feat(profiles): better kde integration
Step 1: Ensure it can boot.
This commit is contained in:
Alexandre Pujol
parent
1aab4f1557
commit
f3d4912be8
9 changed files with 111 additions and 172 deletions
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -7,68 +8,39 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/sddm
|
||||
profile sddm @{exec_path} {
|
||||
profile sddm @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/wutmp>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
# To remove the following errors:
|
||||
# chown("/tmp/sddm-:0-YPUOCV", 123, 132) = -1 EPERM (Operation not permitted)
|
||||
capability chown,
|
||||
|
||||
# To remove the following errors:
|
||||
# sddm-helper[]: pam_keyinit(sddm-greeter:session): Unable to change GID to 132 temporarily
|
||||
# sddm-helper[]: setgid( 132 ) failed for user: "sddm"
|
||||
capability setgid,
|
||||
|
||||
# To remove the following errors:
|
||||
# sddm-helper[]: pam_keyinit(sddm-greeter:session): Unable to change UID to 123 temporarily
|
||||
# sddm-helper[]: pam_unix(sddm-greeter:session): session opened for user sddm by (uid=0)
|
||||
capability fowner,
|
||||
capability setuid,
|
||||
|
||||
# To remove the following errors:
|
||||
# sddm-helper[]: pam_limits(sddm-greeter:session): Could not set limit for 'nofile' to soft=1024,
|
||||
# hard=1048576: Operation not permitted; uid=0,euid=0
|
||||
# sddm-helper[*]: pam_limits(sddm-greeter:session): Could not set limit for 'memlock' to
|
||||
# soft=1017930240, hard=1017930240: Operation not permitted; uid=0,euid=0
|
||||
capability sys_resource,
|
||||
|
||||
# To be able to display messages
|
||||
# sddm-greeter[98834]: Connected to the daemon.
|
||||
# sddm[98806]: Message received from greeter: Connect
|
||||
# ...
|
||||
# sddm-greeter[98834]: Message received from daemon: Capabilities
|
||||
# sddm-greeter[98834]: Message received from daemon: HostName
|
||||
# ...
|
||||
# sddm[98806]: Message received from greeter: Login
|
||||
# ...
|
||||
# sddm-greeter[98834]: Message received from daemon: LoginSucceeded
|
||||
capability audit_write,
|
||||
|
||||
# To read the /var/lib/sddm/state.conf file
|
||||
capability dac_read_search,
|
||||
|
||||
# To prevent breaking the boot process
|
||||
capability net_admin,
|
||||
capability dac_override,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
# Needed?
|
||||
#capability sys_tty_config,
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
signal (send) set=(kill, term) peer=xorg,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/sddm/sddm-helper rix,
|
||||
/{usr/,}lib{,exec}/sddm/sddm-helper rix,
|
||||
/{usr/,}lib/@{multiarch}/sddm/sddm-helper rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh mrix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/sddm-greeter rPx,
|
||||
/etc/sddm/Xsession rPx,
|
||||
|
|
@ -89,92 +61,65 @@ profile sddm @{exec_path} {
|
|||
/usr/share/sddm/scripts/Xstop rPUx,
|
||||
/usr/share/sddm/scripts/wayland-session rPUx,
|
||||
/usr/share/sddm/scripts/Xsession rPUx,
|
||||
#/usr/share/sddm/scripts/Xsetup rCx -> sddm-scripts,
|
||||
#/usr/share/sddm/scripts/Xstop rCx -> sddm-scripts,
|
||||
#/usr/share/sddm/scripts/wayland-session rCx -> sddm-scripts,
|
||||
#/usr/share/sddm/scripts/Xsession rCx -> sddm-scripts,
|
||||
#/usr/share/sddm/scripts/Xsetup rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/Xstop rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/wayland-session rCx -> scripts,
|
||||
#/usr/share/sddm/scripts/Xsession rCx -> scripts,
|
||||
|
||||
# Create kwallet dirs and files
|
||||
owner @{user_share_dirs}/kwalletd/ rw,
|
||||
owner @{user_share_dirs}/kwalletd/kdewallet.salt rw,
|
||||
@{user_share_dirs}/kwalletd/kdewallet.salt r,
|
||||
owner @{run}/user/@{uid}/kwallet5.socket rw,
|
||||
|
||||
# Themes
|
||||
/usr/share/sddm/themes/** r,
|
||||
/usr/share/plasma/desktoptheme/** r,
|
||||
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
|
||||
|
||||
# List of graphical sessions
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/usr/share/plasma/desktoptheme/** r,
|
||||
/usr/share/sddm/faces/.*.icon r,
|
||||
/usr/share/sddm/themes/** r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/var/lib/AccountsService/icons/*.icon r,
|
||||
|
||||
@{etc_ro}/environment r,
|
||||
@{etc_ro}/security/limits.d/ r,
|
||||
/etc/default/locale r,
|
||||
/etc/locale.conf r,
|
||||
/etc/machine-id r,
|
||||
/etc/sddm.conf r,
|
||||
/etc/sddm.conf.d/{,*} r,
|
||||
|
||||
/ r,
|
||||
|
||||
owner /var/lib/sddm/** rw,
|
||||
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.jsc mrw,
|
||||
owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.qmlc mrw,
|
||||
/var/lib/sddm/state.conf rw,
|
||||
|
||||
/etc/sddm.conf.d/{,*} r,
|
||||
/etc/sddm.conf r,
|
||||
|
||||
# User avatars
|
||||
/usr/share/sddm/faces/.*.icon r,
|
||||
/var/lib/AccountsService/icons/*.icon r,
|
||||
|
||||
# QT
|
||||
/{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/*.so mr,
|
||||
/{usr/,}lib/@{multiarch}/qt5/plugins/plasma/dataengine/*.so mr,
|
||||
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/**.qmlc mr,
|
||||
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/Private/*.jsc mr,
|
||||
|
||||
# TMP files
|
||||
owner /tmp/sddm-auth* rw,
|
||||
owner @{HOME}/.local/ w,
|
||||
owner @{HOME}/.Xauthority rw,
|
||||
owner @{user_share_dirs}/ w,
|
||||
owner @{user_share_dirs}/kwalletd/ rw,
|
||||
owner @{user_share_dirs}/kwalletd/kdewallet.salt r,
|
||||
owner @{user_share_dirs}/kwalletd/kdewallet.salt rw,
|
||||
owner @{user_share_dirs}/sddm/ w,
|
||||
|
||||
/tmp/sddm-* rw,
|
||||
owner /tmp/*/{,s} rw,
|
||||
owner /tmp/sddm-auth* rw,
|
||||
|
||||
owner @{run}/sddm/ rw,
|
||||
@{run}/faillock/[a-zA-z0-9]* rwk,
|
||||
@{run}/sddm/* w,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
owner @{run}/sddm/ rw,
|
||||
owner @{run}/user/@{uid}/kwallet5.socket rw,
|
||||
|
||||
# Session error logs
|
||||
# Creating the dir structure is needed when a new user is logging in for the very first time
|
||||
# using SDDM.
|
||||
owner @{HOME}/.local/ w,
|
||||
owner @{user_share_dirs}/ w,
|
||||
owner @{user_share_dirs}/sddm/ w,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/ld-*.so mr,
|
||||
|
||||
@{etc_ro}/security/limits.d/ r,
|
||||
|
||||
owner @{HOME}/.Xauthority rw,
|
||||
|
||||
/etc/default/locale r,
|
||||
/etc/locale.conf r,
|
||||
@{etc_ro}/environment r,
|
||||
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
owner @{PROC}/1/limits r,
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/ r,
|
||||
|
||||
# Run SDDM on a specific TTY
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
|
||||
|
||||
profile sddm-scripts {
|
||||
profile scripts {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/bash>
|
||||
|
||||
/usr/share/sddm/scripts/Xsetup r,
|
||||
/usr/share/sddm/scripts/Xstop r,
|
||||
/usr/share/sddm/scripts/wayland-session r,
|
||||
/usr/share/sddm/scripts/Xsession r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
|
@ -187,6 +132,12 @@ profile sddm @{exec_path} {
|
|||
/{usr/,}bin/dbus-run-session rix,
|
||||
/{usr/,}bin/dbus-daemon rPUx,
|
||||
|
||||
/usr/share/sddm/scripts/Xsetup r,
|
||||
/usr/share/sddm/scripts/Xstop r,
|
||||
/usr/share/sddm/scripts/wayland-session r,
|
||||
/usr/share/sddm/scripts/Xsession r,
|
||||
|
||||
include if exists <local/sddm_scripts>
|
||||
}
|
||||
|
||||
profile xauth {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -9,95 +10,60 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}bin/sddm-greeter
|
||||
profile sddm-greeter @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/opencl>
|
||||
include <abstractions/qt5-shader-cache>
|
||||
include <abstractions/qt5>
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/sddm/{,**} r,
|
||||
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
