Merge branch 'master' into ubuntu2204__2
This commit is contained in:
nobodysu
GitHub
commit
e65a78972b
483 changed files with 7221 additions and 2538 deletions
|
|
@ -9,25 +9,50 @@ include <tunables/global>
|
|||
|
||||
@{exec_path} = /{usr/,}lib/accountsservice/accounts-daemon
|
||||
@{exec_path} += @{libexec}/accounts-daemon
|
||||
profile accounts-daemon @{exec_path} {
|
||||
profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability dac_read_search,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_nice,
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read) peer=unconfined,
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
|
||||
interface=org.freedesktop.{DBus.{Properties,Introspectable},Accounts{,.User}},
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
|
||||
interface=org.freedesktop.PolicyKit[0-9].Authority
|
||||
member={CheckAuthorization,Changed},
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={RequestName,GetConnectionUnixUser}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.Accounts,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/language-tools/language-validate rPx,
|
||||
|
||||
/usr/share/accountsservice/{,**} r,
|
||||
/usr/share/dbus-1/interfaces/*.xml r,
|
||||
|
||||
/etc/gdm/ r,
|
||||
/etc/gdm/custom.conf rw,
|
||||
/etc/gdm/custom.conf.* rw,
|
||||
/etc/default/locale r,
|
||||
/etc/gdm{3,}/ r,
|
||||
/etc/gdm{3,}/custom.conf rw,
|
||||
/etc/gdm{3,}/custom.conf.* rw,
|
||||
/etc/machine-id r,
|
||||
/etc/shadow r,
|
||||
/etc/shells r,
|
||||
|
|
@ -35,6 +60,8 @@ profile accounts-daemon @{exec_path} {
|
|||
owner /var/lib/AccountsService/ r,
|
||||
owner /var/lib/AccountsService/** rw,
|
||||
|
||||
@{HOME}/ r,
|
||||
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/cmdline r,
|
||||
|
|
|
|||
|
|
@ -11,11 +11,13 @@ include <tunables/global>
|
|||
@{exec_path} += @{libexec}/at-spi-bus-launcher
|
||||
profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/dbus-session>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (receive) set=(term hup kill) peer=dbus-daemon,
|
||||
signal (receive) set=(term hup kill) peer=gdm*,
|
||||
signal (receive) set=(term hup kill) peer=gnome-session-binary,
|
||||
signal (send) set=(term hup kill) peer=dbus-daemon,
|
||||
|
||||
network inet stream,
|
||||
|
|
@ -33,11 +35,8 @@ profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{HOME}/.Xauthority r,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner @{run}/user/@{uid}/at-spi/{,bus} rw,
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
||||
|
||||
|
||||
/var/lib/lightdm/.Xauthority r,
|
||||
/var/lib/gdm/.config/dconf/user r,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -10,21 +11,20 @@ include <tunables/global>
|
|||
@{exec_path} += @{libexec}/at-spi2-registryd
|
||||
profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# Needed?
|
||||
deny capability sys_nice,
|
||||
|
||||
signal (receive) set=(term hup) peer=gdm*,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
/var/lib/lightdm/.Xauthority r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/at-spi2-registryd>
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2018-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -11,11 +11,30 @@ include <tunables/global>
|
|||
@{exec_path} += @{libexec}/colord
|
||||
profile colord @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/devices-usb>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/ColorManager{,/**}
|
||||
interface=org.freedesktop.{DBus.Properties,ColorManager*},
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName},
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
|
||||
interface=org.freedesktop.PolicyKit[0-9].Authority
|
||||
member=CheckAuthorization,
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.ColorManager,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/colord/colord-sane rPx,
|
||||
|
|
@ -37,7 +56,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{user_share_dirs}/icc/edid-*.icc r,
|
||||
|
||||
@{run}/systemd/sessions/[0-9]* r,
|
||||
@{run}/systemd/sessions/* r,
|
||||
|
||||
@{sys}/class/drm/ r,
|
||||
@{sys}/class/video4linux/ r,
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -8,25 +9,41 @@ include <tunables/global>
|
|||
|
||||
@{exec_path} = /{usr/,}lib/colord/colord-sane
|
||||
@{exec_path} += @{libexec}/colord-sane
|
||||
profile colord-sane @{exec_path} flags=(complain) {
|
||||
profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/devices-usb>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network netlink raw,
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/ColorManager
|
||||
interface=org.freedesktop.{DBus.Properties,ColorManager},
|
||||
|
||||
dbus send bus=system path=/
|
||||
interface=org.freedesktop.{DBus.Peer,Avahi.Server}
|
||||
member={GetAPIVersion,GetState,ServiceBrowserNew,Ping}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]
|
||||
interface=org.freedesktop.Avahi.ServiceBrowser
|
||||
member={CacheExhausted,AllForNow},
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/sane.d/{,**} r,
|
||||
/usr/share/snmp/mibs/{,*} r,
|
||||
|
||||
/etc/sane.d/{,**} r,
|
||||
/etc/snmp/snmp.conf r,
|
||||
|
||||
/var/lib/snmp/{mib,cert}_indexes/ rw,
|
||||
/var/lib/snmp/mibs/{iana,ietf}/ r,
|
||||
/var/lib/snmp/mibs/{iana,ietf}/[A-Z]* r,
|
||||
|
||||
/var/lib/snmp/{mib,cert}_indexes/ rw,
|
||||
/usr/share/snmp/mibs/{,*} r,
|
||||
@{run}/systemd/journal/socket rw,
|
||||
|
||||
@{sys}/bus/scsi/devices/ r,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/{vendor,model,type} r,
|
||||
|
||||
@{PROC}/sys/dev/parport/ r,
|
||||
|
|
|
|||
|
|
@ -6,7 +6,8 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/colord/colord-session @{libexec}/colord-session
|
||||
@{exec_path} = /{usr/,}lib/colord/colord-session
|
||||
@{exec_path} += @{libexec}/colord-session
|
||||
profile colord-session @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
|
||||
|
|
|
|||
|
|
@ -9,17 +9,14 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/dconf
|
||||
profile dconf @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
|
||||
capability sys_nice,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/dconf/{,**} r,
|
||||
/etc/dconf/db/** rw,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
owner @{user_config_dirs}/dconf/ rw,
|
||||
owner @{user_config_dirs}/dconf/user{,.*} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -9,16 +10,15 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/dconf-editor
|
||||
profile dconf-editor @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/gtk>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
/usr/share/glib-2.0/schemas/{,*} r,
|
||||
|
||||
# When GSETTINGS_BACKEND=keyfile
|
||||
owner @{user_config_dirs}/glib-2.0/ rw,
|
||||
|
|
@ -26,11 +26,7 @@ profile dconf-editor @{exec_path} {
|
|||
owner @{user_config_dirs}/glib-2.0/settings/keyfile rw,
|
||||
owner @{user_config_dirs}/glib-2.0/settings/.goutputstream-* rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/{,*} r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/dconf-editor>
|
||||
|
|
|
|||
|
|
@ -9,18 +9,14 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}lib/dconf/dconf-service @{libexec}/dconf-service
|
||||
profile dconf-service @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
# Needed?
|
||||
deny capability sys_nice,
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dconf-write>
|
||||
|
||||
signal (receive) set=(term kill hup) peer=dbus-daemon,
|
||||
signal (receive) set=(term hup) peer=gdm*,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
owner @{user_config_dirs}/dconf/ rw,
|
||||
owner @{user_config_dirs}/dconf/user{,.*} rw,
|
||||
|
||||
|
|
|
|||
16
apparmor.d/groups/freedesktop/desktop-file-install
Normal file
16
apparmor.d/groups/freedesktop/desktop-file-install
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/desktop-file-install
|
||||
profile desktop-file-install @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/desktop-file-install>
|
||||
}
|
||||
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/fc-cache{,-32}
|
||||
@{exec_path} = /{snap/snapd/[0-9]*/,}{usr/,}bin/fc-cache{,-32,-v*}
|
||||
profile fc-cache @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/fonts>
|
||||
|
|
|
|||
|
|
@ -7,15 +7,65 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{libexec}/geoclue
|
||||
profile geoclue @{exec_path} {
|
||||
profile geoclue @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
|
||||
interface=org.freedesktop.{DBus.Properties,GeoClue2*},
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={GetConnectionUnixProcessID,GetConnectionUnixUser,ReleaseName,RequestName}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus send bus=system path=/
|
||||
interface=org.freedesktop.Avahi.Server
|
||||
member={GetAPIVersion,GetState,ServiceBrowserNew},
|
||||
|
||||
dbus send bus=system path=/
|
||||
interface=org.freedesktop.DBus.Peer
|
||||
member=Ping,
|
||||
|
||||
dbus send bus=system path=/fi/w[0-9]/wpa_supplicant[0-9]
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/ModemManager[0-9]
|
||||
interface=org.freedesktop.DBus.ObjectManager
|
||||
member=GetManagedObjects,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member={GetAll,PropertiesChanged},
|
||||
|
||||
dbus receive bus=system path=/
|
||||
interface=org.freedesktop.Avahi.Server
|
||||
member=StateChanged,
|
||||
|
||||
dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]
|
||||
interface=org.freedesktop.Avahi.ServiceBrowser
|
||||
member={AllForNow,CacheExhausted},
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.NetworkManager
|
||||
member={CheckPermissions,StateChanged,PropertiesChanged},
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged,
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.GeoClue2,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/geoclue/{,**} r,
|
||||
|
||||
@{run}/systemd/journal/socket rw,
|
||||
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
|
||||
include if exists <local/geoclue>
|
||||
|
|
|
|||
|
|
@ -11,12 +11,26 @@ include <tunables/global>
|
|||
profile pipewire @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit[0-9]
|
||||
interface=org.freedesktop.RealtimeKit[0-9]
|
||||
member=MakeThread*
|
||||
peer=(name=org.freedesktop.RealtimeKit[0-9]),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit[0-9]
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(name=org.freedesktop.RealtimeKit[0-9]),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/pipewire-media-session rPx,
|
||||
|
||||
/usr/share/pipewire/pipewire.conf r,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ include <tunables/global>
|
|||
profile pipewire-media-session @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
|
|
@ -19,6 +20,16 @@ profile pipewire-media-session @{exec_path} {
|
|||
network bluetooth stream,
|
||||
network netlink raw,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit[0-9]
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(name=org.freedesktop.RealtimeKit1),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit[0-9]
|
||||
interface=org.freedesktop.RealtimeKit1
|
||||
member=MakeThreadRealtime
|
||||
peer=(name=org.freedesktop.RealtimeKit1),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/alsa-card-profile/{,**} r,
|
||||
|
|
|
|||
|
|
@ -16,5 +16,7 @@ profile plymouth-set-default-theme @{exec_path} {
|
|||
/{usr/,}bin/grep rix,
|
||||
/{usr/,}bin/plymouth rPx,
|
||||
|
||||
/etc/plymouth/{,*} r,
|
||||
|
||||
include if exists <local/plymouth-set-default-theme>
|
||||
}
|
||||
52
apparmor.d/groups/freedesktop/plymouthd
Normal file
52
apparmor.d/groups/freedesktop/plymouthd
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}{s,}bin/plymouthd
|
||||
profile plymouthd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dri-common>
|
||||
|
||||
capability sys_admin,
|
||||
capability sys_tty_config,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
signal (send) peer=unconfined,
|
||||
|
||||
unix type=stream addr="@/org/freedesktop/plymouthd",
|
||||
unix type=stream peer=(addr="@/org/freedesktop/plymouthd"),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/plymouth/{,**} r,
|
||||
|
||||
/etc/default/keyboard r,
|
||||
/etc/plymouth/plymouthd.conf r,
|
||||
/etc/vconsole.conf r,
|
||||
|
||||
@{run}/udev/data/+drm:* r,
|
||||
@{run}/udev/data/c226:* r,
|
||||
@{run}/udev/data/c29:* r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/drm/ r,
|
||||
@{sys}/class/graphics/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/{,uevent} r,
|
||||
@{sys}/devices/virtual/graphics/fbcon/uevent r,
|
||||
@{sys}/devices/virtual/tty/console/active r,
|
||||
@{sys}/firmware/acpi/bgrt/{,*} r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
/dev/ptmx rw,
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/plymouthd>
|
||||
}
|
||||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -9,14 +10,15 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}lib/@{multiarch}/polkit-mate/polkit-mate-authentication-agent-[0-9]
|
||||
profile polkit-mate-authentication-agent @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (send) set=(term, kill) peer=polkit-agent-helper,
|
||||
|
||||
|
|
@ -24,25 +26,19 @@ profile polkit-mate-authentication-agent @{exec_path} {
|
|||
|
||||
/{usr/,}lib/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
|
||||
|
||||
@{PROC}/1/cgroup r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/X11/xkb/** r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
include <abstractions/dconf>
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
/usr/share/X11/xkb/** r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
@{PROC}/1/cgroup r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/polkit-mate-authentication-agent>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ profile polkitd @{exec_path} {
|
|||
capability setuid,
|
||||
capability sys_nice,
|
||||
capability sys_ptrace,
|
||||
audit deny capability net_admin,
|
||||
audit capability net_admin,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -14,9 +15,13 @@ profile pulseaudio @{exec_path} {
|
|||
include <abstractions/consoles>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/hosts_access>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
|
|
@ -29,65 +34,20 @@ profile pulseaudio @{exec_path} {
|
|||
network bluetooth stream,
|
||||
network bluetooth seqpacket,
|
||||
|
||||
@{exec_path} mrix,
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/Client0/EntryGroup[0-9]*
|
||||
interface=org.freedesktop.Avahi.EntryGroup
|
||||
member={GetState,AddService,AddServiceSubtype,Commit}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
/{usr/,}lib{exec,}/pulse/gsettings-helper mrix,
|
||||
/{usr/,}lib/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner mrix,
|
||||
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
|
||||
dbus (receive)
|
||||
bus=session
|
||||
path=/Client0/EntryGroup[0-9]*
|
||||
interface=org.freedesktop.Avahi.EntryGroup
|
||||
member=StateChanged
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
# PulseAudio files
|
||||
/usr/share/pulseaudio/{,**} r,
|
||||
/{usr/,}lib/pulse-*/modules/*.so mr,
|
||||
|
||||
# PulseAudio home config files
|
||||
owner @{user_config_dirs}/pulse/{,**} rw,
|
||||
owner @{user_config_dirs}/dconf/user r,
|
||||
|
||||
owner @{user_cache_dirs}/gstreamer-1.0/registry.x86_64.bin r,
|
||||
|
||||
# Needed when PulseAudio is started via the start-pulseaudio-x11 script
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# Needed when PulseAudio is started via gdm
|
||||
owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.* r,
|
||||
owner @{HOME}/.ICEauthority r,
|
||||
|
||||
# TCP wrap
|
||||
/etc/hosts.{allow,deny} r,
|
||||
|
||||
owner @{run}/user/@{uid}/ rw,
|
||||
owner @{run}/user/@{uid}/pulse/{,*} rw,
|
||||
owner @{run}/user/@{uid}/pulse/*.lock k,
|
||||
|
||||
/usr/share/applications/{,**} r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/sound/ r,
|
||||
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,
|
||||
@{run}/udev/data/+sound* r,
|
||||
@{run}/udev/data/c116:[0-9]* r, # For ALSA
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]/meminfo r,
|
||||
|
||||
deny @{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/ICEauthority r,
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
|
||||
owner @{PROC}/@{pids}/fd/ r,
|
||||
owner @{PROC}/@{pids}/stat r,
|
||||
owner @{PROC}/@{pids}/cmdline r,
|
||||
|
||||
# DBus
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/freedesktop/DBus
|
||||
|
|
@ -138,15 +98,47 @@ profile pulseaudio @{exec_path} {
|
|||
interface=org.freedesktop.DBus.ObjectManager
|
||||
member=GetManagedObjects
|
||||
peer=(name=org.bluez),
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.DBus.Peer
|
||||
member=Ping
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.X11-unix/*),
|
||||
unix (send receive connect) type=stream peer=(addr=@/tmp/.ICE-unix/*),
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.Avahi.Server
|
||||
member={GetAPIVersion,GetState,EntryGroupNew}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
# The orcexec.* file is JIT compiled code for various GStreamer elements.
|
||||
# If one is blocked the next is used instead.
|
||||
owner @{run}/user/@{uid}/orcexec.* mrw,
|
||||
#owner @{HOME}/orcexec.* mrw,
|
||||
#owner /tmp/orcexec.* mrw,
|
||||
dbus (receive)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.Avahi.Server
|
||||
member=StateChanged
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.hostname[0-9]
|
||||
member=Get
|
||||
peer=(name=/org/freedesktop/hostname[0-9]),
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}@{libexec}/pulse/gsettings-helper mrix,
|
||||
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
|
||||
/{usr/,}lib/pulse-*/modules/*.so mr,
|
||||
|
||||
/usr/share/applications/{,**} r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/pulseaudio/{,**} r,
|
||||
/usr/share/ubuntu/applications/{,*} r,
|
||||
|
||||
/var/lib/snapd/desktop/applications/ r,
|
||||
|
||||
# For GDM
|
||||
owner /var/lib/gdm{[1-9],}/.config/pulse/{,**} rw,
|
||||
|
|
@ -164,13 +156,33 @@ profile pulseaudio @{exec_path} {
|
|||
owner /var/lib/lightdm/.config/pulse/{,**} rw,
|
||||
owner /var/lib/lightdm/.config/pulse/cookie k,
|
||||
|
||||
owner @{user_config_dirs}/pulse/{,**} rw,
|
||||
|
||||
owner @{user_cache_dirs}/gstreamer-1.0/registry.x86_64.bin r,
|
||||
|
||||
owner @{run}/user/@{uid}/ rw,
|
||||
owner @{run}/user/@{uid}/pulse/{,*} rw,
|
||||
owner @{run}/user/@{uid}/pulse/*.lock k,
|
||||
owner @{run}/user/@{uid}/systemd/notify rw,
|
||||
|
||||
@{run}/systemd/users/@{uid} r,
|
||||
|
||||
@{run}/udev/data/+sound* r,
|
||||
@{run}/udev/data/c116:[0-9]* r, # For ALSA
|
||||
|
||||
@{sys}/class/sound/ r,
|
||||
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,
|
||||
@{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
|
||||
|
||||
deny @{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
owner @{PROC}/@{pids}/fd/ r,
|
||||
owner @{PROC}/@{pids}/stat r,
|
||||
owner @{PROC}/@{pids}/cmdline r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# Snap
|
||||
/var/lib/snapd/desktop/applications/ r,
|
||||
/usr/{local/,}share/ubuntu/applications/{,*} r,
|
||||
|
||||
include if exists <local/pulseaudio>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,12 +24,15 @@ profile update-desktop-database @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
/usr/share/*/*.desktop r,
|
||||
|
||||
/var/lib/flatpak/exports/share/applications/{,**/} r,
|
||||
/var/lib/flatpak/exports/share/applications/**.desktop r,
|
||||
/var/lib/flatpak/exports/share/applications/.mimeinfo.cache.* rw,
|
||||
/var/lib/flatpak/exports/share/applications/mimeinfo.cache w,
|
||||
/var/lib/flatpak/{app/**/,}exports/share/applications/{,**/} r,
|
||||
/var/lib/flatpak/{app/**/,}exports/share/applications/**.desktop r,
|
||||
/var/lib/flatpak/{app/**/,}exports/share/applications/.mimeinfo.cache.* rw,
|
||||
/var/lib/flatpak/{app/**/,}exports/share/applications/mimeinfo.cache w,
|
||||
|
||||
/var/lib/flatpak/app/**/export/share/applications/**.desktop r,
|
||||
/var/lib/snapd/desktop/applications/{,**/} r,
|
||||
/var/lib/snapd/desktop/applications/**.desktop r,
|
||||
/var/lib/snapd/desktop/applications/.mimeinfo.cache.* rw,
|
||||
/var/lib/snapd/desktop/applications/mimeinfo.cache w,
|
||||
|
||||
# Inherit silencer
|
||||
deny network inet6 stream,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ profile upower @{exec_path} {
