update apparmor profiles
Co-authored-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Alexandre Pujol <alexandre@pujol.io>
This commit is contained in:
Alexandre Pujol
parent
b0690c0e55
commit
d701e39939
201 changed files with 540 additions and 608 deletions
|
|
@ -27,15 +27,7 @@ profile android-studio @{exec_path} {
|
|||
include <abstractions/audio>
|
||||
include <abstractions/python>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
include <abstractions/chromium-common>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
|
|
@ -174,12 +166,6 @@ profile android-studio @{exec_path} {
|
|||
owner @{HOME}/.java/.userPrefs/ rw,
|
||||
owner @{HOME}/.java/.userPrefs/** rwk,
|
||||
|
||||
owner @{HOME}/.pki/ rw,
|
||||
owner @{HOME}/.pki/nssdb/ rw,
|
||||
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
owner @{HOME}/.emulator_console_auth_token rw,
|
||||
|
||||
deny owner @{HOME}/Desktop/* rw,
|
||||
|
|
@ -206,8 +192,6 @@ profile android-studio @{exec_path} {
|
|||
|
||||
@{sys}/fs/cgroup/{,**} r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/** rwk,
|
||||
owner /tmp/native-platform[0-9]*dir/*.so rwm,
|
||||
|
||||
|
|
@ -220,8 +204,6 @@ profile android-studio @{exec_path} {
|
|||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
/dev/kvm rw,
|
||||
|
||||
@{sys}/devices/virtual/block/**/rotational r,
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ profile atom @{exec_path} {
|
|||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/chromium-common>
|
||||
# The following doesn't seem to be needed
|
||||
##include <abstractions/mesa>
|
||||
##include <abstractions/consoles>
|
||||
|
|
@ -24,8 +25,6 @@ profile atom @{exec_path} {
|
|||
include <abstractions/thumbnails-cache-read>
|
||||
##include <abstractions/zsh>
|
||||
##include <abstractions/fzf>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
ptrace (read) peer=lsb_release,
|
||||
ptrace (read) peer=xdg-settings,
|
||||
|
|
@ -93,16 +92,12 @@ profile atom @{exec_path} {
|
|||
|
||||
owner @{user_config_dirs}/git/config r,
|
||||
|
||||
# To remove the following error:
|
||||
# Error initializing NSS with a persistent database
|
||||
deny owner @{HOME}/.pki/ rw,
|
||||
deny owner @{HOME}/.pki/nssdb/ rw,
|
||||
deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
# Needed or atom gets crash with the following error:
|
||||
|
|
@ -125,9 +120,6 @@ profile atom @{exec_path} {
|
|||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
deny /dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
|
|
@ -140,9 +132,6 @@ profile atom @{exec_path} {
|
|||
# The irq file is needed to render pages.
|
||||
deny @{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/atom-[0-9a-f]*.sock rw,
|
||||
owner "/tmp/Atom Crashes/" rw,
|
||||
owner /tmp/github-[0-9]*-[0-9]*-*.*/ rw,
|
||||
|
|
@ -154,9 +143,6 @@ profile atom @{exec_path} {
|
|||
owner /tmp/apm-install-dir-[0-9]*-[0-9]*-*.*/** rw,
|
||||
owner /tmp/net-export/ rw,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
|
||||
|
|
|
|||
|
|
@ -41,15 +41,7 @@ profile calibre @{exec_path} {
|
|||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
include <abstractions/chromium-common>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
|
|
@ -142,9 +134,7 @@ profile calibre @{exec_path} {
|
|||
|
||||
@{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
/dev/shm/ r,
|
||||
/dev/shm/#[0-9]*[0-9] rw,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
/dev/shm/#[0-9]*[0-9] rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
|
@ -157,7 +147,6 @@ profile calibre @{exec_path} {
|
|||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
|
||||
profile open {
|
||||
|
|
|
|||
|
|
@ -16,14 +16,13 @@ profile code @{exec_path} {
|
|||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/chromium-common>
|
||||
# The following doesn't seem to be needed
|
||||
##include <abstractions/mesa>
|
||||
##include <abstractions/consoles>
|
||||
##include <abstractions/audio>
|
||||
##include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
ptrace (read) peer=lsb_release,
|
||||
|
||||
|
|
@ -70,16 +69,12 @@ profile code @{exec_path} {
|
|||
owner @{MOUNTS}/*/code/ r,
|
||||
owner @{MOUNTS}/*/code/** rwkl -> @{MOUNTS}/*/code/**,
|
||||
|
||||
# To remove the following error:
|
||||
# Error initializing NSS with a persistent database
|
||||
deny owner @{HOME}/.pki/ rw,
|
||||
deny owner @{HOME}/.pki/nssdb/ rw,
|
||||
deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
# Needed or code gets crash with the following error:
|
||||
|
|
@ -106,9 +101,6 @@ profile code @{exec_path} {
|
|||
deny owner @{PROC}/@{pid}/net/if_inet6 r,
|
||||
deny owner @{PROC}/@{pids}/cmdline r,
|
||||
|
||||
deny /dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
|
|
@ -120,8 +112,6 @@ profile code @{exec_path} {
|
|||
# The irq file is needed to render pages.
|
||||
deny @{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner "/tmp/VSCode Crashes/" rw,
|
||||
owner /tmp/vscode-typescript[0-9]*/ rw,
|
||||
|
||||
|
|
@ -132,9 +122,5 @@ profile code @{exec_path} {
|
|||
# For installing extensions
|
||||
owner /tmp/@{uuid} rw,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/code>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,11 +6,13 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{DISCORD_LIBDIR} = /usr/share/discord
|
||||
@{DISCORD_HOMEDIR} = @{user_config_dirs}/discord
|
||||
@{DISCORD_CACHEDIR} = @{user_cache_dirs}/discord
|
||||
@{DISCORD_LIBDIR} = /usr/share/discord
|
||||
@{DISCORD_LIBDIR} += /usr/share/discord-ptb
|
||||
@{DISCORD_HOMEDIR} = @{HOME}/.config/discord
|
||||
@{DISCORD_HOMEDIR} += @{HOME}/.config/discordptb
|
||||
@{DISCORD_CACHEDIR} = @{HOME}/.cache/discord
|
||||
|
||||
@{exec_path} = @{DISCORD_LIBDIR}/Discord /{usr/,}bin/discord
|
||||
@{exec_path} = @{DISCORD_LIBDIR}/Discord{,PTB} /{usr/,}bin/discord{,-ptb}
|
||||
profile discord @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
|
@ -24,7 +26,7 @@ profile discord @{exec_path} {
|
|||
include <abstractions/mesa>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/chromium-common>
|
||||
|
||||
signal (send) set=(kill, term) peer=@{profile_name}//lsb_release,
|
||||
|
||||
|
|
@ -40,14 +42,6 @@ profile discord @{exec_path} {
|
|||
|
||||
@{exec_path} mrix,
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
|
|
@ -59,11 +53,8 @@ profile discord @{exec_path} {
|
|||
@{DISCORD_LIBDIR}/ r,
|
||||
@{DISCORD_LIBDIR}/** r,
|
||||
# @{DISCORD_LIBDIR}/**.so mr,
|
||||
# @{DISCORD_LIBDIR}/libEGL.so mr,
|
||||
# @{DISCORD_LIBDIR}/libGLESv2.so mr,
|
||||
# To remove the following error:
|
||||
# discord-canary: error while loading shared libraries: libffmpeg.so: cannot open shared object
|
||||
# file: No such file or directory
|
||||
@{DISCORD_LIBDIR}/libEGL.so mr,
|
||||
@{DISCORD_LIBDIR}/libGLESv2.so mr,
|
||||
@{DISCORD_LIBDIR}/libffmpeg.so mr,
|
||||
# @{DISCORD_LIBDIR}/swiftshader/libEGL.so mr,
|
||||
# @{DISCORD_LIBDIR}/swiftshader/libGLESv2.so mr,
|
||||
|
|
@ -85,7 +76,11 @@ profile discord @{exec_path} {
|
|||
owner @{PROC}/@{pids}/task/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/status r,
|
||||
deny @{PROC}/@{pids}/stat r,
|
||||
deny owner @{PROC}/@{pids}/statm r,
|
||||
# Needed to remove the following error:
|
||||
# Error occurred in handler for 'DISCORD_PROCESS_UTILS_GET_MEMORY_INFO': [Error: Failed to
|
||||
# create memory dump]
|
||||
owner @{PROC}/@{pids}/statm r,
|
||||
#
|
||||
deny @{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
|
|
@ -106,25 +101,11 @@ profile discord @{exec_path} {
|
|||
@{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
deny /dev/ r,
|
||||
deny /dev/shm/ rw,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/net-export/ rw,
|
||||
owner /tmp/discord.sock rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/ rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/discord1_[0-9]*.png rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/SingletonCookie rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/SS rw,
|
||||
owner "/tmp/Discord Crashes/" rw,
|
||||
|
||||
owner @{HOME}/.pki/ rw,
|
||||
owner @{HOME}/.pki/nssdb/ rw,
|
||||
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
owner @{run}/user/@{uid}/discord-ipc-[0-9] rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
|
|
|||
|
|
@ -14,7 +14,6 @@ include <tunables/global>
|
|||
|
||||
profile discord-chrome-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# For kernel unprivileged user namespaces
|
||||
capability sys_admin,
|
||||
|
|
|
|||
|
|
@ -23,7 +23,6 @@ profile dropbox @{exec_path} {
|
|||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
ptrace peer=@{profile_name},
|
||||
|
||||
|
|
|
|||
|
|
@ -15,7 +15,6 @@ profile filezilla @{exec_path} {
|
|||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
signal (send) set=(term, kill) peer=fzsftp,
|
||||
|
||||
|
|
|
|||
|
|
@ -23,7 +23,6 @@ profile flameshot @{exec_path} {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -68,7 +67,6 @@ profile flameshot @{exec_path} {
|
|||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
|
||||
profile open {
|
||||
|
|
|
|||
|
|
@ -25,16 +25,7 @@ profile freetube @{exec_path} {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
include <abstractions/chromium-common>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -55,17 +46,6 @@ profile freetube @{exec_path} {
|
|||
owner @{user_config_dirs}/FreeTube/ rw,
|
||||
owner @{user_config_dirs}/FreeTube/** rwk,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.*/ rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
|
||||
owner /tmp/.org.chromium.Chromium.*/SS w,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/net-export/ rw,
|
||||
|
||||
/dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
# The /proc/ dir is needed to avoid the following error:
|
||||
# traps: freetube[] trap int3 ip:56499eca9d26 sp:7ffcab073060 error:0 in
|
||||
# freetube[56499b8a8000+531e000]
|
||||
|
|
@ -84,8 +64,13 @@ profile freetube @{exec_path} {
|
|||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
deny @{PROC}/vmstat r,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
owner @{user_share_dirs} r,
|
||||
|
|
@ -97,10 +82,6 @@ profile freetube @{exec_path} {
|
|||
# The irq file is needed to render pages.
|
||||
deny @{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
# Needed?
|
||||
deny owner @{HOME}/.pki/ rw,
|
||||
deny owner @{HOME}/.pki/** rwk,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
|
|
|
|||
|
|
@ -15,7 +15,6 @@ include <tunables/global>
|
|||
profile freetube-chrome-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
capability sys_admin,
|
||||
capability setgid,
|
||||
|
|
|
|||
|
|
@ -25,7 +25,6 @@ profile okular @{exec_path} {
|
|||
include <abstractions/kde-icon-cache-write>
|
||||
include <abstractions/qt5-settings-write>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -22,19 +22,11 @@ profile signal-desktop @{exec_path} {
|
|||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/chromium-common>
|
||||
|
||||
# Needed?
|
||||
deny capability sys_ptrace,
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
|
|
@ -59,18 +51,8 @@ profile signal-desktop @{exec_path} {
|
|||
@{SIGNAL_HOMEDIR}/ rw,
|
||||
@{SIGNAL_HOMEDIR}/** rwk,
|
||||
|
||||
#owner @{HOME}/.pki/nssdb/pkcs11.txt r,
|
||||
#owner @{HOME}/.pki/nssdb/cert9.db rwk,
|
||||
#owner @{HOME}/.pki/nssdb/key4.db rwk,
|
||||
|
||||
# Signal wants the /tmp/ dir to be mounted with the "exec" flag. If this is not acceptable in
|
||||
# your system, use the TMPDIR variable to set some other tmp dir.
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.*/ rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
|
||||
owner /tmp/.org.chromium.Chromium.*/SS w,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
/var/tmp/ r,
|
||||
owner @{SIGNAL_HOMEDIR}/tmp/.org.chromium.Chromium.* mrw,
|
||||
|
||||
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
|
|
@ -90,9 +72,6 @@ profile signal-desktop @{exec_path} {
|
|||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
@{PROC}/vmstat r,
|
||||
|
||||
deny /dev/shm/ r,
|
||||
/dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,6 @@ include <tunables/global>
|
|||
@{exec_path} = "/opt/Signal{, Beta}/chrome-sandbox"
|
||||
profile signal-desktop-chrome-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ profile spotify @{exec_path} {
|
|||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/chromium-common>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
@ -57,8 +57,6 @@ profile spotify @{exec_path} {
|
|||
|
||||
/etc/fstab r,
|
||||
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
deny @{sys}/devices/virtual/tty/tty[0-9]*/active r,
|
||||
# To remove the following error:
|
||||
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
|
||||
|
|
@ -69,19 +67,10 @@ profile spotify @{exec_path} {
|
|||
|
||||
/usr/share/X11/XErrorDB r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
|
||||
|
||||
# What's this for?
|
||||
#owner /tmp/[0-9]*.[0-9]*.[0-9]*.[0-9]*-linux-*.zip rw,
|
||||
|
||||
/var/tmp/ r,
|
||||
|
||||
deny owner @{HOME}/.pki/ rw,
|
||||
deny owner @{HOME}/.pki/nssdb/ rw,
|
||||
deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
include if exists <local/spotify>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -27,8 +27,6 @@ profile telegram-desktop @{exec_path} {
|
|||
include <abstractions/enchant>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -76,6 +74,10 @@ profile telegram-desktop @{exec_path} {
|
|||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
# Needed when saving files as, or otherwise the app crashes
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
|
|
|
|||
|
|
@ -30,8 +30,6 @@ profile thunderbird @{exec_path} {
|
|||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
ptrace peer=@{profile_name},
|
||||
|
||||
|
|
@ -93,6 +91,10 @@ profile thunderbird @{exec_path} {
|
|||
owner @{HOME}/Mail/ rw,
|
||||
owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
# Fix error in libglib while saving files as
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
|
|
@ -187,7 +189,6 @@ profile thunderbird @{exec_path} {
|
|||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
|
||||
profile gpg {
|
||||
|
|
|
|||
|
|
@ -108,7 +108,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
|
|||
owner @{libo_user_dirs}/**/ rw, #allow creating directories that we own
|
||||
owner @{libo_user_dirs}/**~lock.* rw, #lock file support
|
||||
owner @{libo_user_dirs}/**.@{libreoffice_ext} rwk, #Open files rw with the right exts
|
||||
owner @{libo_user_dirs}/{,**/}lu???????????{,?}.tmp rwk, #Temporary file used when saving
|
||||
owner @{libo_user_dirs}/{,**/}lu????????{,?,??,???,????}.tmp rwk, #Temporary file used when saving
|
||||
owner @{libo_user_dirs}/{,**/}.directory r, #Read directory settings on KDE
|
||||
|
||||
# Settings
|
||||
|
|
|
|||
|
|
@ -70,7 +70,6 @@ profile vlc @{exec_path} {
|
|||
include <abstractions/private-files-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
signal (receive) set=(term, kill) peer=anyremote//*,
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue