felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): start using the new bwrap abs.

Browse source
This commit is contained in:
Alexandre Pujol 2024-02-28 23:52:15 +00:00
parent cbbb2b4a3e
commit cda8f30c29
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 4 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

22
apparmor.d/profiles-s-z/steam-game
View file

@ -24,6 +24,7 @@ include <tunables/global>
profile steam-game @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bwrap>
include <abstractions/desktop>
include <abstractions/devices-usb>
include <abstractions/fontconfig-cache-write>
@ -34,9 +35,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
capability dac_override,
capability dac_read_search,
capability setpcap,
capability sys_admin,
capability sys_ptrace,
network inet dgram,
network inet6 dgram,
@ -44,16 +42,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
network inet6 stream,
network netlink raw,
mount options=(rw, silent, rslave) -> /,
mount fstype=tmpfs -> /tmp/,
mount -> /newroot/{,**},
mount -> /oldroot/,
mount -> /tmp/newroot/,
umount /{,oldroot/},
pivot_root oldroot=/newroot/ -> /newroot/,
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
signal (receive) peer=steam,
unix (receive) type=stream,
@ -122,8 +110,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
/etc/udev/udev.conf r,
/var/lib/dbus/machine-id r,
/newroot/{,**} rw,
/var/cache/ldconfig/aux-cache* rw,
/ r,
@ -206,21 +192,15 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/net/dev r,
@{PROC}/@{pids}/net/route r,
@{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r,
@{PROC}/uptime r,
@{PROC}/version r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/gid_map rw,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/setgroups rw,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/uid_map rw,
/dev/hidraw@{int} rw,
/dev/input/ r,