feat(kde): move more sddm and kde profiles in the kde group.
This commit is contained in:
Alexandre Pujol
parent
cbc1d8faf3
commit
e84e22a917
4 changed files with 0 additions and 0 deletions
76
apparmor.d/groups/kde/kscreenlocker-greet
Normal file
76
apparmor.d/groups/kde/kscreenlocker-greet
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/@{multiarch}/libexec/kscreenlocker_greet
|
||||
profile kscreenlocker-greet @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/X>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/dri-enumerate>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (send) peer=kcheckpass,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/libexec/kcheckpass rPx,
|
||||
|
||||
/usr/share/plasma/** r,
|
||||
/usr/share/wallpapers/Path/contents/images/*.{jpg,png} r,
|
||||
|
||||
# List of graphical sessions
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
owner @{user_config_dirs}/kdeglobals r,
|
||||
owner @{user_config_dirs}/kscreenlockerrc r,
|
||||
|
||||
owner @{user_config_dirs}/qt5ct/{,**} r,
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/qtshadercache/ rw,
|
||||
owner @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9] rw,
|
||||
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9],
|
||||
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
|
||||
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9],
|
||||
|
||||
owner @{user_cache_dirs}/plasma-svgelements-default_v* r,
|
||||
|
||||
# If one is blocked, the others are probed.
|
||||
deny owner @{HOME}/#[0-9]*[0-9] mrw,
|
||||
owner @{HOME}/.glvnd* mrw,
|
||||
# owner /tmp/#[0-9]*[0-9] mrw,
|
||||
# owner /tmp/.glvnd* mrw,
|
||||
|
||||
@{PROC}/@{pid}/cmdline r,
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
# Audio player covers
|
||||
owner /tmp/*-cover-*.{jpg,png} r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/kscreenlocker-greet>
|
||||
}
|
||||
161
apparmor.d/groups/kde/sddm
Normal file
161
apparmor.d/groups/kde/sddm
Normal file
|
|
@ -0,0 +1,161 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/sddm
|
||||
profile sddm @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability chown,
|
||||
capability setgid,
|
||||
capability fowner,
|
||||
capability setuid,
|
||||
capability sys_resource,
|
||||
capability audit_write,
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
capability dac_override,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
signal (send) set=(kill, term) peer=xorg,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib{,exec}/sddm/sddm-helper rix,
|
||||
/{usr/,}lib/@{multiarch}/sddm/sddm-helper rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/sddm-greeter rPx,
|
||||
/etc/sddm/Xsession rPx,
|
||||
/{usr/,}bin/Xorg rPx,
|
||||
|
||||
/{usr/,}bin/xauth rCx -> xauth,
|
||||
/{usr/,}bin/xsetroot rPx,
|
||||
/{usr/,}bin/sway rPUx,
|
||||
|
||||
# System keyrings
|
||||
/{usr/,}bin/gnome-keyring-daemon rPx,
|
||||
/{usr/,}bin/kwalletd5 rPx,
|
||||
|
||||
# SDDM scripts
|
||||
# What to do with it? (#FIXME#)
|
||||
/usr/etc/X11/xdm/Xsetup rPUx,
|
||||
/usr/share/sddm/scripts/Xsetup rPUx,
|
||||
/usr/share/sddm/scripts/Xstop rPUx,
|
||||
/usr/share/sddm/scripts/wayland-session rPUx,
|
||||
/usr/share/sddm/scripts/Xsession rPUx,
|
||||
#/usr/share/sddm/scripts/Xsetup rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/Xstop rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/wayland-session rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/Xsession rCx -> scripts,
|
||||
|
||||
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
|
||||
/usr/share/plasma/desktoptheme/** r,
|
||||
/usr/share/sddm/faces/.*.icon r,
|
||||
/usr/share/sddm/themes/** r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/var/lib/AccountsService/icons/*.icon r,
|
||||
|
||||
@{etc_ro}/environment r,
|
||||
@{etc_ro}/security/limits.d/ r,
|
||||
/etc/default/locale r,
|
||||
/etc/locale.conf r,
|
||||
/etc/machine-id r,
|
||||
/etc/sddm.conf r,
|
||||
/etc/sddm.conf.d/{,*} r,
|
||||
|
||||
/ r,
|
||||
|
||||
owner /var/lib/sddm/** rw,
|
||||
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.jsc mrw,
|
||||
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.qmlc mrw,
|
||||
/var/lib/sddm/state.conf rw,
|
||||
|
||||
owner @{HOME}/.local/ w,
|
||||
owner @{HOME}/.Xauthority rw,
|
||||
owner @{user_share_dirs}/ w,
|
||||
owner @{user_share_dirs}/kwalletd/ rw,
|
||||
owner @{user_share_dirs}/kwalletd/kdewallet.salt r,
|
||||
owner @{user_share_dirs}/kwalletd/kdewallet.salt rw,
|
||||
owner @{user_share_dirs}/sddm/ w,
|
||||
|
||||
/tmp/sddm-* rw,
|
||||
owner /tmp/*/{,s} rw,
|
||||
owner /tmp/sddm-auth* rw,
|
||||
|
||||
@{run}/faillock/[a-zA-z0-9]* rwk,
|
||||
@{run}/sddm/* w,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
owner @{run}/sddm/ rw,
|
||||
owner @{run}/user/@{uid}/kwallet5.socket rw,
|
||||
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
owner @{PROC}/1/limits r,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
profile scripts {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/bash>
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/zsh rix,
|
||||
|
||||
/{usr/,}bin/id rix,
|
||||
/{usr/,}bin/flatpak rPUx,
|
||||
/{usr/,}bin/sway rPUx,
|
||||
|
||||
/{usr/,}bin/dbus-run-session rix,
|
||||
/{usr/,}bin/dbus-daemon rPUx,
|
||||
|
||||
/usr/share/sddm/scripts/Xsetup r,
|
||||
/usr/share/sddm/scripts/Xstop r,
|
||||
/usr/share/sddm/scripts/wayland-session r,
|
||||
/usr/share/sddm/scripts/Xsession r,
|
||||
|
||||
include if exists <local/sddm_scripts>
|
||||
}
|
||||
|
||||
profile xauth {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/xauth mr,
|
||||
|
||||
owner @{HOME}/.Xauthority-c w,
|
||||
owner @{HOME}/.Xauthority-l wl -> @{HOME}/.Xauthority-c,
|
||||
owner @{HOME}/.Xauthority-n rw,
|
||||
owner @{HOME}/.Xauthority rwl -> @{HOME}/.Xauthority-n,
|
||||
|
||||
owner @{run}/sddm/\{@{uuid}\}-c w,
|
||||
owner @{run}/sddm/\{@{uuid}\}-l wl -> @{run}/sddm/\{@{uuid}\}-c,
|
||||
owner @{run}/sddm/\{@{uuid}\}-n rw,
|
||||
owner @{run}/sddm/\{@{uuid}\} rwl -> @{run}/sddm/\{@{uuid}\}-n,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/sddm>
|
||||
}
|
||||
69
apparmor.d/groups/kde/sddm-greeter
Normal file
69
apparmor.d/groups/kde/sddm-greeter
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/sddm-greeter
|
||||
profile sddm-greeter @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/sddm/{,**} r,
|
||||
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
|
||||
/usr/share/plasma/desktoptheme/** r,
|
||||
/usr/share/qt5ct/** r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/etc/sddm.conf.d/{,*} r,
|
||||
/etc/sddm.conf r,
|
||||
/etc/fstab r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/AccountsService/icons/*.icon r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner /var/lib/sddm/** rw,
|
||||
owner /var/lib/sddm/#[0-9]*[0-9] mrw,
|
||||
owner /var/lib/sddm/.cache/** mrwkl -> /var/lib/sddm/.cache/**,
|
||||
/var/lib/sddm/state.conf r,
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma-svgelements-* rw,
|
||||
owner @{user_cache_dirs}/qtshadercache/{,**} rwl,
|
||||
owner @{user_cache_dirs}/sddm-greeter/{,**} rwl,
|
||||
|
||||
owner @{user_config_dirs}/kdeglobals r,
|
||||
owner @{user_config_dirs}/plasmarc r,
|
||||
owner @{user_config_dirs}/qt5ct/{,**} r,
|
||||
|
||||
# If one is blocked, the others are probed.
|
||||
deny owner @{HOME}/#[0-9]*[0-9] mrw,
|
||||
owner @{HOME}/.glvnd* mrw,
|
||||
|
||||
owner /tmp/runtime-sddm/ rw,
|
||||
|
||||
owner @{run}/sddm/{,*} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
include if exists <local/sddm-greeter>
|
||||
}
|
||||
136
apparmor.d/groups/kde/sddm-xsession
Normal file
136
apparmor.d/groups/kde/sddm-xsession
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/sddm/Xsession
|
||||
profile sddm-xsession @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/bash>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/id rix,
|
||||
/{usr/,}bin/chmod rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/tempfile rix,
|
||||
/{usr/,}bin/mktemp rix,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/zsh rix,
|
||||
/{usr/,}bin/tcsh rix,
|
||||
/{usr/,}bin/csh rix,
|
||||
/{usr/,}bin/fish rix,
|
||||
|
||||
/usr/local/bin/ r,
|
||||
|
||||
/etc/X11/Xsession rPx,
|
||||
|
||||
/{usr/,}bin/dbus-update-activation-environment rCx -> dbus,
|
||||
|
||||
/{usr/,}bin/gpgconf rCx -> gpg,
|
||||
/{usr/,}bin/run-parts rCx -> run-parts,
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
|
||||
/{usr/,}bin/flatpak rPUx,
|
||||
/{usr/,}bin/xrdb rPx,
|
||||
/{usr/,}bin/numlockx rPx,
|
||||
/{usr/,}bin/xhost rPx,
|
||||
|
||||
|
||||
# Allowed GUI sessions to start
|
||||
#/{usr/,}bin/openbox-session rPx,
|
||||
#/{usr/,}bin/openbox rPx,
|
||||
/{usr/,}bin/ssh-agent rPx,
|
||||
|
||||
owner /tmp/xsess-env-* rw,
|
||||
owner /tmp/file* rw,
|
||||
|
||||
/etc/default/{,*} r,
|
||||
|
||||
/etc/X11/{,**} r,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
# Xsession logs
|
||||
owner @{user_share_dirs}/sddm/xorg-session.log w,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
/etc/zsh/* r,
|
||||
|
||||
|
||||
profile run-parts {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/run-parts mr,
|
||||
|
||||
/etc/X11/Xsession.d/ r,
|
||||
/etc/X11/Xresources/ r,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
profile dbus {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/dbus-update-activation-environment mr,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/gpgconf mr,
|
||||
|
||||
/{usr/,}bin/gpg-agent rix,
|
||||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
|
||||
}
|
||||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
@{sys}/firmware/efi/efivars/SecureBoot-@{hex}-@{hex}-@{hex}@{hex} r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/*/devices/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/*/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{run}/udev/data/* r,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/sddm-xsession>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue