felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): add the open_path variable.

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-17 23:43:14 +00:00
parent a46dfaad61
commit f362975ce7
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
29 changed files with 36 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/_full/default
View file

@ -55,9 +55,7 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{bin}/exo-open rPx -> child-open,
@{bin}/xdg-open rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
audit @{bin}/** Pix,
audit @{lib}/** Pix,

5
apparmor.d/groups/browsers/firefox
View file

@ -106,15 +106,12 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{lib}/mozilla/plugins/libvlcplugin.so mr,
# Desktop integration
@{bin}/exo-open rPx -> child-open,
@{bin}/gnome-software rPx,
@{bin}/kreadconfig5 rix,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/update-mime-database rPx,
@{bin}/xdg-open rPx -> child-open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{lib}/gvfsd-metadata rPx,
@{open_path} rPx -> child-open,
# Common extensions
/opt/net.downloadhelper.coapp/bin/net.downloadhelper.coapp* rPx,

3
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -71,9 +71,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
@{bin}/snap rPUx,
@{bin}/kreadconfig5 rPx,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{lib}/xdg-desktop-portal-validate-icon rPUx,
@{open_path} rPx -> child-open,
/ r,
/.flatpak-info r,

3
apparmor.d/groups/gnome/gnome-disks
View file

@ -19,8 +19,7 @@ profile gnome-disks @{exec_path} {
@{exec_path} mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
owner @{user_cache_dirs}/gnome-disks/{,**} rw,

3
apparmor.d/groups/gnome/gnome-extension-gsconnect
View file

@ -44,8 +44,7 @@ profile gnome-extension-gsconnect @{exec_path} {
@{lib}/gio/modules/*.so* rm,
@{lib}/girepository-1.0/* r,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
@{share_dirs}/{,**} r,
@{share_dirs}/gsconnect-preferences rix,

5
apparmor.d/groups/gnome/gnome-extension-manager
View file

@ -32,12 +32,9 @@ profile gnome-extension-manager @{exec_path} {
@{bin}/gjs-console rix,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
/usr/share/gnome-shell/org.gnome.Shell.Extensions r,
/usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r,
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
owner @{PROC}/@{pid}/cmdline r,

3
apparmor.d/groups/gnome/gnome-extensions-app
View file

@ -25,8 +25,7 @@ profile gnome-extensions-app @{exec_path} {
@{bin}/{,ba,da}sh rix,
@{bin}/gjs-console rix,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
/usr/share/gnome-shell/org.gnome.Extensions* r,
/usr/share/icu/@{int}.@{int}/*.dat r,

3
apparmor.d/groups/gnome/gnome-software
View file

@ -38,9 +38,8 @@ profile gnome-software @{exec_path} {
@{bin}/gpg{,2} rCx -> gpg,
@{bin}/gpgconf rCx -> gpg,
@{bin}/gpgsm rCx -> gpg,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{lib}/revokefs-fuse rix,
@{open_path} rPx -> child-open,
/usr/share/app-info/{,**} r,
/usr/share/appdata/{,**} r,

3
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -46,8 +46,7 @@ profile gnome-terminal-server @{exec_path} {
@{bin}/micro rPUx,
@{bin}/nvtop rPx,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
/usr/share/icu/@{int}.@{int}/*.dat r,
/usr/share/sounds/{,**} r,

3
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -88,8 +88,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
/usr/share/dconf/profile/gdm r,
/usr/share/gdm/greeter-dconf-defaults r,

3
apparmor.d/groups/gnome/kgx
View file

@ -34,8 +34,7 @@ profile kgx @{exec_path} {
@{bin}/micro rPUx,
@{bin}/nvtop rPx,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{open_path} rPx -> child-open,
owner /tmp/#@{int} rw,

7
apparmor.d/groups/whonix/torbrowser
View file

@ -54,11 +54,8 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) {
@{lib_dirs}/vaapitest rPx -> torbrowser-vaapitest,
# Desktop integration
@{bin}/exo-open rPx -> child-open,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/xdg-open rPx -> child-open,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,
@{bin}/lsb_release rPx -> lsb_release,
@{open_path} rPx -> child-open,
/usr/share/@{name}/{,**} r,
/usr/share/doc/{,**} r,