feat(profiles): general update.
This commit is contained in:
Alexandre Pujol
parent
8142ad657d
commit
c32b19a808
40 changed files with 218 additions and 196 deletions
|
|
@ -16,12 +16,17 @@ profile pulseaudio @{exec_path} {
|
|||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/hosts_access>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
signal (receive) peer=pacmd,
|
||||
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.X11-unix/*),
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.ICE-unix/*),
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
|
@ -29,65 +34,6 @@ profile pulseaudio @{exec_path} {
|
|||
network bluetooth stream,
|
||||
network bluetooth seqpacket,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}lib{exec,}/pulse/gsettings-helper mrix,
|
||||
/{usr/,}lib/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner mrix,
|
||||
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
|
||||
|
||||
# PulseAudio files
|
||||
/usr/share/pulseaudio/{,**} r,
|
||||
/{usr/,}lib/pulse-*/modules/*.so mr,
|
||||
|
||||
# PulseAudio home config files
|
||||
owner @{user_config_dirs}/pulse/{,**} rw,
|
||||
owner @{user_config_dirs}/dconf/user r,
|
||||
|
||||
owner @{user_cache_dirs}/gstreamer-1.0/registry.x86_64.bin r,
|
||||
|
||||
# Needed when PulseAudio is started via the start-pulseaudio-x11 script
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# Needed when PulseAudio is started via gdm
|
||||
owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.* r,
|
||||
owner @{HOME}/.ICEauthority r,
|
||||
|
||||
# TCP wrap
|
||||
/etc/hosts.{allow,deny} r,
|
||||
|
||||
owner @{run}/user/@{uid}/ rw,
|
||||
owner @{run}/user/@{uid}/pulse/{,*} rw,
|
||||
owner @{run}/user/@{uid}/pulse/*.lock k,
|
||||
|
||||
/usr/share/applications/{,**} r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/sound/ r,
|
||||
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,
|
||||
@{run}/udev/data/+sound* r,
|
||||
@{run}/udev/data/c116:[0-9]* r, # For ALSA
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]/meminfo r,
|
||||
|
||||
deny @{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/ICEauthority r,
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
|
||||
owner @{PROC}/@{pids}/fd/ r,
|
||||
owner @{PROC}/@{pids}/stat r,
|
||||
owner @{PROC}/@{pids}/cmdline r,
|
||||
|
||||
# DBus
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/freedesktop/DBus
|
||||
|
|
@ -139,14 +85,18 @@ profile pulseaudio @{exec_path} {
|
|||
member=GetManagedObjects
|
||||
peer=(name=org.bluez),
|
||||
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.X11-unix/*),
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.ICE-unix/*),
|
||||
@{exec_path} mrix,
|
||||
|
||||
# The orcexec.* file is JIT compiled code for various GStreamer elements.
|
||||
# If one is blocked the next is used instead.
|
||||
owner @{run}/user/@{uid}/orcexec.* mrw,
|
||||
#owner @{HOME}/orcexec.* mrw,
|
||||
#owner /tmp/orcexec.* mrw,
|
||||
/{usr/,}@{libexec}/pulse/gsettings-helper mrix,
|
||||
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
|
||||
/{usr/,}lib/pulse-*/modules/*.so mr,
|
||||
|
||||
/usr/share/applications/{,**} r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/pulseaudio/{,**} r,
|
||||
/usr/share/ubuntu/applications/{,*} r,
|
||||
|
||||
/var/lib/snapd/desktop/applications/ r,
|
||||
|
||||
# For GDM
|
||||
owner /var/lib/gdm{[1-9],}/.config/pulse/{,**} rw,
|
||||
|
|
@ -164,13 +114,42 @@ profile pulseaudio @{exec_path} {
|
|||
owner /var/lib/lightdm/.config/pulse/{,**} rw,
|
||||
owner /var/lib/lightdm/.config/pulse/cookie k,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
owner @{HOME}/.ICEauthority r,
|
||||
|
||||
owner @{user_config_dirs}/pulse/{,**} rw,
|
||||
owner @{user_config_dirs}/dconf/user r,
|
||||
|
||||
owner @{user_cache_dirs}/gstreamer-1.0/registry.x86_64.bin r,
|
||||
|
||||
owner @{run}/user/@{uid}/ rw,
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.* r,
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,
|
||||
owner @{run}/user/@{uid}/ICEauthority r,
|
||||
owner @{run}/user/@{uid}/pulse/{,*} rw,
|
||||
owner @{run}/user/@{uid}/pulse/*.lock k,
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
@{run}/udev/data/+sound* r,
|
||||
@{run}/udev/data/c116:[0-9]* r, # For ALSA
|
||||
|
||||
@{sys}/class/sound/ r,
|
||||
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,
|
||||
@{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
|
||||
|
||||
deny @{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
owner @{PROC}/@{pids}/fd/ r,
|
||||
owner @{PROC}/@{pids}/stat r,
|
||||
owner @{PROC}/@{pids}/cmdline r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# Snap
|
||||
/var/lib/snapd/desktop/applications/ r,
|
||||
/usr/{local/,}share/ubuntu/applications/{,*} r,
|
||||
|
||||
include if exists <local/pulseaudio>
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue