diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index 3875f3c90..7b30bda99 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -3,8 +3,9 @@ # Copyright (C) 2021-2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - /etc/writable/localtime r, - /usr/share/locale/ r, + /usr/share/locale/ r, + + @{etc_rw}/localtime r, # Allow to receive some signals signal (receive) peer=htop, diff --git a/apparmor.d/abstractions/gtk.d/complete b/apparmor.d/abstractions/gtk.d/complete index a1d6690a4..d6bcefee1 100644 --- a/apparmor.d/abstractions/gtk.d/complete +++ b/apparmor.d/abstractions/gtk.d/complete @@ -4,11 +4,6 @@ abi , - /usr/share/gtk-{3,4}.0/ r, - /usr/share/gtk-{3,4}.0/settings.ini r, - - /etc/gtk-{3,4}.0/ r, - /etc/gtk-{3,4}.0/*.conf r, /etc/gtk-{3,4}.0/settings.ini r, owner @{user_config_dirs}/gtk-{3,4}.0/ rw, diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index 3307131da..a710755f3 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -9,6 +9,3 @@ /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw, /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/@{hex} rw, /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/@{hex}.tmp rwk, - - @{sys}/devices/pci[0-9]*/**/revision r, - @{sys}/devices/pci[0-9]*/**/config r, diff --git a/apparmor.d/abstractions/nvidia.d/complete b/apparmor.d/abstractions/nvidia.d/complete index 74f458251..499d75ab4 100644 --- a/apparmor.d/abstractions/nvidia.d/complete +++ b/apparmor.d/abstractions/nvidia.d/complete @@ -2,11 +2,8 @@ # Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - owner @{user_cache_dirs}/nvidia/ w, - owner @{user_cache_dirs}/nvidia/GLCache/ rw, - owner @{user_cache_dirs}/nvidia/GLCache/** rwk, - owner @{HOME}/.nv/nvidia-application-profiles-rc r, + owner @{HOME}/.nv/nvidia-application-profiles* r, - /etc/nvidia/nvidia-application-profiles-rc r, + /etc/nvidia/nvidia-application-profiles* r, unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"), diff --git a/apparmor.d/abstractions/python.d/complete b/apparmor.d/abstractions/python.d/complete index b5427859b..0a3335253 100644 --- a/apparmor.d/abstractions/python.d/complete +++ b/apparmor.d/abstractions/python.d/complete @@ -4,12 +4,9 @@ # SPDX-License-Identifier: GPL-2.0-only /{usr/,}bin/ r, + /{usr/,}bin/python{2.[4-7],3,3.[0-9],3.1[0-9]} r, - /{usr/,}bin/python{2.[4-7],3,3.[0-9]*} r, - - /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]*}/{site,dist}-packages/{,**/} r, - - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9]*}/**.{pyc,so} mr, - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9]*}/**.{egg,py,pth} r, - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9]*}/{site,dist}-packages/ r, - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9]*}/{site,dist}-packages/**/ r, + owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so} mr, + owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r, + owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r, + owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r, diff --git a/apparmor.d/abstractions/ssl_certs.d/complete b/apparmor.d/abstractions/ssl_certs.d/complete deleted file mode 100644 index 0bab5773c..000000000 --- a/apparmor.d/abstractions/ssl_certs.d/complete +++ /dev/null @@ -1,13 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - - /etc/ca-certificates/{,**} r, - /etc/{,libre}ssl/ r, - /etc/{,libre}ssl/cert.pem r, - /etc/{,libre}ssl/certs/{,**} r, - /etc/pki/trust/{,*} r, - /etc/pki/trust/anchors/{,**} r, - /usr/share/ca-certificates/{,**} r, - /usr/local/share/ca-certificates/{,**} r, - /var/lib/ca-certificates/{,**} r, diff --git a/apparmor.d/abstractions/wayland.d/complete b/apparmor.d/abstractions/wayland.d/complete deleted file mode 100644 index 43bb91c9a..000000000 --- a/apparmor.d/abstractions/wayland.d/complete +++ /dev/null @@ -1,8 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2020-2022 Mikhail Morfikov -# Copyright (C) 2021-2022 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - - owner @{run}/user/@{uid}/wayland-[0-9]* rw, - @{run}/user/@{uid}/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw, - owner /dev/shm/wlroots-* rw,