felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update apparmor profiles

Browse source 
Co-authored-by: Mikhail Morfikov <mmorfikov@gmail.com>
Signed-off-by: Alexandre Pujol <alexandre@pujol.io>
This commit is contained in:
Alexandre Pujol 2022-02-27 01:22:35 +00:00
parent b0690c0e55
commit d701e39939
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
201 changed files with 540 additions and 608 deletions
Download patch file Download diff file Expand all files Collapse all files

20
apparmor.d/groups/apps/android-studio
View file

@ -27,15 +27,7 @@ profile android-studio @{exec_path} {
include <abstractions/audio>
include <abstractions/python>
include <abstractions/devices-usb>
include <abstractions/deny-root-dir-access>
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
include <abstractions/chromium-common>
capability sys_ptrace,
@ -174,12 +166,6 @@ profile android-studio @{exec_path} {
owner @{HOME}/.java/.userPrefs/ rw,
owner @{HOME}/.java/.userPrefs/** rwk,
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{HOME}/.emulator_console_auth_token rw,
deny owner @{HOME}/Desktop/* rw,
@ -206,8 +192,6 @@ profile android-studio @{exec_path} {
@{sys}/fs/cgroup/{,**} r,
/var/tmp/ r,
/tmp/ r,
owner /tmp/** rwk,
owner /tmp/native-platform[0-9]*dir/*.so rwm,
@ -220,8 +204,6 @@ profile android-studio @{exec_path} {
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner /dev/shm/.org.chromium.Chromium.* rw,
/dev/kvm rw,
@{sys}/devices/virtual/block/**/rotational r,

24
apparmor.d/groups/apps/atom
View file

@ -16,6 +16,7 @@ profile atom @{exec_path} {
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/enchant>
include <abstractions/chromium-common>
# The following doesn't seem to be needed
##include <abstractions/mesa>
##include <abstractions/consoles>
@ -24,8 +25,6 @@ profile atom @{exec_path} {
include <abstractions/thumbnails-cache-read>
##include <abstractions/zsh>
##include <abstractions/fzf>
include <abstractions/deny-dconf>
include <abstractions/deny-root-dir-access>
ptrace (read) peer=lsb_release,
ptrace (read) peer=xdg-settings,
@ -93,16 +92,12 @@ profile atom @{exec_path} {
owner @{user_config_dirs}/git/config r,
# To remove the following error:
# Error initializing NSS with a persistent database
deny owner @{HOME}/.pki/ rw,
deny owner @{HOME}/.pki/nssdb/ rw,
deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
/etc/fstab r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
# Needed or atom gets crash with the following error:
@ -125,9 +120,6 @@ profile atom @{exec_path} {
owner @{PROC}/@{pid}/mounts r,
deny owner @{PROC}/@{pid}/loginuid r,
deny /dev/shm/ r,
owner /dev/shm/.org.chromium.Chromium.* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
@ -140,9 +132,6 @@ profile atom @{exec_path} {
# The irq file is needed to render pages.
deny @{sys}/devices/pci[0-9]*/**/irq r,
/var/tmp/ r,
/tmp/ r,
owner /tmp/.org.chromium.Chromium.* rw,
owner /tmp/atom-[0-9a-f]*.sock rw,
owner "/tmp/Atom Crashes/" rw,
owner /tmp/github-[0-9]*-[0-9]*-*.*/ rw,
@ -154,9 +143,6 @@ profile atom @{exec_path} {
owner /tmp/apm-install-dir-[0-9]*-[0-9]*-*.*/** rw,
owner /tmp/net-export/ rw,
# file_inherit
owner @{HOME}/.xsession-errors w,
# Allowed apps to open
/{usr/,}lib/firefox/firefox rPUx,

15
apparmor.d/groups/apps/calibre
View file

@ -41,15 +41,7 @@ profile calibre @{exec_path} {
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/devices-usb>
include <abstractions/deny-root-dir-access>
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
include <abstractions/chromium-common>
capability sys_ptrace,
@ -142,9 +134,7 @@ profile calibre @{exec_path} {
@{sys}/devices/pci[0-9]*/**/irq r,
/dev/shm/ r,
/dev/shm/#[0-9]*[0-9] rw,
owner /dev/shm/.org.chromium.Chromium.* rw,
/dev/shm/#[0-9]*[0-9] rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
@ -157,7 +147,6 @@ profile calibre @{exec_path} {
# file_inherit
owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
profile open {

