felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update. See #101

Browse source
This commit is contained in:
Alexandre Pujol 2023-01-15 17:15:26 +00:00
parent f20aa4f548
commit c59a40ec4e
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
28 changed files with 64 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

13
apparmor.d/groups/bus/dbus-daemon
View file

@ -40,16 +40,15 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/ r,
@{libexec}/* rPUx,
/{usr/,}lib/ibus/ibus-* rPx,
/{usr/,}bin/[a-z0-9]* rPUx,
/{usr/,}lib/dbus-1.0/dbus-daemon-launch-helper rPx,
# Xubuntu
/{usr/,}lib/@{multiarch}/xfce4/xfconf/xfconfd rPUx,
/{usr/,}lib/@{multiarch}/tumbler-1/tumblerd rPUx,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters rPx,
/{usr/,}lib/@{multiarch}/xfce4/xfconf/xfconfd rPUx,
/{usr/,}lib/dbus-1.0/dbus-daemon-launch-helper rPx,
/{usr/,}lib/ibus/ibus-* rPx,
/{usr/,}lib/telepathy/mission-control-5 rPx,
/usr/share/gnome-documents/org.gnome.Documents rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters rPx,
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx,
/etc/dbus-1/{,**} r,

2
apparmor.d/groups/children/child-pager
View file

@ -32,7 +32,9 @@ profile child-pager {
owner @{HOME}/ r,
owner @{HOME}/.lesshs* rw,
owner @{HOME}/.terminfo/[0-9]*/* r,
owner @{user_cache_dirs}/lesshs* rw,
owner @{user_state_dirs}/ r,
owner @{user_state_dirs}/lesshs* rw,
include if exists <local/child-pager>

2
apparmor.d/groups/freedesktop/pipewire
View file

@ -61,7 +61,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/pipewire-[0-9]*.lock rwk,
@{run}/udev/data/c236:[0-9]* r,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c81:[0-9]* r, # For video4linux

3
apparmor.d/groups/freedesktop/xdg-settings
View file

@ -33,14 +33,15 @@ profile xdg-settings @{exec_path} {
/{usr/,}bin/xdg-mime rPx,
/{usr/,}bin/xprop rPx,
/usr/share/applications/{,*} r,
/usr/share/terminfo/x/xterm-256color r,
/usr/share/applications/ r,
/usr/share/ubuntu/applications/ r,
/etc/xdg/xfce4/helpers.rc r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
/var/lib/flatpak/exports/share/applications/{,*} r,
/var/lib/snapd/desktop/applications/{,*} r,
owner @{HOME}/ r,

3
apparmor.d/groups/freedesktop/xhost
View file

@ -24,5 +24,8 @@ profile xhost @{exec_path} {
/dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
# Silencer
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/xhost>
}

4
apparmor.d/groups/freedesktop/xrdb
View file

@ -16,6 +16,7 @@ profile xrdb @{exec_path} {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{,@{multiarch}-}cpp-[0-9]* rix,
/{usr/,}bin/cpp rix,
/{usr/,}lib/gcc/@{multiarch}/[0-9]*/cc1 rix,
/{usr/,}lib/llvm-[0-9]*/bin/clang rix,
@ -27,7 +28,6 @@ profile xrdb @{exec_path} {
owner @{HOME}/.Xresources r,
owner @{user_config_dirs}/.Xresources r,
owner @{user_config_dirs}/Xresources/.Xresources r,
# If the .Xresources file includes some additional files
owner @{user_config_dirs}/Xresources/* r,
owner /tmp/xauth-[0-9]*-_[0-9] r,
@ -37,6 +37,8 @@ profile xrdb @{exec_path} {
owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
/dev/tty rw,
include if exists <local/xrdb>
}

9
apparmor.d/groups/gnome/gnome-characters
View file

@ -10,9 +10,13 @@ include <tunables/global>
profile gnome-characters @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gnome>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/vulkan>
@{exec_path} mr,
@ -22,6 +26,7 @@ profile gnome-characters @{exec_path} {
/usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService.*.gresource r,
/usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r,
/usr/share/libdrm/*.ids r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r,

2
apparmor.d/groups/gnome/gnome-contacts-search-provider
View file

@ -20,6 +20,8 @@ profile gnome-contacts-search-provider @{exec_path} {
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/mime/mime.cache r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
owner @{user_share_dirs}/mime/mime.cache r,
owner @{user_share_dirs}/folks/relationships.ini r,

3
apparmor.d/groups/gnome/gnome-control-center
View file

@ -153,8 +153,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+pci* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c235:[0-9]* r,
@{run}/udev/data/c236:[0-9]* r,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/n[0-9]* r,

