From e77f8db40f35f6995537b9a688812ad934c4a063 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Wed, 27 Mar 2024 22:07:43 +0000
Subject: [PATCH] feat(abs): add bash-strict.

---
 apparmor.d/groups/gnome/gdm-xsession   | 2 +-
 apparmor.d/groups/gnome/gnome-session  | 2 +-
 apparmor.d/groups/kde/sddm             | 2 +-
 apparmor.d/groups/kde/sddm-xsession    | 2 +-
 apparmor.d/groups/kde/xdm-xsession     | 2 +-
 apparmor.d/groups/virt/cockpit-session | 2 +-
 apparmor.d/profiles-m-r/pam_roles      | 4 ++--
 7 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession
index af4cbad93..b12a5e047 100644
--- a/apparmor.d/groups/gnome/gdm-xsession
+++ b/apparmor.d/groups/gnome/gdm-xsession
@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{etc_ro}/gdm{3,}/Xsession
 profile gdm-xsession @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/nameservice-strict>
diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session
index b208aa2ec..5107a9621 100644
--- a/apparmor.d/groups/gnome/gnome-session
+++ b/apparmor.d/groups/gnome/gnome-session
@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/gnome-session
 profile gnome-session @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/zsh>
diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm
index 3d3e3dacb..79aafd3cf 100644
--- a/apparmor.d/groups/kde/sddm
+++ b/apparmor.d/groups/kde/sddm
@@ -11,7 +11,7 @@ include <tunables/global>
 profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/base>
   include <abstractions/authentication>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.login1>
diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession
index 35c94f61f..c63a441ed 100644
--- a/apparmor.d/groups/kde/sddm-xsession
+++ b/apparmor.d/groups/kde/sddm-xsession
@@ -12,7 +12,7 @@ profile sddm-xsession @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/zsh>
 
   @{exec_path} r,
diff --git a/apparmor.d/groups/kde/xdm-xsession b/apparmor.d/groups/kde/xdm-xsession
index 498420a9a..2a8184e54 100644
--- a/apparmor.d/groups/kde/xdm-xsession
+++ b/apparmor.d/groups/kde/xdm-xsession
@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{etc_ro}/X11/xdm/Xsession
 profile xdm-xsession @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/dconf-write>
   include <abstractions/nameservice-strict>
   include <abstractions/X-strict>
diff --git a/apparmor.d/groups/virt/cockpit-session b/apparmor.d/groups/virt/cockpit-session
index a4c1adb04..774a6b7a9 100644
--- a/apparmor.d/groups/virt/cockpit-session
+++ b/apparmor.d/groups/virt/cockpit-session
@@ -10,7 +10,7 @@ include <tunables/global>
 profile cockpit-session @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/authentication>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/zsh>
 
diff --git a/apparmor.d/profiles-m-r/pam_roles b/apparmor.d/profiles-m-r/pam_roles
index d73a0e62a..f2b37b148 100644
--- a/apparmor.d/profiles-m-r/pam_roles
+++ b/apparmor.d/profiles-m-r/pam_roles
@@ -18,7 +18,7 @@ include <tunables/global>
 # of files.
 profile default_user flags=(complain) {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/nameservice>
 
@@ -38,7 +38,7 @@ profile default_user flags=(complain) {
 # anywhere, and execute from some places.
 profile confined_user flags=(complain) {
   include <abstractions/base>
-  include <abstractions/bash>
+  include <abstractions/bash-strict>
   include <abstractions/consoles>
   include <abstractions/nameservice>