feat(kde): move more sddm and kde profiles in the kde group.
This commit is contained in:
Alexandre Pujol
parent
cbc1d8faf3
commit
e84e22a917
4 changed files with 0 additions and 0 deletions
161
apparmor.d/groups/kde/sddm
Normal file
161
apparmor.d/groups/kde/sddm
Normal file
|
|
@ -0,0 +1,161 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/sddm
|
||||
profile sddm @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability chown,
|
||||
capability setgid,
|
||||
capability fowner,
|
||||
capability setuid,
|
||||
capability sys_resource,
|
||||
capability audit_write,
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
capability dac_override,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
signal (send) set=(kill, term) peer=xorg,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib{,exec}/sddm/sddm-helper rix,
|
||||
/{usr/,}lib/@{multiarch}/sddm/sddm-helper rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/sddm-greeter rPx,
|
||||
/etc/sddm/Xsession rPx,
|
||||
/{usr/,}bin/Xorg rPx,
|
||||
|
||||
/{usr/,}bin/xauth rCx -> xauth,
|
||||
/{usr/,}bin/xsetroot rPx,
|
||||
/{usr/,}bin/sway rPUx,
|
||||
|
||||
# System keyrings
|
||||
/{usr/,}bin/gnome-keyring-daemon rPx,
|
||||
/{usr/,}bin/kwalletd5 rPx,
|
||||
|
||||
# SDDM scripts
|
||||
# What to do with it? (#FIXME#)
|
||||
/usr/etc/X11/xdm/Xsetup rPUx,
|
||||
/usr/share/sddm/scripts/Xsetup rPUx,
|
||||
/usr/share/sddm/scripts/Xstop rPUx,
|
||||
/usr/share/sddm/scripts/wayland-session rPUx,
|
||||
/usr/share/sddm/scripts/Xsession rPUx,
|
||||
#/usr/share/sddm/scripts/Xsetup rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/Xstop rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/wayland-session rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/Xsession rCx -> scripts,
|
||||
|
||||
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
|
||||
/usr/share/plasma/desktoptheme/** r,
|
||||
/usr/share/sddm/faces/.*.icon r,
|
||||
/usr/share/sddm/themes/** r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/var/lib/AccountsService/icons/*.icon r,
|
||||
|
||||
@{etc_ro}/environment r,
|
||||
@{etc_ro}/security/limits.d/ r,
|
||||
/etc/default/locale r,
|
||||
/etc/locale.conf r,
|
||||
/etc/machine-id r,
|
||||
/etc/sddm.conf r,
|
||||
/etc/sddm.conf.d/{,*} r,
|
||||
|
||||
/ r,
|
||||
|
||||
owner /var/lib/sddm/** rw,
|
||||
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.jsc mrw,
|
||||
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.qmlc mrw,
|
||||
/var/lib/sddm/state.conf rw,
|
||||
|
||||
owner @{HOME}/.local/ w,
|
||||
owner @{HOME}/.Xauthority rw,
|
||||
owner @{user_share_dirs}/ w,
|
||||
owner @{user_share_dirs}/kwalletd/ rw,
|
||||
owner @{user_share_dirs}/kwalletd/kdewallet.salt r,
|
||||
owner @{user_share_dirs}/kwalletd/kdewallet.salt rw,
|
||||
owner @{user_share_dirs}/sddm/ w,
|
||||
|
||||
/tmp/sddm-* rw,
|
||||
owner /tmp/*/{,s} rw,
|
||||
owner /tmp/sddm-auth* rw,
|
||||
|
||||
@{run}/faillock/[a-zA-z0-9]* rwk,
|
||||
@{run}/sddm/* w,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
owner @{run}/sddm/ rw,
|
||||
owner @{run}/user/@{uid}/kwallet5.socket rw,
|
||||
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
owner @{PROC}/1/limits r,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
profile scripts {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/bash>
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/zsh rix,
|
||||
|
||||
/{usr/,}bin/id rix,
|
||||
/{usr/,}bin/flatpak rPUx,
|
||||
/{usr/,}bin/sway rPUx,
|
||||
|
||||
/{usr/,}bin/dbus-run-session rix,
|
||||
/{usr/,}bin/dbus-daemon rPUx,
|
||||
|
||||
/usr/share/sddm/scripts/Xsetup r,
|
||||
/usr/share/sddm/scripts/Xstop r,
|
||||
/usr/share/sddm/scripts/wayland-session r,
|
||||
/usr/share/sddm/scripts/Xsession r,
|
||||
|
||||
include if exists <local/sddm_scripts>
|
||||
}
|
||||
|
||||
profile xauth {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/xauth mr,
|
||||
|
||||
owner @{HOME}/.Xauthority-c w,
|
||||
owner @{HOME}/.Xauthority-l wl -> @{HOME}/.Xauthority-c,
|
||||
owner @{HOME}/.Xauthority-n rw,
|
||||
owner @{HOME}/.Xauthority rwl -> @{HOME}/.Xauthority-n,
|
||||
|
||||
owner @{run}/sddm/\{@{uuid}\}-c w,
|
||||
owner @{run}/sddm/\{@{uuid}\}-l wl -> @{run}/sddm/\{@{uuid}\}-c,
|
||||
owner @{run}/sddm/\{@{uuid}\}-n rw,
|
||||
owner @{run}/sddm/\{@{uuid}\} rwl -> @{run}/sddm/\{@{uuid}\}-n,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/sddm>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue