felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): improve dbus integration.

Browse source
This commit is contained in:
Alexandre Pujol 2023-07-20 21:00:41 +01:00
parent 33a9b062ff
commit d2a650f6c6
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
19 changed files with 77 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/abstractions/dconf-write
View file

@ -5,6 +5,16 @@
# Permissions for querying dconf settings with write access; use the dconf
# abstraction first, and dconf-write only for specific application's profile.
dbus send bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Change
peer=(name=ca.desrt.dconf), # no peer's labels
dbus receive bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Notify
peer=(name=:*, label=dconf-service),
/etc/dconf/** r,
owner @{user_config_dirs}/dconf/user r,

52
apparmor.d/abstractions/gstreamer
View file

@ -1,32 +1,40 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@{lib}/frei0r-[0-9]/*.so mr,
@{lib}/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner{,x86_64} mrix,
@{lib}/@{multiarch}/gstreamer[0-9]*.[0-9]*/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner{,x86_64} mrix,
@{lib}/@{multiarch}/libproxy/*/modules/*.so mr,
@{lib}/@{multiarch}/libproxy/*/pxgsettings ixr,
@{lib}/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr,
/etc/openni2/OpenNI.ini r,
/tmp/ r,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*/ rw,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
/tmp/ r,
/var/tmp/ r,
/dev/ r,
/dev/bus/usb/ r,
/dev/dri/ r,
# The orcexec.* file is JIT compiled code for various GStreamer elements.
# If one is blocked the next is used instead.
# The orcexec file is placed under /home/user/ also when the /tmp/ dir is mounted with the noexec flag.
owner @{run}/user/@{uid}/orcexec.* mrw,
#owner /tmp/orcexec.* mrw,
#owner @{HOME}/orcexec.* mrw,
# /dev/shm is a symlink to /run/shm on ubuntu
#owner /{dev,run}/shm/shmfd-* rw,
@{run}/udev/data/+drm:* r, # For screen outputs
@{run}/udev/data/+usb:* r, # For /dev/bus/usb/**
#
@{run}/udev/data/c81:[0-9]* r, # For video4linux
@{run}/udev/data/c189:[0-9]* r, # For USB serial converters
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card[0-9]*
@{run}/udev/data/+drm:* r, # For screen outputs
#@{run}/udev/data/+pci:* r,
@{run}/udev/data/+usb:* r, # For /dev/bus/usb/**
@{sys}/bus/ r,
@{sys}/bus/usb/devices/ r,
@{sys}/bus/media/devices/ r,
@{sys}/bus/usb/devices/ r,
@{sys}/class/ r,
@{sys}/class/drm/ r,
@{sys}/class/video4linux/ r,
@ -34,22 +42,8 @@
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node[0-9]*/meminfo r,
# The orcexec.* file is JIT compiled code for various GStreamer elements.
# If one is blocked the next is used instead.
# The orcexec file is placed under /home/user/ also when the /tmp/ dir is mounted with the noexec
# flag.
owner @{run}/user/@{uid}/orcexec.* mrw,
#owner /tmp/orcexec.* mrw,
#owner @{HOME}/orcexec.* mrw,
@{lib}/frei0r-[0-9]/*.so mr,
@{lib}/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner mrix,
@{lib}/@{multiarch}/gstreamer[0-9]*.[0-9]*/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner mrix,
@{lib}/@{multiarch}/libproxy/*/modules/*.so mr,
@{lib}/@{multiarch}/libproxy/*/pxgsettings ixr,
@{lib}/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*/ rw,
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
/dev/ r,
/dev/bus/usb/ r,
/dev/dri/ r,
include if exists <abstractions/gstreamer.d>