felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): improve dbus integration.

Browse source
This commit is contained in:
Alexandre Pujol 2023-07-20 21:00:41 +01:00
parent 33a9b062ff
commit d2a650f6c6
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
19 changed files with 77 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/freedesktop/colord
View file

@ -50,7 +50,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/ColorManager/**
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=:*, label=@{profile_name}),
peer=(name=:*, label="{@{profile_name},gsd-color}"),
dbus bind bus=system
name=org.freedesktop.ColorManager,

1
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -13,6 +13,7 @@ profile pulseaudio @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/consoles>
include <abstractions/dbus-gtk>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>

10
apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
View file

@ -107,6 +107,16 @@ profile xdg-desktop-portal-gnome @{exec_path} {
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus receive bus=session path=/org/freedesktop/portal/desktop
interface=org.freedesktop.impl.portal.Settings
member=Read
peer=(name=:*, label=xdg-desktop-portal),
dbus receive bus=session path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect

10
apparmor.d/groups/gnome/gnome-shell
View file

@ -395,16 +395,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=gnome-extension-ding),
dbus send bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Change
peer=(name=ca.desrt.dconf), # no peer's labels
dbus receive bus=session path=/ca/desrt/dconf/Writer/user
interface=ca.desrt.dconf.Writer
member=Notify
peer=(name=:*, label=dconf-service),
dbus send bus=session path=/org/gnome/ControlCenter
interface=org.gtk.Actions
member=DescribeAll

11
apparmor.d/groups/gnome/tracker-miner
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/tracker-miner-fs-{,control-}3
profile tracker-miner @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-gtk>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/dconf-write>
@ -36,16 +37,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
member={ListMonitorImplementations,ListMountableInfo}
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus receive bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=Mounted
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
interface=org.gtk.Private.RemoteVolumeMonitor
member={List,IsSupported}

7
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View file

@ -42,12 +42,17 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
interface=org.gtk.Private.RemoteVolumeMonitor
member=MountAdded
peer=(name=org.freedesktop.DBus, label=tracker-*),
dbus receive bus=session path=/org/gtk/Private/RemoteVolumeMonitor
interface=org.gtk.Private.RemoteVolumeMonitor
member={List,IsSupported}
peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
dbus receive bus=session path=/{,org}
dbus receive bus=session path=/{,org,org/gtk,org/gtk/Private,org/gtk/Private/RemoteVolumeMonitor}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

1
apparmor.d/groups/kde/kwin_x11
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/kwin_x11
profile kwin_x11 @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>
include <abstractions/fonts>

1
apparmor.d/groups/kde/plasmashell
View file

@ -13,6 +13,7 @@ profile plasmashell @{exec_path} {
include <abstractions/audio>
include <abstractions/consoles>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/disks-read>
include <abstractions/dri-common>
include <abstractions/dri-enumerate>

5
apparmor.d/groups/network/NetworkManager
View file

@ -84,6 +84,11 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects,
dbus receive bus=system path=/org/bluez/hci*/**
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(name=:*),
dbus bind bus=system
name=org.freedesktop.NetworkManager,

1
apparmor.d/groups/ubuntu/check-new-release-gtk
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile check-new-release-gtk @{exec_path} {
include <abstractions/base>
include <abstractions/apt-common>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/fonts>

1
apparmor.d/groups/ubuntu/livepatch-notification
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/update-notifier/livepatch-notification
profile livepatch-notification @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/gtk>

1
apparmor.d/groups/ubuntu/ubuntu-advantage-notification
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/update-notifier/ubuntu-advantage-notification
profile ubuntu-advantage-notification @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/gtk>

1
apparmor.d/groups/ubuntu/update-notifier
View file

@ -11,6 +11,7 @@ profile update-notifier @{exec_path} {
include <abstractions/base>
include <abstractions/apt-common>
include <abstractions/audio>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dconf-write>
include <abstractions/fonts>