24
apparmor.d/groups/apps/code
View file

@ -16,14 +16,13 @@ profile code @{exec_path} {
include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
include <abstractions/chromium-common>
# The following doesn't seem to be needed
##include <abstractions/mesa>
##include <abstractions/consoles>
##include <abstractions/audio>
##include <abstractions/user-download-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/deny-dconf>
include <abstractions/deny-root-dir-access>
ptrace (read) peer=lsb_release,
@ -70,16 +69,12 @@ profile code @{exec_path} {
owner @{MOUNTS}/*/code/ r,
owner @{MOUNTS}/*/code/** rwkl -> @{MOUNTS}/*/code/**,
# To remove the following error:
# Error initializing NSS with a persistent database
deny owner @{HOME}/.pki/ rw,
deny owner @{HOME}/.pki/nssdb/ rw,
deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
/etc/fstab r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
# Needed or code gets crash with the following error:
@ -106,9 +101,6 @@ profile code @{exec_path} {
deny owner @{PROC}/@{pid}/net/if_inet6 r,
deny owner @{PROC}/@{pids}/cmdline r,
deny /dev/shm/ r,
owner /dev/shm/.org.chromium.Chromium.* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
@ -120,8 +112,6 @@ profile code @{exec_path} {
# The irq file is needed to render pages.
deny @{sys}/devices/pci[0-9]*/**/irq r,
/var/tmp/ r,
/tmp/ r,
owner "/tmp/VSCode Crashes/" rw,
owner /tmp/vscode-typescript[0-9]*/ rw,
@ -132,9 +122,5 @@ profile code @{exec_path} {
# For installing extensions
owner /tmp/@{uuid} rw,
# file_inherit
owner @{HOME}/.xsession-errors w,
include if exists <local/code>
}

47
apparmor.d/groups/apps/discord
View file

@ -6,11 +6,13 @@ abi <abi/3.0>,
include <tunables/global>
@{DISCORD_LIBDIR} = /usr/share/discord
@{DISCORD_HOMEDIR} = @{user_config_dirs}/discord
@{DISCORD_CACHEDIR} = @{user_cache_dirs}/discord
@{DISCORD_LIBDIR} = /usr/share/discord
@{DISCORD_LIBDIR} += /usr/share/discord-ptb
@{DISCORD_HOMEDIR} = @{HOME}/.config/discord
@{DISCORD_HOMEDIR} += @{HOME}/.config/discordptb
@{DISCORD_CACHEDIR} = @{HOME}/.cache/discord
@{exec_path} = @{DISCORD_LIBDIR}/Discord /{usr/,}bin/discord
@{exec_path} = @{DISCORD_LIBDIR}/Discord{,PTB} /{usr/,}bin/discord{,-ptb}
profile discord @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -24,7 +26,7 @@ profile discord @{exec_path} {
include <abstractions/mesa>
include <abstractions/user-download-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/deny-root-dir-access>
include <abstractions/chromium-common>
signal (send) set=(kill, term) peer=@{profile_name}//lsb_release,
@ -40,14 +42,6 @@ profile discord @{exec_path} {
@{exec_path} mrix,
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/xdg-open rCx -> open,
@ -59,11 +53,8 @@ profile discord @{exec_path} {
@{DISCORD_LIBDIR}/ r,
@{DISCORD_LIBDIR}/** r,
# @{DISCORD_LIBDIR}/**.so mr,
# @{DISCORD_LIBDIR}/libEGL.so mr,
# @{DISCORD_LIBDIR}/libGLESv2.so mr,
# To remove the following error:
# discord-canary: error while loading shared libraries: libffmpeg.so: cannot open shared object
# file: No such file or directory
@{DISCORD_LIBDIR}/libEGL.so mr,
@{DISCORD_LIBDIR}/libGLESv2.so mr,
@{DISCORD_LIBDIR}/libffmpeg.so mr,
# @{DISCORD_LIBDIR}/swiftshader/libEGL.so mr,
# @{DISCORD_LIBDIR}/swiftshader/libGLESv2.so mr,
@ -85,7 +76,11 @@ profile discord @{exec_path} {
owner @{PROC}/@{pids}/task/ r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny @{PROC}/@{pids}/stat r,
deny owner @{PROC}/@{pids}/statm r,
# Needed to remove the following error:
# Error occurred in handler for 'DISCORD_PROCESS_UTILS_GET_MEMORY_INFO': [Error: Failed to
# create memory dump]
owner @{PROC}/@{pids}/statm r,
#
deny @{PROC}/@{pids}/cmdline r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/sys/fs/inotify/max_user_watches r,
@ -106,25 +101,11 @@ profile discord @{exec_path} {
@{sys}/devices/pci[0-9]*/**/irq r,
deny /dev/ r,
deny /dev/shm/ rw,
owner /dev/shm/.org.chromium.Chromium.* rw,
/var/tmp/ r,
/tmp/ r,
owner /tmp/net-export/ rw,
owner /tmp/discord.sock rw,
owner /tmp/.org.chromium.Chromium.*/ rw,
owner /tmp/.org.chromium.Chromium.*/discord1_[0-9]*.png rw,
owner /tmp/.org.chromium.Chromium.*/SingletonCookie rw,
owner /tmp/.org.chromium.Chromium.*/SS rw,
owner "/tmp/Discord Crashes/" rw,
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{run}/user/@{uid}/discord-ipc-[0-9] rw,
/var/lib/dbus/machine-id r,

