felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): add the X-strict abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-09 22:45:14 +01:00
parent 5d45b8e7a7
commit f53550525e
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
5 changed files with 34 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/gnome/gnome-shell
View file

@ -25,6 +25,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/vulkan>
include <abstractions/X-strict>
capability sys_nice,
capability sys_ptrace,
@ -40,7 +41,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
signal (receive) set=(term, hup) peer=gdm*,
signal (send),
unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
unix (send,receive) type=stream addr=none peer=(label=gnome-extension-ding),
dbus (send,receive) bus=system path=/org/freedesktop/login[0-9]/session/_[0-9]*
@ -118,7 +118,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/usr/share/ubuntu/applications/{,*.desktop} r,
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r,
/usr/share/xsessions/{,*.desktop} r,
/.flatpak-info r,
/etc/fstab r,
@ -170,8 +169,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/media-art/{,**} r,
owner @{user_cache_dirs}/vlc/**/*.jpg r,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/gnome-shell-disable-extensions rw,
owner @{run}/user/@{uid}/gnome-shell/{,**} rw,
owner @{run}/user/@{uid}/gvfsd/socket-[0-9A-Za-z]* rw,
@ -185,7 +182,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner /tmp/.X[0-9]-lock rw,
owner /tmp/[0-9A-Z]*.shell-extension.zip rw,
owner /tmp/gdkpixbuf-xpm-tmp.[0-9A-Z]* rw,
/tmp/.X11-unix/X[0-9] rw,
@{run}/systemd/users/@{uid} r,
@{run}/systemd/seats/seat[0-9]* r,