felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

New profile for Microsoft Edge and better support in abstractions/app/chromium

Browse source 
This commit add new profile for Microsoft Edge browser and variants (beta,dev).
The new profile is based in actual chrome profile. Tested with actual Edge, in
Debian Stable and enforced rules. All ok using GPU Rasterization and Vulkan, not
HWAccel for encoding video because this is very unstable yet in all Chromium based
browsers.

Add support for libpam-tmpdir for abstractions/app/chromium and all browser using
this absctractions (Chrome, Chromium, Edge, and others). This fix access and use
of browser with libpam-tmpdir installed (Debian and Whonix)

Fix a denied access to RADV user cache (Vulkan-amdgpu) in abstractions/app/chromium
(Vulkan is optional in Chromium-based browser, but the backend is
perfectly usable now).
This commit is contained in:
Jose Maldonado aka Yukiteru 2024-04-28 17:09:07 -04:00 • committed by Alex
parent 065f2233ac
commit d0ea5f50a3
6 changed files with 152 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/abstractions/app/chromium
View file

@ -158,6 +158,10 @@
owner /tmp/tmp.*/ rw,
owner /tmp/tmp.*/** rwk,
# libpam-tmpdir support
owner /tmp/user/@{uid}/ rw,
owner /tmp/user/@{uid}/** rwk,
/dev/shm/ r,
owner /dev/shm/.@{domain}* rw,

4
apparmor.d/abstractions/vulkan-strict
View file

@ -15,6 +15,7 @@
/etc/vulkan/implicit_layer.d/{,*.json} r,
owner @{user_share_dirs}/vulkan/implicit_layer.d/{,*.json} r,
owner @{user_cache_dirs}/radv_builtin_shaders64 r, #Vulkan radv shaders cache
@{sys}/class/ r,
@{sys}/class/drm/ r,
@ -23,4 +24,5 @@
@{sys}/devices/@{pci}/drm/card@{int}/metrics/ r,
@{sys}/devices/@{pci}/drm/card@{int}/metrics/@{uuid}/id r,
include if exists <abstractions/vulkan-strict.d>
include if exists <abstractions/vulkan-strict.d>