6
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -166,6 +166,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/parcellite rPUx,
/{usr/,}bin/pkcs11-register rPx,
/{usr/,}bin/snap rPUx,
/{usr/,}bin/snapshot-detect rPUx,
/{usr/,}bin/spice-vdagent rPx,
/{usr/,}bin/start-pulseaudio-x11 rPx,
/{usr/,}bin/ubuntu-report rPx,
@ -176,6 +177,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/{usr/,}lib/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
/{usr/,}lib/caribou/caribou rPUx,
/{usr/,}lib/update-notifier/ubuntu-advantage-notification rPx,
/{usr/,}lib/xapps/sn-watcher/* rPUx,
/{usr/,}share/libpam-kwallet-common/pam_kwallet_init rPUx,
@{libexec}/deja-dup/deja-dup-monitor rPUx,
@{libexec}/evolution-data-server/evolution-alarm-notify rPx,
@ -209,8 +211,9 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm{3,}/.local/share/session_migration-* r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
/var/lib/flatpak/exports/share/applications/{,**} r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
owner /tmp/dirs-?????? rw,
@ -224,6 +227,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/user-dirs.locale r,
owner @{user_share_dirs}/applications/ r,
owner @{user_share_dirs}/applications/defaults.list r,
owner @{user_share_dirs}/applications/mimeapps.list r,
owner @{user_share_dirs}/applications/mimeinfo.cache r,
owner @{user_share_dirs}/gnome-shell/gnome-overrides-migrated rw,
owner @{user_share_dirs}/mime/mime.cache r,

1
apparmor.d/groups/gnome/nautilus
View file

@ -43,6 +43,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/firejail rPUx,
/{usr/,}bin/bwrap rPUx,
/{usr/,}lib/gio-launch-desktop rPx -> child-open,
/usr/share/*ubuntu/applications/{,**} r,

4
apparmor.d/groups/gnome/tracker-extract
View file

@ -86,6 +86,7 @@ profile tracker-extract @{exec_path} {
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/flatpak/exports/share/applications/mimeinfo.cache r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
/var/lib/snapd/desktop/applications/*.desktop r,
# Allow to search user files
@ -101,8 +102,7 @@ profile tracker-extract @{exec_path} {
@{run}/blkid/blkid.tab r,
@{run}/udev/data/c235:* r,
@{run}/udev/data/c236:* r,
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/mount/utab r,

3
apparmor.d/groups/gpg/gpg
View file

@ -33,6 +33,9 @@ profile gpg @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
owner @{HOME}/.var/app/**/gnupg*/** rw,
owner @{HOME}/.var/app/**/gnupg*/** rwkl -> @{HOME}/.var/app/**/gnupg*/**,
owner @{user_projects_dirs}/**/gnupg/ rw,
owner @{user_projects_dirs}/**/gnupg/** rwkl -> @{user_projects_dirs}/**/gnupg/**,

1
apparmor.d/groups/gpg/gpgconf
View file

@ -26,6 +26,7 @@ profile gpgconf @{exec_path} {
/{usr/,}bin/pinentry-* rPx,
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
owner @{run}/user/@{uid}/gnupg/** rwkl -> @{run}/user/@{uid}/gnupg/**,
owner @{user_projects_dirs}/**/gnupg/** rwkl -> @{user_projects_dirs}/**/gnupg/**,
owner @{PROC}/@{pid}/task/@{tid}/stat rw,

2
apparmor.d/groups/gvfs/gvfsd-smb-browse
View file

@ -55,6 +55,8 @@ profile gvfsd-smb-browse @{exec_path} {
/etc/samba/smb.conf r,
/var/cache/samba/ rw,
owner @{run}/samba/ rw,
owner @{run}/samba/gencache.tdb rwk,
owner @{run}/user/@{uid}/gvfsd/socket-[a-zA-z0-9]* rw,

4
apparmor.d/groups/systemd/systemd-coredump
View file

@ -33,9 +33,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
/etc/systemd/coredump.conf r,
/var/lib/systemd/coredump/ r,
owner /var/lib/systemd/coredump/#[0-9]* rwl,
owner /var/lib/systemd/coredump/core.*.zst rwl,
/var/lib/systemd/coredump/{,**} rwl,
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/cmdline r,

3
apparmor.d/groups/systemd/systemd-sleep
View file

@ -21,8 +21,9 @@ profile systemd-sleep @{exec_path} {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/nvidia-sleep.sh rix,
/{usr/,}lib/systemd/system-sleep/nvidia rix,
/{usr/,}lib/systemd/system-sleep/hdparm rix,
/{usr/,}lib/systemd/system-sleep/nvidia rix,
/{usr/,}lib/systemd/system-sleep/sysstat.sleep rPUx,
/{usr/,}lib/systemd/system-sleep/unattended-upgrades rix,
/etc/systemd/sleep.conf r,

2
apparmor.d/groups/virt/libvirtd
View file

@ -206,7 +206,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
@{sys}/kernel/mm/hugepages/{,**} r,
@{sys}/kernel/security/apparmor/profiles r,
@{sys}/module/kvm_intel/parameters/nested r,
@{sys}/module/kvm_*/parameters/* r,
@{sys}/module/vhost/parameters/max_mem_regions r,
@{sys}/fs/cgroup/ r,