,**} rw,
owner @{user_config_dirs}/#@{int} rw,
owner @{user_config_dirs}/KDE/*.conf r,
owner @{user_config_dirs}/kioslaverc r,
owner @{user_config_dirs}/kservicemenurc r,
owner @{user_config_dirs}/kwalletrc r,
owner @{user_config_dirs}/okular-generator-popplerrc r,
owner @{user_config_dirs}/okularpartrc rw,
owner @{user_config_dirs}/okularpartrc.@{rand6} rwl -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/okularpartrc.lock rwk,
owner @{user_config_dirs}/okularrc rw,
owner @{user_config_dirs}/okularrc.@{rand6} rwl -> @{user_config_dirs}/#@{int},
owner @{user_config_dirs}/okularrc.lock rwk,
owner @{user_config_dirs}/okular-generator-popplerrc r,
owner @{user_config_dirs}/KDE/*.conf r,
owner @{user_config_dirs}/kioslaverc r,
owner @{user_config_dirs}/kservicemenurc r,
owner @{user_config_dirs}/kwalletrc r,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_share_dirs}/#@{int} rw,
owner @{user_share_dirs}/kxmlgui{5,6}/okular/{,*} r,

6
apparmor.d/groups/kde/plasma-browser-integration-host
View file

@ -21,16 +21,10 @@ profile plasma-browser-integration-host @{exec_path} {
@{exec_path} mr,
/etc/xdg/menus/applications-merged/ r,
/usr/share/kservices{5,6}/{,**} r,
/etc/xdg/menus/ r,
/etc/xdg/taskmanagerrulesrc r,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_share_dirs}/kservices{5,6}/ r,
owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r,

1
apparmor.d/groups/kde/plasma_session
View file

@ -36,7 +36,6 @@ profile plasma_session @{exec_path} {
/etc/xdg/autostart/ r,
/etc/xdg/autostart/*.desktop r,
/etc/xdg/menus/ r,
owner @{user_config_dirs}/kdedefaults/ksplashrc r,
owner @{user_config_dirs}/plasma-welcomerc r,

3
apparmor.d/groups/kde/systemsettings
View file

@ -57,7 +57,6 @@ profile systemsettings @{exec_path} {
/etc/fstab r,
/etc/machine-id r,
/etc/xdg/menus/{,applications-merged/} r,
/etc/xdg/plasmanotifyrc r,
/etc/xdg/ui/ui_standards.rc r,
/var/lib/dbus/machine-id r,
@ -90,8 +89,6 @@ profile systemsettings @{exec_path} {
owner @{user_config_dirs}/kinfocenterrc* rwlk,
owner @{user_config_dirs}/libaccounts-glib/ rw,
owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk,
owner @{user_config_dirs}/menus/ r,
owner @{user_config_dirs}/menus/applications-merged/ r,
owner @{user_config_dirs}/session/ rw,
owner @{user_config_dirs}/session/** rwlk,
owner @{user_config_dirs}/systemsettingsrc.lock rwk,

2
apparmor.d/profiles-m-r/pinentry-qt
View file

@ -17,6 +17,8 @@ profile pinentry-qt @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write>
ptrace read peer=gpg-agent,
@{exec_path} mr,
/etc/machine-id r,