|
|||
include <abstractions/base>
|
||||
|
||||
# Needed?
|
||||
deny capability sys_nice,
|
||||
audit capability sys_nice,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2018-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -10,36 +11,42 @@ include <tunables/global>
|
|||
@{exec_path} += @{libexec}/upowerd
|
||||
profile upowerd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/devices-usb>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/UPower{,/**}
|
||||
interface=org.freedesktop.{DBus.Properties,DBus.Introspectable,UPower*},
|
||||
|
||||
dbus (send,receive) bus=system path=/org/freedesktop/login[0-9]
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member={PropertiesChanged,GetAll},
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/login[0-9]
|
||||
interface=org.freedesktop.login[0-9].Manager
|
||||
member=Inhibit,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member=RequestName
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/login[0-9]
|
||||
interface=org.freedesktop.login[0-9].Manager
|
||||
member={SessionNew,SessionRemoved,PrepareForShutdown},
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.UPower,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# UPower config file
|
||||
/etc/UPower/ r,
|
||||
/etc/UPower/UPower.conf r,
|
||||
|
||||
# The history data for the power device
|
||||
/var/lib/upower/ r,
|
||||
/var/lib/upower/history-*.dat{,.*} rw,
|
||||
|
||||
# Are all of these needed? (#FIXME#)
|
||||
/dev/input/event* r,
|
||||
@{sys}/bus/hid/devices/ r,
|
||||
@{sys}/class/leds/ r,
|
||||
@{sys}/class/power_supply/ r,
|
||||
@{sys}/class/input/ r,
|
||||
@{sys}/devices/ r,
|
||||
@{sys}/devices/**/power_supply/**/* r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/devices/**/capabilities/* r,
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
|
||||
@{sys}/devices/platform/**/leds/**/max_brightness r,
|
||||
@{sys}/devices/platform/**/leds/**/brightness rw,
|
||||
@{sys}/devices/platform/**/leds/**/brightness_hw_changed r,
|
||||
|
||||
@{run}/udev/data/ r,
|
||||
@{run}/udev/data/+power_supply* r,
|
||||
@{run}/udev/data/+input* r,
|
||||
|
|
@ -48,5 +55,20 @@ profile upowerd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
||||
|
||||
@{sys}/bus/hid/devices/ r,
|
||||
@{sys}/class/input/ r,
|
||||
@{sys}/class/leds/ r,
|
||||
@{sys}/class/power_supply/ r,
|
||||
@{sys}/devices/ r,
|
||||
@{sys}/devices/**/capabilities/* r,
|
||||
@{sys}/devices/**/power_supply/**/* r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/devices/platform/**/leds/**/brightness rw,
|
||||
@{sys}/devices/platform/**/leds/**/brightness_hw_changed r,
|
||||
@{sys}/devices/platform/**/leds/**/max_brightness r,
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
|
||||
/dev/input/event* r,
|
||||
|
||||
include if exists <local/upowerd>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/xdg-dbus-proxy
|
||||
profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-session-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
16
apparmor.d/groups/freedesktop/xdg-desktop-icon
Normal file
16
apparmor.d/groups/freedesktop/xdg-desktop-icon
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/xdg-desktop-icon
|
||||
profile xdg-desktop-icon @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/xdg-desktop-icon>
|
||||
}
|
||||
|
|
@ -9,7 +9,10 @@ include <tunables/global>
|
|||
@{exec_path} = @{libexec}/xdg-desktop-portal
|
||||
profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/dbus-network-manager-strict>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
|
|
@ -19,30 +22,48 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
ptrace (read),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/RealtimeKit[0-9]
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member={GetAll,Get},
|
||||
|
||||
dbus send bus=system path=/net/hadess/PowerProfiles
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll,
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.NetworkManager
|
||||
member={StateChanged,CheckPermissions},
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/snap rPx,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}bin/firefox rPx -> firefox,
|
||||
|
||||
/ r,
|
||||
/.flatpak-info r,
|
||||
/{usr/,}lib/x r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/pipewire/client.conf r,
|
||||
/usr/share/xdg-desktop-portal/portals/{,*.portal} r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/etc/pipewire/client.conf.d/ r,
|
||||
|
||||
/var/lib/flatpak/exports/share/mime/mime.cache r,
|
||||
/var/lib/flatpak/exports/share/applications/{**,} r,
|
||||
|
||||
owner @{run}/user/@{uid}/.flatpak/{,*/*} r,
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/pipewire-[0-9]* rw,
|
||||
|
||||
owner @{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/ r,
|
||||
|
|
|
|||
|
|
@ -9,13 +9,28 @@ include <tunables/global>
|
|||
@{exec_path} = @{libexec}/xdg-desktop-portal-gnome
|
||||
profile xdg-desktop-portal-gnome @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/user-download>
|
||||
include <abstractions/user-read>
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll,
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged,
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
|
||||
interface=org.freedesktop.Accounts.User
|
||||
member=Changed,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
|
@ -28,7 +43,7 @@ profile xdg-desktop-portal-gnome @{exec_path} {
|
|||
|
||||
owner @{user_share_dirs}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/wayland-[0-9]* rw,
|
||||
owner @{run}/user/@{uid}/wayland-cursor-shared-* rw,
|
||||
|
||||
include if exists <local/xdg-desktop-portal-gnome>
|
||||
|
|
|
|||
|
|
@ -9,7 +9,9 @@ include <tunables/global>
|
|||
@{exec_path} = @{libexec}/xdg-desktop-portal-gtk
|
||||
profile xdg-desktop-portal-gtk @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/dbus-session-strict>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
|
|
@ -18,6 +20,26 @@ profile xdg-desktop-portal-gtk @{exec_path} {
|
|||
include <abstractions/user-download>
|
||||
include <abstractions/user-write>
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll,
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged,
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
|
||||
interface=org.freedesktop.Accounts.User
|
||||
member=Changed,
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.NetworkManager
|
||||
member=CheckPermissions,
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/NetworkManager
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
|
@ -30,10 +52,10 @@ profile xdg-desktop-portal-gtk @{exec_path} {
|
|||
owner @{HOME}/@{XDG_DATA_HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/wayland-[0-9]* rw,
|
||||
@{run}/mount/utab r,
|
||||
|
||||
owner @{PROC}/@{uid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
include if exists <local/xdg-desktop-portal-gtk>
|
||||
}
|
||||
|
|
@ -12,6 +12,8 @@ profile xdg-document-portal @{exec_path} {
|
|||
|
||||
ptrace (read) peer=xdg-desktop-portal,
|
||||
|
||||
unix (send receive) type=stream peer=(label=xdg-document-portal//fusermount),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/flatpak rCx -> flatpak,
|
||||
|
|
@ -57,6 +59,8 @@ profile xdg-document-portal @{exec_path} {
|
|||
capability sys_admin,
|
||||
capability dac_read_search,
|
||||
|
||||
unix (send receive) type=stream peer=(label=xdg-document-portal),
|
||||
|
||||
# network inet stream,
|
||||
# network inet6 stream,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -11,8 +12,13 @@ profile xdg-email @{exec_path} flags=(complain) {
|
|||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gio rPx,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/xdg-mime rPx,
|
||||
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2018-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -14,24 +15,39 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
|
|||
@{exec_path} r,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/head rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/uname rix,
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/file rix,
|
||||
/{usr/,}bin/head rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/tr rix,
|
||||
/{usr/,}bin/uname rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
|
||||
/{usr/,}bin/gio rPx,
|
||||
/{usr/,}bin/mimetype rPx,
|
||||
/{usr/,}bin/xprop rPx,
|
||||
|
||||
/usr/share/terminfo/x/xterm-256color r,
|
||||
/usr/share/ubuntu/applications/ r,
|
||||
|
||||
/etc/gnome/defaults.list r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
owner @{user_config_dirs}/mimeapps.list{,.new} rw,
|
||||
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/temp* r,
|
||||
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
|
||||
|
||||
/dev/dri/card[0-9]* rw,
|
||||
/dev/tty rw,
|
||||
|
||||
# When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two
|
||||
# following root processes:
|
||||
|
|
@ -44,26 +60,6 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
|
|||
deny /{usr/,}bin/dbus-launch rx,
|
||||
deny /{usr/,}bin/dbus-send rx,
|
||||
|
||||
owner @{user_config_dirs}/mimeapps.list{,.new} rw,
|
||||
|
||||
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# For shell pwd
|
||||
owner @{HOME}/ r,
|
||||
|
||||
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/temp* r,
|
||||
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
|
||||
|
||||
# file_inherit
|
||||
@{MOUNTS}/** rw,
|
||||
/dev/dri/card[0-9]* rw,
|
||||
|
||||
/dev/tty rw,
|
||||
|
||||
profile dbus {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
@ -72,10 +68,9 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
|
|||
/{usr/,}bin/dbus-send mr,
|
||||
/{usr/,}bin/dbus-daemon rPx,
|
||||
|
||||
# for dbus-launch
|
||||
@{HOME}/.Xauthority r,
|
||||
owner @{HOME}/.dbus/session-bus/[0-9a-f]*-[0-9] w,
|
||||
|
||||
@{HOME}/.Xauthority r,
|
||||
}
|
||||
|
||||
include if exists <local/xdg-mime>
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{libexec}/xdg-permission-store
|
||||
profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-session-strict>
|
||||
|
||||
signal (receive) set=(term hup kill) peer=dbus-daemon,
|
||||
signal (receive) set=(term hup kill) peer=gdm*,
|
||||
|
|
@ -17,6 +18,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{HOME}/@{XDG_DATA_HOME}/flatpak/db/gnome rw,
|
||||
|
||||
owner @{user_share_dirs}/flatpak/db/ rw,
|
||||
owner @{user_share_dirs}/flatpak/db/.goutputstream-* rw,
|
||||
owner @{user_share_dirs}/flatpak/db/background rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -35,11 +35,14 @@ profile xdg-settings @{exec_path} {
|
|||
|
||||
/usr/share/terminfo/x/xterm-256color r,
|
||||
/usr/share/applications/ r,
|
||||
/usr/share/ubuntu/applications/ r,
|
||||
|
||||
/etc/xdg/xfce4/helpers.rc r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/var/lib/snapd/desktop/applications/{,*} r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
|
|
|
|||
20
apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update
Normal file
20
apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/xdg-user-dirs-gtk-update
|
||||
profile xdg-user-dirs-gtk-update @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{user_config_dirs}/user-dirs.dirs r,
|
||||
owner @{user_config_dirs}/user-dirs.locale r,
|
||||
|
||||
include if exists <local/xdg-user-dirs-gtk-update>
|
||||
}
|
||||
|
|
@ -11,6 +11,10 @@ include <tunables/global>
|
|||
profile xkbcomp @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
|
||||
unix (send,receive) type=stream addr=none peer=(label=gnome-shell),
|
||||
unix (send,receive) type=stream addr=none peer=(label=xwayland),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/X11/xkb/** r,
|
||||
|
|
|
|||
|
|
@ -10,9 +10,10 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/X
|
||||
@{exec_path} += /{usr/,}bin/Xorg
|
||||
@{exec_path} += /{usr/,}lib/Xorg{,.wrap}
|
||||
@{exec_path} += /{usr/,}lib/xorg/Xorg
|
||||
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}
|
||||
profile xorg @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
|
|
@ -40,6 +41,15 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/login[0-9]{,/session/*}
|
||||
interface=org.freedesktop.{DBus.Properties,login1.Session}
|
||||
member={ReleaseControl,TakeControl,TakeDevice,ReleaseDevice,GetSessionByPID}
|
||||
peer=(name=org.freedesktop.login[0-9]),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/login[0-9]/session/*
|
||||
interface=org.freedesktop.login1.Session
|
||||
member=PauseDevice,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/xrdb
|
||||
profile xrdb @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
@ -17,9 +18,8 @@ profile xrdb @{exec_path} {
|
|||
/{usr/,}bin/{,@{multiarch}-}cpp-[0-9]* rix,
|
||||
/{usr/,}lib/gcc/@{multiarch}/[0-9]*/cc1 rix,
|
||||
/{usr/,}lib/llvm-[0-9]*/bin/clang rix,
|
||||
/usr/include/stdc-predef.h r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
/usr/include/stdc-predef.h r,
|
||||
|
||||
/etc/X11/Xresources/x11-common r,
|
||||
|
||||
|
|
@ -33,8 +33,6 @@ profile xrdb @{exec_path} {
|
|||
owner /tmp/xauth-[0-9]*-_[0-9] r,
|
||||
owner /tmp/kcminit.* r,
|
||||
|
||||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.* r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
|
|
|||
|
|
@ -19,6 +19,9 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
|
|||
signal (receive) set=(term hup) peer=gdm*,
|
||||
signal (receive) set=(term hup) peer=gnome-shell,
|
||||
|
||||
unix (send,receive) type=stream addr="@/tmp/.X11-unix/X[0-9]*",
|
||||
unix (send,receive) type=stream addr=none peer=(label=gnome-shell),
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
|
@ -32,6 +35,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* rw,
|
||||
|
||||
@{sys}/bus/pci/devices/ r,
|
||||
@{sys}/devices/system/cpu/possible r,
|
||||
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
owner @{PROC}/@{pids}/comm r,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue