felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): replace old audio abstraction by the new stack.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-12 15:39:10 +00:00
parent b1235b0c52
commit e4c0f683d2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
62 changed files with 81 additions and 173 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/profiles-s-z/scrcpy
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/scrcpy
profile scrcpy @{exec_path} {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/graphics>
@ -31,13 +32,6 @@ profile scrcpy @{exec_path} {
owner @{user_config_dirs}/ibus/bus/ r,
owner @{user_config_dirs}/ibus/bus/@{md5}-unix-{,wayland-}@{int} r,
owner @{user_config_dirs}/pulse/client.conf r,
owner @{user_config_dirs}/pulse/cookie r,
owner @{user_config_dirs}/pulse/cookie rk,
owner @{run}/user/@{uid}/pulse/ r,
/dev/shm/ r,
deny @{user_share_dirs}/gvfs-metadata/* r,

2
apparmor.d/profiles-s-z/smplayer
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/smplayer
profile smplayer @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/consoles>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>

9
apparmor.d/profiles-s-z/spice-vdagent
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/spice-vdagent
profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio2>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
@ -36,10 +36,6 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/usr/share/pipewire/client-rt.conf r,
/etc/pipewire/client.conf r,
/var/lib/gdm{3,}/.config/pulse/cookie rk,
/var/lib/gdm{3,}/.config/user-dirs.dirs r,
@ -47,8 +43,7 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/user-dirs.dirs r,
@{run}/spice-vdagentd/spice-vdagent-sock rw,
owner @{run}/user/@{uid}/pipewire-@{int} rw,
@{run}/spice-vdagentd/spice-vdagent-sock rw,
owner @{PROC}/@{pids}/task/@{tid}/comm rw,

8
apparmor.d/profiles-s-z/spotify
View file

@ -15,6 +15,7 @@ include <tunables/global>
@{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name}
profile spotify @{exec_path} {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/chromium-common>
include <abstractions/dconf-write>
include <abstractions/desktop>
@ -44,8 +45,6 @@ profile spotify @{exec_path} {
owner @{user_music_dirs}/{,**} r,
owner @{user_config_dirs}/pulse/client.conf r,
owner @{user_config_dirs}/pulse/cookie rk,
owner @{user_config_dirs}/spotify-adblock/* r,
owner @{config_dirs}/ rw,
@ -56,8 +55,6 @@ profile spotify @{exec_path} {
owner @{cache_dirs}/** rwk -> @{cache_dirs}/**,
owner @{cache_dirs}/WidevineCdm/**/libwidevinecdm.so rm,
owner @{run}/user/@{uid}/pulse/ r,
@{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/dmi/id/board_{vendor,name,version} r,
@{sys}/devices/virtual/dmi/id/product_{name,version} r,
@ -76,8 +73,7 @@ profile spotify @{exec_path} {
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/task/@{tid}/status r,
/dev/tty rw,
owner /dev/shm/pulse-shm-@{int} r,
/dev/tty rw,
deny @{user_share_dirs}/gvfs-metadata/* r,

2
apparmor.d/profiles-s-z/steam
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{user_share_dirs}/Steam/steam.sh
profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/chromium-common>
include <abstractions/consoles>
include <abstractions/dconf-write>

2
apparmor.d/profiles-s-z/steam-game
View file

@ -23,7 +23,7 @@ include <tunables/global>
@{exec_path} = @{user_share_dirs}/Steam/steamapps/common/*/**
profile steam-game @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/bwrap>
include <abstractions/desktop>
include <abstractions/devices-usb>

2
apparmor.d/profiles-s-z/steam-gameoverlayui
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{steam_lib_dirs}/gameoverlayui
profile steam-gameoverlayui @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/desktop>
include <abstractions/graphics>

2
apparmor.d/profiles-s-z/strawberry
View file

@ -18,7 +18,7 @@ profile strawberry @{exec_path} {
include <abstractions/fontconfig-cache-read>
include <abstractions/dri-enumerate>
include <abstractions/mesa>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/qt5-compose-cache-write>
include <abstractions/qt5-settings-write>
include <abstractions/nameservice-strict>

3
apparmor.d/profiles-s-z/thunderbird
View file

@ -15,7 +15,7 @@ include <tunables/global>
@{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name}
profile thunderbird @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.a11y>
@ -95,7 +95,6 @@ profile thunderbird @{exec_path} {
/usr/share/lightning/{,**} r,
/usr/share/mozilla/extensions/{,**} r,
/usr/share/qt5ct/** r,
/usr/share/sounds/freedesktop/stereo/*.oga r,
/usr/share/xul-ext/kwallet5/* r,
/etc/@{name}/{,**} r,

2
apparmor.d/profiles-s-z/utox
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/utox
profile utox @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>

2
apparmor.d/profiles-s-z/vidcutter
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/vidcutter
profile vidcutter @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/dconf-write>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>

2
apparmor.d/profiles-s-z/virt-manager
View file

@ -11,7 +11,7 @@ include <tunables/global>
@{exec_path} += /usr/share/virt-manager/virt-manager
profile virt-manager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/devices-usb>

2
apparmor.d/profiles-s-z/vlc
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/{c,}vlc
profile vlc @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus/org.a11y>

2
apparmor.d/profiles-s-z/volumeicon
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/volumeicon
profile volumeicon @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/desktop>

4
apparmor.d/profiles-s-z/wireplumber
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/wireplumber
profile wireplumber @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio2>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.RealtimeKit1>
@ -49,8 +49,6 @@ profile wireplumber @{exec_path} {
owner @{user_state_dirs}/ w,
owner @{user_state_dirs}/wireplumber/{,**} rw,
@{run}/user/@{uid}/pipewire-@{int} rw,
@{run}/systemd/users/@{uid} r,
@{run}/udev/data/c14:@{int} r, # Open Sound System (OSS)

2
apparmor.d/profiles-s-z/youtube-dl
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/youtube-dl
profile youtube-dl @{exec_path} {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/audio-client>
include <abstractions/consoles>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>