felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update freedesktop profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-11 23:32:29 +02:00
parent d32fd03650
commit c7e999fe30
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
8 changed files with 19 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -21,9 +21,9 @@ profile pulseaudio @{exec_path} {
include <abstractions/camera>
include <abstractions/consoles>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/dri>
include <abstractions/fontconfig-cache-write>
include <abstractions/desktop>
include <abstractions/gstreamer>
include <abstractions/hosts_access>
include <abstractions/media-control>

2
apparmor.d/groups/freedesktop/wireplumber
View file

@ -27,6 +27,7 @@ profile wireplumber @{exec_path} {
network netlink raw,
#aa:dbus own bus=session name=org.freedesktop.ReserveDevice1.Audio@{int}
#aa:dbus own bus=session name=org.pipewire.Telephony
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
@ -77,6 +78,7 @@ profile wireplumber @{exec_path} {
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/meminfo r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/board_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,

3
apparmor.d/groups/freedesktop/xdg-dbus-proxy
View file

@ -21,6 +21,9 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
network unix stream,
#aa:dbus talk bus=session name=org.freedesktop.portal.Flatpak label=flatpak-portal
#aa:dbus talk bus=session name=org.freedesktop.portal.Request path=/org/freedesktop/portal/desktop label=xdg-desktop-portal
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.portal.Realtime
member=MakeThread*

2
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -52,6 +52,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor
#aa:dbus talk bus=session name=org.freedesktop.impl.portal.Inhibit label=xdg-desktop-portal-gtk
#aa:dbus talk bus=session name=org.freedesktop.FileManager1 label=nautilus
#aa:dbus talk bus=session name=org.freedesktop.impl.portal.FileChooser label=xdg-desktop-portal-gnome
#aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal
@ -101,6 +102,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{PROC}/ r,
@{PROC}/@{pids}/status r,
@{PROC}/*/ r,
@{PROC}/1/cgroup r,
@{PROC}/cmdline r,

10
apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
View file

@ -16,6 +16,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.Accounts>
include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/bus/org.gnome.Shell.Introspect>
include <abstractions/bus/org.gtk.vfs.Daemon>
include <abstractions/bus/org.gtk.vfs.MountTracker>
include <abstractions/consoles>
include <abstractions/dconf-write>
@ -24,6 +25,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
include <abstractions/gnome-strict>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/notifications>
include <abstractions/user-download-strict>
network unix stream,
@ -36,17 +38,13 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
#aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell
#aa:dbus talk bus=session name=org.gnome.Settings.GlobalShortcutsProvider label=gnome-control-center-global-shortcuts-provider
#aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell
#aa:dbus talk bus=session name=org.gtk.Private.RemoteVolumeMonitor label="gvfs-*-volume-monitor"
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Background
member=RunningApplicationsChanged
peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal),
dbus send bus=session path=/org/gtk/Notifications
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gnome/Shell
interface=org.freedesktop.DBus.Properties
member=GetAll
@ -85,6 +83,8 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
owner @{tmp}/gtkprint@{rand6} r,
owner @{tmp}/xdg-desktop-portal-gnome@{rand6} rw,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
@{run}/mount/utab r,
owner @{PROC}/@{pid}/ r,

12
apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
View file

@ -35,18 +35,12 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=session name=org.freedesktop.impl.portal.desktop.gtk
#aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs
#aa:dbus talk bus=session name=org.freedesktop.impl.portal.Settings label=xdg-desktop-portal
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Settings
peer=(name=:*),
dbus send bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Settings
member=SettingChanged
peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal),
dbus send bus=session path=/org/gtk/Notifications
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,

2
apparmor.d/groups/freedesktop/xdg-settings
View file

@ -15,7 +15,7 @@ profile xdg-settings @{exec_path} flags=(attach_disconnected) {
@{exec_path} r,
@{sh_path} r,
@{sh_path} mr,
@{bin}/{,e}grep rix,
@{bin}/basename rix,
@{bin}/cat ix,

3
apparmor.d/groups/freedesktop/xorg
View file

@ -133,8 +133,9 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
@{PROC}/ioports r,
@{PROC}/mtrr rw,
/dev/ r,
/dev/fb@{int} rw,
/dev/input/event@{int} rw,
@{att}/dev/input/event@{int} rw,
/dev/input/mouse@{int} rw,
/dev/shm/#@{int} rw,
/dev/shm/shmfd-* rw,