1
apparmor.d/groups/apps/discord-chrome-sandbox
View file

@ -14,7 +14,6 @@ include <tunables/global>
profile discord-chrome-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
# For kernel unprivileged user namespaces
capability sys_admin,

1
apparmor.d/groups/apps/dropbox
View file

@ -23,7 +23,6 @@ profile dropbox @{exec_path} {
include <abstractions/qt5-settings-write>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
ptrace peer=@{profile_name},

1
apparmor.d/groups/apps/filezilla
View file

@ -15,7 +15,6 @@ profile filezilla @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/nameservice>
include <abstractions/user-download-strict>
include <abstractions/deny-root-dir-access>
signal (send) set=(term, kill) peer=fzsftp,

2
apparmor.d/groups/apps/flameshot
View file

@ -23,7 +23,6 @@ profile flameshot @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
network inet dgram,
network inet6 dgram,
@ -68,7 +67,6 @@ profile flameshot @{exec_path} {
# file_inherit
owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
profile open {

31
apparmor.d/groups/apps/freetube
View file

@ -25,16 +25,7 @@ profile freetube @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/deny-dconf>
include <abstractions/deny-root-dir-access>
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
include <abstractions/chromium-common>
network inet dgram,
network inet6 dgram,
@ -55,17 +46,6 @@ profile freetube @{exec_path} {
owner @{user_config_dirs}/FreeTube/ rw,
owner @{user_config_dirs}/FreeTube/** rwk,
/var/tmp/ r,
/tmp/ r,
owner /tmp/.org.chromium.Chromium.*/ rw,
owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
owner /tmp/.org.chromium.Chromium.*/SS w,
owner /tmp/.org.chromium.Chromium.* rw,
owner /tmp/net-export/ rw,
/dev/shm/ r,
owner /dev/shm/.org.chromium.Chromium.* rw,
# The /proc/ dir is needed to avoid the following error:
# traps: freetube[] trap int3 ip:56499eca9d26 sp:7ffcab073060 error:0 in
# freetube[56499b8a8000+531e000]
@ -84,8 +64,13 @@ profile freetube @{exec_path} {
@{PROC}/sys/kernel/yama/ptrace_scope r,
deny @{PROC}/vmstat r,
@{PROC}/sys/fs/inotify/max_user_watches r,
/etc/fstab r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
owner @{user_share_dirs} r,
@ -97,10 +82,6 @@ profile freetube @{exec_path} {
# The irq file is needed to render pages.
deny @{sys}/devices/pci[0-9]*/**/irq r,
# Needed?
deny owner @{HOME}/.pki/ rw,
deny owner @{HOME}/.pki/** rwk,
/var/lib/dbus/machine-id r,
/etc/machine-id r,

1
apparmor.d/groups/apps/freetube-chrome-sandbox
View file

@ -15,7 +15,6 @@ include <tunables/global>
profile freetube-chrome-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/deny-root-dir-access>
capability sys_admin,
capability setgid,

1
apparmor.d/groups/apps/okular
View file

@ -25,7 +25,6 @@ profile okular @{exec_path} {
include <abstractions/kde-icon-cache-write>
include <abstractions/qt5-settings-write>
include <abstractions/qt5-compose-cache-write>
include <abstractions/deny-root-dir-access>
@{exec_path} mr,

23
apparmor.d/groups/apps/signal-desktop
View file

@ -22,19 +22,11 @@ profile signal-desktop @{exec_path} {
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/deny-root-dir-access>
include <abstractions/chromium-common>
# Needed?
deny capability sys_ptrace,
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
network inet dgram,
network inet6 dgram,
network inet stream,
@ -59,18 +51,8 @@ profile signal-desktop @{exec_path} {
@{SIGNAL_HOMEDIR}/ rw,
@{SIGNAL_HOMEDIR}/** rwk,
#owner @{HOME}/.pki/nssdb/pkcs11.txt r,
#owner @{HOME}/.pki/nssdb/cert9.db rwk,
#owner @{HOME}/.pki/nssdb/key4.db rwk,
# Signal wants the /tmp/ dir to be mounted with the "exec" flag. If this is not acceptable in
# your system, use the TMPDIR variable to set some other tmp dir.
/tmp/ r,
owner /tmp/.org.chromium.Chromium.*/ rw,
owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
owner /tmp/.org.chromium.Chromium.*/SS w,
owner /tmp/.org.chromium.Chromium.* rw,
/var/tmp/ r,
owner @{SIGNAL_HOMEDIR}/tmp/.org.chromium.Chromium.* mrw,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
@ -90,9 +72,6 @@ profile signal-desktop @{exec_path} {
@{PROC}/sys/fs/inotify/max_user_watches r,
@{PROC}/vmstat r,
deny /dev/shm/ r,
/dev/shm/.org.chromium.Chromium.* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,

1
apparmor.d/groups/apps/signal-desktop-chrome-sandbox
View file

@ -13,7 +13,6 @@ include <tunables/global>
@{exec_path} = "/opt/Signal{, Beta}/chrome-sandbox"
profile signal-desktop-chrome-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
@{exec_path} mr,

13
apparmor.d/groups/apps/spotify
View file

@ -21,7 +21,7 @@ profile spotify @{exec_path} {
include <abstractions/thumbnails-cache-read>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
include <abstractions/chromium-common>
@{exec_path} mrix,
@ -57,8 +57,6 @@ profile spotify @{exec_path} {
/etc/fstab r,
owner /dev/shm/.org.chromium.Chromium.* rw,
deny @{sys}/devices/virtual/tty/tty[0-9]*/active r,
# To remove the following error:
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
@ -69,19 +67,10 @@ profile spotify @{exec_path} {
/usr/share/X11/XErrorDB r,
/tmp/ r,
owner /tmp/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
# What's this for?
#owner /tmp/[0-9]*.[0-9]*.[0-9]*.[0-9]*-linux-*.zip rw,
/var/tmp/ r,
deny owner @{HOME}/.pki/ rw,
deny owner @{HOME}/.pki/nssdb/ rw,
deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
include if exists <local/spotify>
}

6
apparmor.d/groups/apps/telegram-desktop
View file

@ -27,8 +27,6 @@ profile telegram-desktop @{exec_path} {
include <abstractions/enchant>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/deny-dconf>
include <abstractions/deny-root-dir-access>
network inet dgram,
network inet6 dgram,
@ -76,6 +74,10 @@ profile telegram-desktop @{exec_path} {
/var/lib/dbus/machine-id r,
/etc/machine-id r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
# Needed when saving files as, or otherwise the app crashes
/usr/share/glib-2.0/schemas/gschemas.compiled r,

7
apparmor.d/groups/apps/thunderbird
View file

@ -30,8 +30,6 @@ profile thunderbird @{exec_path} {
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/deny-dconf>
include <abstractions/deny-root-dir-access>
ptrace peer=@{profile_name},
@ -93,6 +91,10 @@ profile thunderbird @{exec_path} {
owner @{HOME}/Mail/ rw,
owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
# Fix error in libglib while saving files as
/usr/share/glib-2.0/schemas/gschemas.compiled r,
@ -187,7 +189,6 @@ profile thunderbird @{exec_path} {
# file_inherit
owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
profile gpg {

2
apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
View file

@ -108,7 +108,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
owner @{libo_user_dirs}/**/ rw, #allow creating directories that we own
owner @{libo_user_dirs}/**~lock.* rw, #lock file support
owner @{libo_user_dirs}/**.@{libreoffice_ext} rwk, #Open files rw with the right exts
owner @{libo_user_dirs}/{,**/}lu???????????{,?}.tmp rwk, #Temporary file used when saving
owner @{libo_user_dirs}/{,**/}lu????????{,?,??,???,????}.tmp rwk, #Temporary file used when saving
owner @{libo_user_dirs}/{,**/}.directory r, #Read directory settings on KDE
# Settings

1
apparmor.d/groups/apps/vlc
View file

@ -70,7 +70,6 @@ profile vlc @{exec_path} {
include <abstractions/private-files-strict>
include <abstractions/ssl_certs>
include <abstractions/devices-usb>
include <abstractions/deny-root-dir-access>
signal (receive) set=(term, kill) peer=anyremote//*,

16
apparmor.d/groups/apt/apt-listbugs
View file

@ -23,21 +23,25 @@ profile apt-listbugs @{exec_path} {
network netlink raw,
@{exec_path} r,
/{usr/,}bin/ruby2.[0-9]* rix,
/{usr/,}bin/ruby[0-9].[0-9]* rix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/logname rix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/logname rix,
/{usr/,}bin/apt-config rPx,
/{usr/,}bin/apt-config rPx,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
/{usr/,}bin/dpkg-query rpx,
/{usr/,}bin/dpkg-query rpx,
/usr/local/lib/site_ruby/[0-9].[0-9].[0-9]/**.rb r,
/usr/share/rubygems-integration/*/specifications/ r,
/usr/share/rubygems-integration/*/specifications/* r,
/usr/share/rubygems-integration/*/specifications/*.gemspec rwk,
/{usr/,}lib/ruby/gems/*/specifications/ r,
/{usr/,}lib/ruby/gems/*/specifications/** r,
/{usr/,}lib/ruby/gems/*/specifications/**.gemspec rwk,
/etc/apt/listbugs/{,*} r,

