felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): kde: improve dbus rules.

Browse source
This commit is contained in:
Alexandre Pujol 2025-08-22 20:39:18 +02:00
parent cea9fd5614
commit f18fc88253
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
10 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/kde/baloorunner
View file

@ -10,6 +10,9 @@ include <tunables/global>
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}baloorunner @{exec_path} += @{lib}/@{multiarch}/{,libexec/}baloorunner
profile baloorunner @{exec_path} { profile baloorunner @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus/org.a11y>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/kde-strict> include <abstractions/kde-strict>

1
apparmor.d/groups/kde/kaccess
View file

@ -18,6 +18,7 @@ profile kaccess @{exec_path} {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
#aa:dbus own bus=session name=org.kde.kaccess #aa:dbus own bus=session name=org.kde.kaccess
#aa:dbus talk bus=session name=org.kde.kglobalaccel path=/kglobalaccel label=kglobalacceld
@{exec_path} mr, @{exec_path} mr,

1
apparmor.d/groups/kde/kactivitymanagerd
View file

@ -11,6 +11,7 @@ include <tunables/global>
profile kactivitymanagerd @{exec_path} { profile kactivitymanagerd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y>
include <abstractions/devices-usb> include <abstractions/devices-usb>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/kde-strict> include <abstractions/kde-strict>

1
apparmor.d/groups/kde/kde-powerdevil
View file

@ -28,6 +28,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted)
network netlink raw, network netlink raw,
#aa:dbus own bus=system name=org.freedesktop.Policy.Power #aa:dbus own bus=system name=org.freedesktop.Policy.Power
#aa:dbus own bus=system name=org.kde.kf5auth path=/
#aa:dbus own bus=session name=local.org_kde_powerdevil #aa:dbus own bus=session name=local.org_kde_powerdevil
#aa:dbus own bus=session name=org.freedesktop.PowerManagement #aa:dbus own bus=session name=org.freedesktop.PowerManagement

1
apparmor.d/groups/kde/kded
View file

@ -68,6 +68,7 @@ profile kded @{exec_path} {
#aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager
#aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd
#aa:dbus talk bus=session name=org.kde.NightColor path=/ColorCorrect label="{kwin_wayland,kwin_x11}"
#aa:dbus talk bus=session name=org.kde.KGlobalAccel path=/ label="{kglobalacceld,kwin_wayland}" #aa:dbus talk bus=session name=org.kde.KGlobalAccel path=/ label="{kglobalacceld,kwin_wayland}"
dbus receive bus=system path=/ dbus receive bus=system path=/

2
apparmor.d/groups/kde/kglobalacceld
View file

@ -9,7 +9,9 @@ include <tunables/global>
@{exec_path} = @{bin}/kglobalaccel5 @{lib}/kglobalacceld @{exec_path} = @{bin}/kglobalaccel5 @{lib}/kglobalacceld
profile kglobalacceld @{exec_path} { profile kglobalacceld @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y>
include <abstractions/kde-strict> include <abstractions/kde-strict>
#aa:dbus own bus=session name=org.kde.KGlobalAccel path=/kglobalaccel #aa:dbus own bus=session name=org.kde.KGlobalAccel path=/kglobalaccel

9
apparmor.d/groups/kde/ksmserver-logout-greeter
View file

@ -11,6 +11,10 @@ include <tunables/global>
@{exec_path} += @{lib}/@{multiarch}/{,libexec/}ksmserver-logout-greeter @{exec_path} += @{lib}/@{multiarch}/{,libexec/}ksmserver-logout-greeter
profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected,mediate_deleted) { profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-accessibility>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/bus/org.a11y>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/kde-strict> include <abstractions/kde-strict>
@ -18,6 +22,11 @@ profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected,mediate
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/qt5-shader-cache> include <abstractions/qt5-shader-cache>
#aa:dbus own bus=session name=org.kde.LogoutPrompt path=/LogoutPrompt
#aa:dbus talk bus=session name=org.kde.LogoutPrompt path=/Shutdown label=plasma-shutdown
#aa:dbus talk bus=session name=org.kde.KWin label=kwin_wayland
@{exec_path} mr, @{exec_path} mr,
@{lib}/os-release r, @{lib}/os-release r,

1
apparmor.d/groups/kde/ksplashqml
View file

@ -11,6 +11,7 @@ profile ksplashqml @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/kde-strict> include <abstractions/kde-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/groups/kde/kwin_wayland
View file

@ -35,7 +35,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected,mediate_deleted) {
unix type=stream peer=(label=xwayland), unix type=stream peer=(label=xwayland),
#aa:dbus own bus=session name=org.freedesktop.ScreenSaver #aa:dbus own bus=session name=org.freedesktop.ScreenSaver
#aa:dbus own bus=session name=org.kde.kglobalaccel #aa:dbus own bus=session name=org.kde.kglobalaccel path=/kglobalaccel
#aa:dbus own bus=session name=org.kde.KWin #aa:dbus own bus=session name=org.kde.KWin
#aa:dbus own bus=session name=org.kde.NightColor path=/ColorCorrect #aa:dbus own bus=session name=org.kde.NightColor path=/ColorCorrect
#aa:dbus own bus=session name=org.kde.screensaver #aa:dbus own bus=session name=org.kde.screensaver

1
apparmor.d/groups/kde/sddm
View file

@ -55,6 +55,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
#aa:dbus own bus=system name=org.freedesktop.DisplayManager #aa:dbus own bus=system name=org.freedesktop.DisplayManager
#aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label="@{p_systemd_homed}" #aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label="@{p_systemd_homed}"
#aa:dbus talk bus=system name=org.freedesktop.login1 interface=org.freedesktop.login1.Manager label="@{p_systemd_logind}"
@{exec_path} mr, @{exec_path} mr,