felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): dbus rules cleanup (3)

Browse source
This commit is contained in:
Alexandre Pujol 2023-11-30 23:20:29 +00:00
parent cd391bae01
commit d75fa9bbd5
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
47 changed files with 176 additions and 438 deletions
Download patch file Download diff file Expand all files Collapse all files

38
apparmor.d/groups/freedesktop/pulseaudio
View file

@ -38,6 +38,12 @@ profile pulseaudio @{exec_path} {
network bluetooth stream,
network bluetooth seqpacket,
dbus bind bus=session name=org.freedesktop.ReserveDevice[0-9].Audio[0-9],
dbus bind bus=session name=org.PulseAudio[0-9],
dbus bind bus=session name=org.pulseaudio*,
dbus send bus=session path=/Client[0-9]*/EntryGroup[0-9]*
interface=org.freedesktop.Avahi.EntryGroup
member={GetState,AddService,AddServiceSubtype,Commit}
@ -63,11 +69,6 @@ profile pulseaudio @{exec_path} {
member=Free
peer=(name=org.freedesktop.Avahi),
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,ReleaseName}
peer=(name=org.freedesktop.DBus),
dbus receive bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,RequestName,ReleaseName}
@ -78,21 +79,6 @@ profile pulseaudio @{exec_path} {
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.freedesktop.ReserveDevice[0-9].Audio[0-9],
dbus bind bus=session
name=org.PulseAudio[0-9],
dbus bind bus=session
name=org.pulseaudio*,
dbus send bus=system
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/RealtimeKit1
member={Get,MakeThreadHighPriority,MakeThreadRealtime}
peer=(name=org.freedesktop.RealtimeKit1),
@ -118,19 +104,19 @@ profile pulseaudio @{exec_path} {
peer=(name=org.freedesktop.Avahi),
dbus send bus=system path=/
interface=org.freedesktop.hostname[0-9]
interface=org.freedesktop.hostname1
member=Get
peer=(name=/org/freedesktop/hostname[0-9]),
peer=(name=/org/freedesktop/hostname1),
dbus send bus=system path=/org/freedesktop/hostname[0-9]
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=/org/freedesktop/hostname[0-9]),
peer=(name=/org/freedesktop/hostname1),
dbus send bus=system path=/org/freedesktop/hostname[0-9]
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.hostname[0-9]),
peer=(name=org.freedesktop.hostname1),
dbus receive bus=system path=/org/bluez/hci*/**
interface=org.freedesktop.DBus.Properties

9
apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile xdg-desktop-portal-gtk @{exec_path} {
include <abstractions/base>
include <abstractions/bus/atspi>
include <abstractions/bus/vfs>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
@ -84,11 +85,6 @@ profile xdg-desktop-portal-gtk @{exec_path} {
member={RunningApplicationsChanged,WindowsChanged}
peer=(name=:*, label=gnome-shell),
dbus send bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus send bus=session path=/org/gnome/ScreenSaver
interface=org.freedesktop.DBus.Properties
member=GetAll
@ -119,9 +115,6 @@ profile xdg-desktop-portal-gtk @{exec_path} {
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus bind bus=session
name=org.freedesktop.impl.portal.desktop.gtk,
@{exec_path} mr,
/usr/share/X11/xkb/{,**} r,

2
apparmor.d/groups/freedesktop/xorg
View file

@ -50,7 +50,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/login1/session/*
interface=org.freedesktop.login1.Session
member=PauseDevice,
member=PauseDevice
peer=(name=org.freedesktop.login1, label=systemd-logind),
@{exec_path} mrix,