8
apparmor.d/groups/apt/apt-listbugs-migratepins
View file

@ -13,10 +13,14 @@ profile apt-listbugs-migratepins @{exec_path} {
include <abstractions/ruby>
@{exec_path} r,
/{usr/,}bin/ruby2.[0-9]* rix,
/{usr/,}bin/ruby[0-9].[0-9]* rix,
/usr/share/rubygems-integration/*/specifications/ r,
/usr/share/rubygems-integration/*/specifications/* r,
/usr/share/rubygems-integration/*/specifications/*.gemspec rwk,
/{usr/,}lib/ruby/gems/*/specifications/ r,
/{usr/,}lib/ruby/gems/*/specifications/** r,
/{usr/,}lib/ruby/gems/*/specifications/**.gemspec rwk,
/etc/apt/preferences r,

2
apparmor.d/groups/apt/apt-listbugs-prefclean
View file

@ -13,7 +13,7 @@ profile apt-listbugs-prefclean @{exec_path} {
include <abstractions/ruby>
@{exec_path} r,
/{usr/,}bin/ruby2.[0-9]* rix,
/{usr/,}bin/ruby[0-9].[0-9]* rix,
/{usr/,}bin/date rix,
/{usr/,}bin/cat rix,

1
apparmor.d/groups/apt/apt-listchanges
View file

@ -79,6 +79,7 @@ profile apt-listchanges @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
#capability sys_tty_config,
/{usr/,}bin/sensible-pager mr,

1
apparmor.d/groups/apt/querybts
View file

@ -18,7 +18,6 @@ profile querybts @{exec_path} {
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/apt-common>
include <abstractions/deny-root-dir-access>
network inet dgram,
network inet6 dgram,

6
apparmor.d/groups/apt/reportbug
View file

@ -19,8 +19,6 @@ profile reportbug @{exec_path} {
include <abstractions/enchant>
include <abstractions/python>
include <abstractions/apt-common>
include <abstractions/deny-root-dir-access>
include <abstractions/deny-dconf>
network inet dgram,
network inet6 dgram,
@ -65,6 +63,10 @@ profile reportbug @{exec_path} {
/{usr/,}bin/run-parts rCx -> run-parts,
/{usr/,}bin/gpg rCx -> gpg,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
# For sending additional information
/etc/** r,

1
apparmor.d/groups/apt/synaptic
View file

@ -16,7 +16,6 @@ profile synaptic @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/apt-common>
include <abstractions/nameservice-strict>
include <abstractions/deny-dconf>
# To remove the following errors:
# W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory

37
apparmor.d/groups/browsers/brave
View file

@ -24,19 +24,10 @@ profile brave @{exec_path} {
include <abstractions/user-download-strict>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/deny-dconf>
include <abstractions/deny-root-dir-access>
include <abstractions/chromium-common>
capability sys_ptrace,
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
ptrace (read),
@{exec_path} mrix,
@ -78,14 +69,6 @@ profile brave @{exec_path} {
/usr/share/chromium/extensions/ r,
# To remove the following error:
# Error initializing NSS with a persistent database
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
owner @{HOME}/ r,
owner @{user_config_dirs}/BraveSoftware/ w,
owner @{BRAVE_HOMEDIR}/ rw,
@ -122,6 +105,10 @@ profile brave @{exec_path} {
/etc/fstab r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
# Needed or Brave crash with the following error:
@ -148,14 +135,10 @@ profile brave @{exec_path} {
@{PROC}/sys/fs/inotify/max_user_watches r,
deny @{PROC}filesystems r,
owner /dev/shm/.org.chromium.Chromium.* rw,
owner /dev/shm/org.chromium.Chromium.shmem.[A-F0-9]*._service_shmem rw,
/dev/bus/usb/[0-9]*/[0-9]* rw,
# For downloading files
owner @{user_share_dirs}/.org.chromium.Chromium.* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
@ -179,22 +162,12 @@ profile brave @{exec_path} {
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
/var/tmp/ r,
/tmp/ r,
owner /tmp/.org.chromium.Chromium.* rw,
owner /tmp/.org.chromium.Chromium.*/{,**} rw,
# For installing/updating/removing extensions
owner /tmp/scoped_dir*/{,**} rw,
owner /tmp/tmp.* rw,
# For brave://net-export/
owner /tmp/net-export/ rw,
# Silencer
deny @{BRAVE_INSTALLDIR}/** w,
# file_inherit
owner @{HOME}/.xsession-errors w,
profile open {
include <abstractions/base>

1
apparmor.d/groups/browsers/brave-browser
View file

@ -14,7 +14,6 @@ include <tunables/global>
profile brave-browser @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/deny-root-dir-access>
@{exec_path} r,
/{usr/,}bin/{,ba,da}sh rix,

1
apparmor.d/groups/browsers/brave-sandbox
View file

@ -13,7 +13,6 @@ include <tunables/global>
@{exec_path} = @{BRAVE_INSTALLDIR}/{brave,chrome}-sandbox
profile brave-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
# For kernel unprivileged user namespaces
capability sys_admin,

1
apparmor.d/groups/browsers/chromium
View file

@ -14,7 +14,6 @@ include <tunables/global>
profile chromium @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/freedesktop.org>
include <abstractions/deny-root-dir-access>
@{exec_path} r,

36
apparmor.d/groups/browsers/chromium-chrome-crashpad-handler Normal file
View file

@ -0,0 +1,36 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
@{exec_path} = @{CHROMIUM_INSTALLDIR}/chrome_crashpad_handler
profile chromium-chrome-crashpad-handler @{exec_path} flags=(complain) {
include <abstractions/base>
capability sys_ptrace,
ptrace peer=chromium-chromium,
signal (send) peer=chromium-chromium,
@{exec_path} mrix,
owner "@{HOME}/.config/chromium/Crash Reports/**" rwk,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pids}/mem r,
owner @{PROC}/@{pids}/stat r,
owner @{PROC}/@{pids}/task/ r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_max_freq r,
include if exists <local/chromium-chrome-crashpad-handler>
}

1
apparmor.d/groups/browsers/chromium-chrome-sandbox
View file

@ -14,7 +14,6 @@ include <tunables/global>
profile chromium-chrome-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
# For kernel unprivileged user namespaces
capability sys_admin,

50
apparmor.d/groups/browsers/chromium-chromium
View file

@ -28,7 +28,6 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
include <abstractions/thumbnails-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
ptrace (read) peer=chrome-gnome-shell,
@ -46,6 +45,7 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
ptrace (read) peer=lsb_release,
signal (send) set=(term, kill) peer=keepassxc-proxy,
signal (receive) peer=chromium-chrome-crashpad-handler,
network inet dgram,
network inet6 dgram,
@ -55,9 +55,9 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
@{exec_path} mrix,
/{usr/,}bin/chrome-gnome-shell rPx,
@{CHROMIUM_INSTALLDIR}/chrome-sandbox rPx,
@{CHROMIUM_INSTALLDIR}/crashpad_handler rPx,
/{usr/,}bin/chrome-gnome-shell rPx,
@{CHROMIUM_INSTALLDIR}/chrome-sandbox rPx,
@{CHROMIUM_INSTALLDIR}/chrome_crashpad_handler rPx,
# For storing passwords externally
/{usr/,}bin/keepassxc-proxy rPUx,
@ -70,14 +70,6 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/xdg-desktop-menu rPx,
/{usr/,}bin/xdg-icon-resource rPx,
# To remove the following error:
# Error initializing NSS with a persistent database
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
# Chromium files
/usr/share/chromium/{,**} r,
@ -121,36 +113,39 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
/etc/fstab r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
# Needed or chromium gets crash with the following error:
# FATAL:sandbox_linux.cc(172)] Check failed: proc_fd_ >= 0 (-1 vs. 0)
@{PROC}/ r,
#
deny @{PROC}/vmstat r,
@{PROC}/vmstat r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/@{pid}/fd/ r,
deny @{PROC}/@{pids}/stat r,
deny @{PROC}/@{pids}/statm r,
@{PROC}/@{pids}/stat r,
@{PROC}/@{pids}/statm r,
# To remove the following error:
# Failed to adjust OOM score of renderer with pid : Permission denied
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
owner @{PROC}/@{pid}/oom_{,score_}adj rw,
#
deny @{PROC}/@{pids}/cmdline r,
deny owner @{PROC}/@{pids}/environ r,
owner @{PROC}/@{pids}/environ r,
owner @{PROC}/@{pids}/task/ r,
deny @{PROC}/@{pids}/task/@{tid}/stat r,
@{PROC}/@{pids}/task/@{tid}/stat r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny owner @{PROC}/@{pid}/limits r,
deny owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/limits r,
owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
# To remove the following error:
# file_path_watcher_linux.cc(71)] Failed to read /proc/sys/fs/inotify/max_user_watches
@{PROC}/sys/fs/inotify/max_user_watches r,
deny /dev/shm/ r,
owner /dev/shm/.org.chromium.Chromium.* rw,
#
owner @{PROC}/@{pids}/clear_refs w,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
@ -174,19 +169,10 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
/var/tmp/ r,
/tmp/ r,
owner /tmp/.org.chromium.Chromium.* rw,
owner /tmp/.org.chromium.Chromium.*/{,**} rw,
# For the temp profile
owner /tmp/tmp.*/ rw,
owner /tmp/tmp.*/** rwk,
# For installing/updating extensions
owner /tmp/scoped_dir*/ rw,
owner /tmp/scoped_dir*/** rw,
# Silencer
deny @{CHROMIUM_INSTALLDIR}/** w,

1
apparmor.d/groups/browsers/chromium-crashpad-handler
View file

@ -14,7 +14,6 @@ include <tunables/global>
profile chromium-crashpad_handler @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
@{exec_path} mrix,

1
apparmor.d/groups/browsers/firefox
View file

@ -17,7 +17,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/dconf>
include <abstractions/deny-root-dir-access>
include <abstractions/enchant>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>

8
apparmor.d/groups/browsers/firefox-crashreporter
View file

@ -20,8 +20,6 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/openssl>
include <abstractions/deny-root-dir-access>
include <abstractions/deny-dconf>
signal (receive) set=(term, kill) peer=firefox,
@ -55,6 +53,10 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/X11/xkb/** r,
@ -62,8 +64,6 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
# file_inherit
owner @{MOZ_CACHEDIR}/firefox/*.*/** r,
owner @{MOZ_HOMEDIR}/firefox/*.*/extensions/*.xpi r,
owner @{MOZ_HOMEDIR}/firefox/*.*/.parentlock rw,
owner @{HOME}/.xsession-errors w,
/dev/dri/renderD128 rw,
/dev/dri/card[0-9]* rw,

1
apparmor.d/groups/browsers/firefox-minidump-analyzer
View file

@ -13,7 +13,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/firefox/minidump-analyzer
profile firefox-minidump-analyzer @{exec_path} {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
signal (receive) set=(term, kill) peer=firefox,

1
apparmor.d/groups/browsers/firefox-pingsender
View file

@ -16,7 +16,6 @@ profile firefox-pingsender @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
signal (receive) set=(term, kill) peer=firefox,

29
apparmor.d/groups/browsers/google-chrome-chrome
View file

@ -24,15 +24,7 @@ profile google-chrome-chrome @{exec_path} {
include <abstractions/thumbnails-cache-read>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
include <abstractions/chromium-common>
ptrace (trace) peer=@{profile_name},
@ -69,20 +61,10 @@ profile google-chrome-chrome @{exec_path} {
/{usr/,}bin/xdg-mime rPx,
/{usr/,}bin/xdg-settings rPx,
# To remove the following error:
# Error initializing NSS with a persistent database
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
# Google Chrome home files
owner @{HOME}/ r,
owner @{CHROME_HOMEDIR}/ rw,
owner @{CHROME_HOMEDIR}/** rwk,
# Flashplayer
owner @{CHROME_HOMEDIR}/PepperFlash/**/libpepflashplayer.so mr,
owner @{user_share_dirs}/.com.google.Chrome.* rw,
@ -141,8 +123,6 @@ profile google-chrome-chrome @{exec_path} {
owner @{PROC}/@{pid}/mounts r,
deny @{PROC}/diskstats r,
owner /dev/shm/.com.google.Chrome.* rw,
# To play DRM media (protected content)
@{CHROME_INSTALLDIR}/libwidevinecdm.so mr,
@{CHROME_INSTALLDIR}/libwidevinecdmadapter.so mr,
@ -168,13 +148,6 @@ profile google-chrome-chrome @{exec_path} {
# The irq file is needed to render pages.
@{sys}/devices/pci[0-9]*/**/irq r,
/var/tmp/ r,
/tmp/ r,
owner /tmp/.com.google.Chrome.* rw,
owner /tmp/.com.google.Chrome.*/{,**} rw,
# For installing/updating extensions
owner /tmp/scoped_dir*/{,**} rw,
# Silencer
deny @{CHROME_INSTALLDIR}/** w,

1
apparmor.d/groups/browsers/google-chrome-chrome-sandbox
View file

@ -13,7 +13,6 @@ include <tunables/global>
@{exec_path} = @{CHROME_INSTALLDIR}/chrome-sandbox
profile google-chrome-chrome-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
# For kernel unprivileged user namespaces
capability sys_admin,

1
apparmor.d/groups/browsers/google-chrome-google-chrome
View file

@ -14,7 +14,6 @@ include <tunables/global>
profile google-chrome-google-chrome @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/deny-root-dir-access>
@{exec_path} r,
/{usr/,}bin/{,ba,da}sh rix,

40
apparmor.d/groups/browsers/opera
View file

@ -25,16 +25,7 @@ profile opera @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/deny-dconf>
include <abstractions/deny-root-dir-access>
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
include <abstractions/chromium-common>
ptrace (trace) peer=@{profile_name},
@ -62,21 +53,11 @@ profile opera @{exec_path} {
/{usr/,}bin/xdg-desktop-menu rPx,
/{usr/,}bin/xdg-icon-resource rPx,
# To remove the following error:
# Error initializing NSS with a persistent database
owner @{HOME}/.pki/ rw,
owner @{HOME}/.pki/nssdb/ rw,
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
# Opera home files
owner @{HOME}/ r,
owner @{OPERA_HOMEDIR}/ rw,
owner @{OPERA_HOMEDIR}/** rwk,
owner @{user_share_dirs}/.org.chromium.Chromium.* rw,
# Cache files
owner @{user_cache_dirs}/ rw,
owner @{OPERA_CACHEDIR}/{,**/} rw,
@ -100,13 +81,12 @@ profile opera @{exec_path} {
owner @{user_config_dirs}/chromium/*/ r,
owner @{user_config_dirs}/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
# Flashplayer
owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/**/manifest.json r,
owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/latest-component-updated-flash r,
owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/**/libpepflashplayer.so mr,
/etc/fstab r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
# Needed or opera crashes with the following error:
@ -133,8 +113,6 @@ profile opera @{exec_path} {
owner @{PROC}/@{pid}/mounts r,
@{PROC}/sys/fs/inotify/max_user_watches r,
owner /dev/shm/.org.chromium.Chromium.* rw,
# To play DRM media (protected content)
/opt/google/chrome{,-beta,-unstable}/libwidevinecdm.so mr,
/opt/google/chrome{,-beta,-unstable}/libwidevinecdmadapter.so mr,
@ -159,14 +137,6 @@ profile opera @{exec_path} {
# The irq file is needed to render pages.
@{sys}/devices/pci[0-9]*/**/irq r,
/var/tmp/ r,
/tmp/ r,
owner /tmp/.org.chromium.Chromium.* rw,
owner /tmp/.org.chromium.Chromium.*/{,*} rw,
# For installing/updating extensions
owner /tmp/scoped_dir*/{,**} rw,
# For crashreporter
owner /tmp/opera-crashlog-[0-9]*-[0-9]*.txt rw,

1
apparmor.d/groups/browsers/opera-crashreporter
View file

@ -19,7 +19,6 @@ profile opera-crashreporter @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
ptrace (trace, read) peer=opera,

1
apparmor.d/groups/browsers/opera-sandbox
View file

@ -15,7 +15,6 @@ profile opera-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/deny-root-dir-access>
# For kernel unprivileged user namespaces
capability sys_admin,

1
apparmor.d/groups/desktop/at-spi-bus-launcher
View file

@ -12,7 +12,6 @@ include <tunables/global>
profile at-spi-bus-launcher @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/deny-root-dir-access>
# Needed?
deny capability sys_nice,

1
apparmor.d/groups/desktop/at-spi2-registryd
View file

@ -11,7 +11,6 @@ include <tunables/global>
profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/deny-root-dir-access>
# Needed?
deny capability sys_nice,

1
apparmor.d/groups/desktop/dconf-editor
View file

@ -14,7 +14,6 @@ profile dconf-editor @{exec_path} {
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/dconf>
include <abstractions/deny-root-dir-access>
@{exec_path} mr,

3
apparmor.d/groups/gnome/gnome-keyring-daemon
View file

@ -11,10 +11,7 @@ include <tunables/global>
profile gnome-keyring-daemon @{exec_path} {
include <abstractions/base>
include <abstractions/openssl>
include <abstractions/deny-root-dir-access>
# Remove the following error:
# gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used
capability ipc_lock,
signal (send) set=(term) peer=ssh-agent,

3
apparmor.d/groups/gpg/gpg
View file

@ -72,6 +72,9 @@ profile gpg @{exec_path} {
/usr/share/keyrings/*.{gpg,asc} r,
/etc/keyrings/*.{gpg,asc} r,
# APT repositories
/var/lib/apt/lists/*_InRelease r,
# Verify files
owner @{HOME}/** r,
owner @{MOUNTS}/*/** r,

10
apparmor.d/groups/systemd/systemd-coredump
View file

@ -19,6 +19,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
capability setgid,
capability setpcap,
capability setuid,
capability sys_admin,
capability sys_ptrace,
@{exec_path} mr,
@ -27,12 +28,15 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
/{usr/,}sbin/* r,
@{libexec}/** r,
/opt/** r,
/ r,
mount -> /,
/etc/systemd/coredump.conf r,
/var/lib/systemd/coredump/ r,
/var/lib/systemd/coredump/** rwl,
/var/lib/systemd/coredump/#[0-9]* rwl,
/var/lib/systemd/coredump/ r,
owner /var/lib/systemd/coredump/#[0-9]* rw,
owner /var/lib/systemd/coredump/core.*.zst rwl -> /var/lib/systemd/coredump/#[0-9]*,
owner @{PROC}/@{pid}/setgroups r,
@{PROC}/@{pids}/comm r,