|
||||
/usr/share/plasma/desktoptheme/** r,
|
||||
/usr/share/qt5ct/** r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
/etc/sddm.conf.d/{,*} r,
|
||||
/etc/sddm.conf r,
|
||||
/etc/fstab r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/AccountsService/icons/*.icon r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
owner /var/lib/sddm/** rw,
|
||||
owner /var/lib/sddm/#[0-9]*[0-9] mrw,
|
||||
owner /var/lib/sddm/.cache/** mrwkl -> /var/lib/sddm/.cache/**,
|
||||
/var/lib/sddm/state.conf r,
|
||||
|
||||
/usr/share/sddm/{,**} r,
|
||||
|
||||
/etc/sddm.conf.d/{,*} r,
|
||||
/etc/sddm.conf r,
|
||||
|
||||
# QT
|
||||
/{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/*.so mr,
|
||||
/{usr/,}lib/@{multiarch}/qt5/plugins/plasma/dataengine/*.so mr,
|
||||
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/**.qmlc mr,
|
||||
/{usr/,}lib/@{multiarch}/qt5/qml/QtQuick/Controls/Private/*.jsc mr,
|
||||
/{usr/,}lib/@{multiarch}/qt5/qml/QtGraphicalEffects/private/DropShadowBase.qmlc mr,
|
||||
|
||||
# List of graphical sessions
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
/usr/share/wayland-sessions/{,*.desktop} r,
|
||||
|
||||
# Themes
|
||||
/usr/share/plasma/desktoptheme/** r,
|
||||
/usr/share/desktop-base/softwaves-theme/login/*.svg r,
|
||||
|
||||
# User avatars
|
||||
/var/lib/AccountsService/icons/*.icon r,
|
||||
|
||||
# All the following is for the test mode
|
||||
#------------------------------------------------------------------
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/sddm-greeter/ rw,
|
||||
owner @{user_cache_dirs}/sddm-greeter/qmlcache/ rw,
|
||||
owner @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9] rw,
|
||||
owner @{user_cache_dirs}/sddm-greeter/qmlcache/[a-f0-9]*.jsc* rwl -> @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9],
|
||||
owner @{user_cache_dirs}/sddm-greeter/qmlcache/[a-f0-9]*.qmlc* rwl -> @{user_cache_dirs}/sddm-greeter/qmlcache/#[0-9]*[0-9],
|
||||
|
||||
owner @{user_cache_dirs}/qtshadercache/ rw,
|
||||
owner @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9] rw,
|
||||
owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#[0-9]*[0-9],
|
||||
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
|
||||
owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#[0-9]*[0-9],
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma-svgelements-* rw,
|
||||
owner @{user_cache_dirs}/qtshadercache/{,**} rwl,
|
||||
owner @{user_cache_dirs}/sddm-greeter/{,**} rwl,
|
||||
|
||||
owner @{user_config_dirs}/kdeglobals r,
|
||||
owner @{user_config_dirs}/plasmarc r,
|
||||
owner @{user_config_dirs}/qt5ct/{,**} r,
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
# If one is blocked, the others are probed.
|
||||
deny owner @{HOME}/#[0-9]*[0-9] mrw,
|
||||
owner @{HOME}/.glvnd* mrw,
|
||||
# owner /tmp/#[0-9]*[0-9] mrw,
|
||||
# owner /tmp/.glvnd* mrw,
|
||||
|
||||
owner @{user_config_dirs}/kdeglobals r,
|
||||
owner @{user_config_dirs}/plasmarc r,
|
||||
owner @{user_cache_dirs}/icon-cache.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
|
||||
owner @{user_cache_dirs}/plasma-svgelements-* rw,
|
||||
|
||||
include <abstractions/qt5-compose-cache-write>
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
#------------------------------------------------------------------
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
owner /tmp/runtime-sddm/ rw,
|
||||
|
||||
owner @{run}/sddm/{,*} rw,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/ld-*.so mr,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/sys/kernel/core_pattern r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# file_inherit
|
||||
#/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/sddm-greeter>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/startx
|
||||
profile startx @{exec_path} {
|
||||
profile startx @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue