feat(profile): general update.
This commit is contained in:
Alexandre Pujol
parent
7c5ba70b40
commit
f9a93ab67e
18 changed files with 51 additions and 75 deletions
|
|
@ -20,6 +20,8 @@ profile dbus-session flags=(attach_disconnected) {
|
|||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
network unix stream,
|
||||
|
||||
unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none),
|
||||
|
||||
signal (receive) set=(term hup) peer=gdm-session-worker,
|
||||
|
|
|
|||
|
|
@ -55,6 +55,8 @@ profile child-modprobe-nvidia flags=(attach_disconnected) {
|
|||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
deny @{HOME}/.steam/** r,
|
||||
|
||||
profile kmod {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/kmod>
|
||||
|
|
@ -69,6 +71,8 @@ profile child-modprobe-nvidia flags=(attach_disconnected) {
|
|||
# @{sys}/module/{drm,nvidia}/initstate r,
|
||||
@{sys}/module/compression r,
|
||||
|
||||
deny @{HOME}/.steam/** r,
|
||||
|
||||
include if exists <local/child-modprobe-nvidia_kmod>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -18,6 +18,8 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/bus/org.freedesktop.portal.Desktop>
|
||||
include <abstractions/consoles>
|
||||
|
||||
network unix stream,
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/portal/desktop
|
||||
interface=org.freedesktop.portal.Realtime
|
||||
member=MakeThreadRealtimeWithPID
|
||||
|
|
|
|||
|
|
@ -111,49 +111,21 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile open flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app-launcher-user>
|
||||
include <abstractions/desktop>
|
||||
|
||||
@{lib}/gio-launch-desktop mr,
|
||||
@{bin}/env rix,
|
||||
@{sh_path} r,
|
||||
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
|
||||
@{sh_path} rix,
|
||||
@{lib}/gio-launch-desktop mr,
|
||||
|
||||
@{bin}/aa-notify rPx,
|
||||
@{bin}/blueman-applet rPx,
|
||||
@{bin}/firewall-applet rPx,
|
||||
@{bin}/gnome-keyring-daemon rPx,
|
||||
@{bin}/gnome-shell rPx,
|
||||
@{bin}/gnome-software rPx,
|
||||
@{bin}/im-launch rPx,
|
||||
@{bin}/keepassxc rPx,
|
||||
@{bin}/opensuse-welcome rPx,
|
||||
@{bin}/parcellite rPUx,
|
||||
@{bin}/pkcs11-register rPx,
|
||||
@{bin}/snap rPUx,
|
||||
@{bin}/snapshot-detect rPUx,
|
||||
@{bin}/spice-vdagent rPx,
|
||||
@{bin}/start-pulseaudio-x11 rPx,
|
||||
@{bin}/ubuntu-report rPx,
|
||||
@{bin}/update-notifier rPx,
|
||||
@{bin}/xbrlapi rPx,
|
||||
@{bin}/xdg-user-dirs-gtk-update rPx,
|
||||
@{bin}/xdg-user-dirs-update rPx,
|
||||
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
|
||||
@{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh rPx,
|
||||
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
|
||||
@{lib}/caribou/caribou rPUx,
|
||||
@{lib}/deja-dup/deja-dup-monitor rPx,
|
||||
@{lib}/gsd-* rPx,
|
||||
@{lib}/update-notifier/ubuntu-advantage-notification rPx,
|
||||
@{lib}/xapps/sn-watcher/* rPUx,
|
||||
@{thunderbird_path} rPx,
|
||||
/usr/share/libpam-kwallet-common/pam_kwallet_init rPUx,
|
||||
@{lib}/** PUx,
|
||||
@{bin}/** PUx,
|
||||
/opt/*/** PUx,
|
||||
/usr/share/*/** PUx,
|
||||
/usr/local/bin/** PUx,
|
||||
/usr/games/** PUx,
|
||||
|
||||
#aa:exec baloo
|
||||
#aa:exec evolution-alarm-notify
|
||||
@{lib}/kdeconnectd rPUx,
|
||||
@{lib}/@{multiarch}/{,libexec/}kdeconnectd rPUx,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
/dev/tty rw,
|
||||
|
||||
include if exists <usr/gnome-session-binary_open.d>
|
||||
include if exists <local/gnome-session-binary_open>
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
capability sys_admin, # To set a hostname
|
||||
|
||||
network unix stream,
|
||||
|
||||
unix (bind) type=stream addr=@@{hex16}/bus/systemd-hostnam/system,
|
||||
|
||||
#aa:dbus own bus=system name=org.freedesktop.hostname1
|
||||
|
|
|
|||
|
|
@ -53,12 +53,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/systemd/network/ r,
|
||||
@{run}/systemd/network/*.network r,
|
||||
@{run}/systemd/notify rw,
|
||||
owner @{run}/systemd/netif/.#state rw,
|
||||
owner @{run}/systemd/netif/.#state* rw,
|
||||
owner @{run}/systemd/netif/leases/{,*} rw,
|
||||
owner @{run}/systemd/netif/links/{,*} rw,
|
||||
owner @{run}/systemd/netif/lldp/{,*} rw,
|
||||
owner @{run}/systemd/netif/state rw,
|
||||
owner @{run}/systemd/netif/** rw,
|
||||
|
||||
@{run}/udev/data/n@{int} r,
|
||||
|
||||
|
|
|
|||
|
|
@ -40,6 +40,7 @@ profile cockpit-bridge @{exec_path} {
|
|||
@{lib}/cockpit/cockpit-ssh rPx,
|
||||
|
||||
/usr/share/cockpit/{,**} r,
|
||||
/usr/{,local/}share/ r,
|
||||
|
||||
/etc/cockpit/{,**} r,
|
||||
/etc/httpd/conf/mime.types r,
|
||||
|
|
@ -51,6 +52,7 @@ profile cockpit-bridge @{exec_path} {
|
|||
/etc/shells r,
|
||||
|
||||
owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw,
|
||||
owner @{user_share_dirs}/ r,
|
||||
|
||||
@{run}/user/@{uid}/ssh-agent.[0-9A-Z]* rw,
|
||||
@{run}/utmp r,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue