felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Debian 12 Gnome DE

Browse source
This commit is contained in:
nobody43 2023-09-08 14:33:32 +00:00 • committed by Alex
parent 0687c32df2
commit d414083113
34 changed files with 150 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -19,6 +19,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
capability dac_override,
capability dac_read_search,
capability fowner,
capability fsetid,
capability kill,
capability net_admin,
capability setgid,
@ -107,5 +108,10 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
/dev/tty rw,
/dev/tty@{int} rw,
# Add user; set password on first login
/etc/.pwd.lock wk,
/etc/nshadow rw,
/etc/shadow w,
include if exists <local/gdm-session-worker>
}

1
apparmor.d/groups/gnome/gnome-control-center
View file

@ -132,6 +132,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.cat_installer/ca.pem r,
owner @{HOME}/.cert/nm-openvpn/*.pem r,
owner @{HOME}/.face r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_cache_dirs}/gnome-control-center/{,**} rw,
owner @{user_cache_dirs}/thumbnails/{,**} rw,

3
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -153,9 +153,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{lib}/gnome-session-failed rix,
@{lib}/gsd-* rPx,
# TODO: rCx gio-launch-desktop and put all the following program in this
# subprofile. Not done yet as it breaks compatibility with Ubuntu/Debian
@{lib}/gio-launch-desktop rix,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
@{bin}/aa-notify rPx,
@{bin}/baloo_file rPx,

6
apparmor.d/groups/gnome/gnome-shell
View file

@ -473,6 +473,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{bin}/Xwayland rPx,
@{lib}/polkit-1/polkit* rPx,
@{lib}/* rPUx,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
/usr/share/gnome-shell/extensions/ding@rastersoft.com/ding.js rPx,
@ -506,8 +507,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/.flatpak-info r,
/etc/fstab r,
/etc/udev/hwdb.bin r,
/etc/pipewire/client.conf.d/{,**} r,
/etc/timezone r,
/etc/udev/hwdb.bin r,
/etc/xdg/menus/gnome-applications.menu r,
/var/lib/gdm{3,}/.cache/ w,
@ -542,6 +544,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/var/lib/snapd/desktop/icons/{,**} r,
owner @{HOME}/.face r,
owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
owner @{HOME}/.var/app/**/ r,
owner @{HOME}/.var/app/**.{png,jpg,svg} r,
@ -555,6 +558,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/ibus/ w,
owner @{user_config_dirs}/monitors.xml{,~} rwl,
owner @{user_config_dirs}/pulse/ r,
owner @{user_config_dirs}/pulse/ w, # change to 'c'
owner @{user_config_dirs}/tiling-assistant/{,**} rw,
owner @{user_share_dirs}/backgrounds/{,**} rw,

6
apparmor.d/groups/gnome/gnome-software
View file

@ -61,6 +61,8 @@ profile gnome-software @{exec_path} {
/var/cache/app-info/xmls/{,**} r,
/var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r,
/var/lib/apt/lists/*.yml.gz r,
/var/lib/flatpak/app/{,**} r,
/var/lib/flatpak/appstream/{,**} r,
/var/lib/flatpak/repo/{,**} r,
@ -68,6 +70,8 @@ profile gnome-software @{exec_path} {
/var/lib/PackageKit/offline-update-competed r,
/var/lib/PackageKit/prepared-update r,
/var/lib/swcatalog/icons/**.png r,
/var/lib/swcatalog/yaml/ r,
/var/tmp/flatpak-cache-*/ rw,
/var/tmp/flatpak-cache-*/** rwkl,
@ -143,4 +147,4 @@ profile gnome-software @{exec_path} {
}
include if exists <local/gnome-software>
}
}

8
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -29,6 +29,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{bin}/pkexec rPx,
/usr/share/gnome-system-monitor/{,**} r,
/usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
# freedesktop.org-strict
/usr/share/pixmaps/{,**} r,
@ -40,13 +41,14 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
/var/lib/snapd/desktop/icons/ r,
owner @{run}/user/@{uid}/doc/ rw,
owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
@{run}/systemd/sessions/* r,
@{run}/systemd/sessions/*.ref r,
@{sys}/devices/@{pci}/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/collisions r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/tx_{bytes,errors,packets} r,

2
apparmor.d/groups/gnome/gsd-color
View file

@ -125,6 +125,8 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
/usr/share/mime/mime.cache r,
/usr/share/X11/xkb/** r,
/etc/timezone r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/.local/share/icc/ rw,

7
apparmor.d/groups/gnome/tracker-extract
View file

@ -95,10 +95,14 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
/etc/fstab r,
/etc/libva.conf r,
# dri-common-strict
/usr/share/drirc.d/{,*.conf} r,
/var/lib/gdm{3,}/.cache/ rw,
/var/lib/gdm{3,}/.cache/tracker3/{,**} rw,
/var/lib/gdm{3,}/.cache/gstreamer-1.0/ rw,
/var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/lightdm/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} r,
@ -130,6 +134,9 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
@{run}/mount/utab r,
@{sys}/devices/pci[0-9]*/*/vendor r,
@{sys}/devices/pci[0-9]*/*/device r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,

2
apparmor.d/groups/gnome/tracker-miner
View file

@ -77,6 +77,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
/etc/fstab r,
/etc/blkid.conf r,
/etc/timezone r,
/var/lib/flatpak/exports/share/applications/{,mimeinfo.cache} r,
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
@ -84,6 +85,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
/var/lib/gdm{3,}/ r,
/var/lib/gdm{3,}/.cache/tracker3/{,tracker3/}files/{,**} rwk,
/var/lib/gdm{3,}/.local/share/applications/ r,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/lightdm/.config/dconf/user r,