felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dbus): improve dbus introspectable rules.

Browse source
This commit is contained in:
Alexandre Pujol 2023-09-15 18:14:39 +01:00
parent 2d2693bd99
commit f7d1931bdf
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
37 changed files with 51 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/groups/gnome/evolution-source-registry
View file

@ -21,12 +21,9 @@ profile evolution-source-registry @{exec_path} {
network inet6 dgram,
network netlink raw,
dbus (receive) bus=session path=/org/gnome/evolution/dataserver{,/**}
interface=org.freedesktop.DBus.Introspectable
peer=(name=:*, label=gnome-shell),
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/gnome/evolution/dataserver/SourceManager

2
apparmor.d/groups/gnome/gdm-wayland-session
View file

@ -31,7 +31,7 @@ profile gdm-wayland-session @{exec_path} {
member=Get
peer=(name=org.freedesktop.systemd[0-9]*, label=unconfined),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

14
apparmor.d/groups/gnome/gjs-console
View file

@ -41,14 +41,9 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop/Notifications
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop
interface=org.freedesktop.DBus.Introspectable
member=Introspect
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/freedesktop/Notifications
@ -68,11 +63,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
interface=org.freedesktop.DBus.Properties
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/{,org}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus bind bus=session name=org.gnome.ScreenSaver,
dbus bind bus=session name=org.freedesktop.Notifications,

4
apparmor.d/groups/gnome/gnome-shell
View file

@ -324,10 +324,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
member=Introspect
peer=(name=:*), # all paths and peer's labels
dbus receive bus=session path=/{,org,StatusNotifierWatcher}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell), # itself
peer=(name=:*, label=gnome-shell),
dbus (send, receive) bus=session path=/org/gnome/SettingsDaemon/Rfkill
interface=org.freedesktop.DBus.Properties

2
apparmor.d/groups/gnome/gsd-a11y-settings
View file

@ -44,7 +44,7 @@ profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-color
View file

@ -108,7 +108,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
member=Embed
peer=(name=org.a11y.atspi.Registry), # all peer's labels
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-datetime
View file

@ -44,7 +44,7 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -85,7 +85,7 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
member=ListMountableInfo
peer=(name=:*, label=gvfsd),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -149,7 +149,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
member=EventListenerDeregistered
peer=(name=:*, label=at-spi2-registryd),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-power
View file

@ -160,7 +160,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
member=ActiveChanged
peer=(name=:*, label=gjs-console),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-print-notifications
View file

@ -68,7 +68,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
member=RegisterClient
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

6
apparmor.d/groups/gnome/gsd-printer
View file

@ -45,10 +45,10 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
member={EndSession,QueryEndSession,CancelEndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*),
member=Introspect
peer=(name=:*, label=gnome-shell),
@{exec_path} mr,

2
apparmor.d/groups/gnome/gsd-rfkill
View file

@ -76,7 +76,7 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
member=PropertiesChanged
peer=(name=org.freedesktop.DBus, label=gnome-shell),
dbus receive bus=session path=/{,org}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-screensaver-proxy
View file

@ -43,7 +43,7 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/{,org}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-sharing
View file

@ -91,7 +91,7 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
member=StopUnit
peer=(name=org.freedesktop.systemd[0-9]*), # all peer's labels
dbus receive bus=session path=/{,org}
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-smartcard
View file

@ -56,7 +56,7 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-sound
View file

@ -45,7 +45,7 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) {
member={CancelEndSession,QueryEndSession,EndSession,Stop}
peer=(name=:*, label=gnome-session-binary),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/gsd-wacom
View file

@ -75,7 +75,7 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
member=GetAll
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=:*, label=gnome-shell),

2
apparmor.d/groups/gnome/tracker-extract
View file

@ -60,7 +60,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
member=Introspect
peer=(name=:*, label=gnome-shell),
dbus receive bus=session path=/org/gtk/vfs/mounttracker