felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): move away from old or too wide abstractions.

Browse source
This commit is contained in:
Alexandre Pujol 2025-06-19 23:55:20 +02:00
parent 033a7475e0
commit f29041576e
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
19 changed files with 84 additions and 86 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/browsers/opera-crashreporter
View file

@ -17,7 +17,7 @@ profile opera-crashreporter @{exec_path} {
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/nameservice>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
ptrace (trace, read) peer=opera,

10
apparmor.d/groups/filesystem/udiskie
View file

@ -11,16 +11,12 @@ include <tunables/global>
profile udiskie @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/X>
include <abstractions/fonts>
include <abstractions/desktop>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/graphics>
include <abstractions/python>
include <abstractions/user-download-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/mesa>
include <abstractions/dri-enumerate>
include <abstractions/user-download-strict>
@{exec_path} r,
@{python_path} r,

1
apparmor.d/groups/hyprland/hyprpm
View file

@ -11,7 +11,6 @@ profile hyprpm @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
include <abstractions/user-tmp>
network inet dgram,
network inet stream,

2
apparmor.d/groups/network/nm-dhcp-helper
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,NetworkManager/}nm-dhcp-helper
profile nm-dhcp-helper @{exec_path} {
include <abstractions/base>
include <abstractions/dbus>
include <abstractions/bus-system>
network inet dgram,
network inet6 dgram,

20
apparmor.d/groups/usb/usbguard-applet-qt
View file

@ -10,22 +10,21 @@ include <tunables/global>
@{exec_path} = @{bin}/usbguard-applet-qt
profile usbguard-applet-qt @{exec_path} {
include <abstractions/base>
include <abstractions/X>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/qt5>
include <abstractions/qt5-compose-cache-write>
include <abstractions/desktop>
include <abstractions/dri-enumerate>
include <abstractions/fontconfig-cache-read>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/qt5-compose-cache-write>
# Needed?
ptrace (read),
@{exec_path} mr,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{user_config_dirs}/USBGuard/ rw,
owner @{user_config_dirs}/USBGuard/* rwkl -> @{user_config_dirs}/USBGuard/#@{int},
@ -37,11 +36,6 @@ profile usbguard-applet-qt @{exec_path} {
owner @{PROC}/@{pid}/cmdline r,
/usr/share/hwdata/pnp.ids r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
include if exists <local/usbguard-applet-qt>
}

3
apparmor.d/groups/virt/libvirtd
View file

@ -17,8 +17,9 @@ include <tunables/global>
@{exec_path} = @{sbin}/libvirtd
profile libvirtd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
include <abstractions/consoles>
include <abstractions/dbus>
include <abstractions/devices-usb>
include <abstractions/disks-write>
include <abstractions/nameservice-strict>