feat(profile): general update.
This commit is contained in:
Alexandre Pujol
parent
79eed4b93d
commit
faab4928ed
23 changed files with 213 additions and 286 deletions
|
|
@ -7,30 +7,26 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/gpartedbin
|
||||
@{exec_path} += @{lib}/gpartedbin
|
||||
@{exec_path} += @{lib}/gparted/gpartedbin
|
||||
@{exec_path} = @{bin}/gpartedbin @{lib}/{,gparted/}gpartedbin
|
||||
profile gpartedbin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
|
||||
capability dac_read_search,
|
||||
capability ipc_lock,
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
ptrace (read),
|
||||
ptrace read,
|
||||
|
||||
signal (send) peer=mke2fs,
|
||||
signal send peer=mke2fs,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{sh_path} rix,
|
||||
|
||||
@{bin}/blkid rPx,
|
||||
@{bin}/dmidecode rPx,
|
||||
|
|
@ -84,29 +80,21 @@ profile gpartedbin @{exec_path} {
|
|||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/mapper/control rw,
|
||||
|
||||
profile mount {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> /tmp/gparted-*/,
|
||||
mount /dev/{s,v}d[a-z]*@{int} -> /tmp/gparted-*/,
|
||||
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> /boot/,
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/,
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/,
|
||||
mount /dev/{s,v}d[a-z]*@{int} -> /boot/,
|
||||
mount /dev/{s,v}d[a-z]*@{int} -> @{MOUNTS}/,
|
||||
mount /dev/{s,v}d[a-z]*@{int} -> @{MOUNTS}/*/,
|
||||
|
||||
@{bin}/mount mr,
|
||||
|
||||
@{sys}/devices/@{pci}/block/{s,v}d[a-z]/ r,
|
||||
@{sys}/devices/@{pci}/block/{s,v}d[a-z]/dev r,
|
||||
@{sys}/devices/@{pci}/block/{s,v}d[a-z]/{s,v}d[a-z][0-9]*/ r,
|
||||
@{sys}/devices/@{pci}/block/{s,v}d[a-z]/{s,v}d[a-z][0-9]*/{start,size} r,
|
||||
|
||||
/dev/{s,v}d[a-z]* r,
|
||||
/dev/{s,v}d[a-z]*[0-9]* r,
|
||||
|
||||
include if exists <local/gpartedbin_umount>
|
||||
}
|
||||
|
||||
profile umount {
|
||||
|
|
@ -128,6 +116,7 @@ profile gpartedbin @{exec_path} {
|
|||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
include if exists <local/gpartedbin_umount>
|
||||
}
|
||||
|
||||
profile udevadm {
|
||||
|
|
|
|||
|
|
@ -10,14 +10,12 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/gpodder
|
||||
profile gpodder @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/python>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -32,64 +30,30 @@ profile gpodder @{exec_path} {
|
|||
@{sh_path} rix,
|
||||
@{bin}/uname rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/gPodder/ rw,
|
||||
owner @{HOME}/gPodder/** rwk,
|
||||
|
||||
/usr/share/gpodder/{,**} r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
owner /var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
/etc/mime.types r,
|
||||
|
||||
/usr/share/*/*.desktop r,
|
||||
|
||||
@{bin}/xdg-settings rPUx,
|
||||
|
||||
@{bin}/xdg-open rCx -> open,
|
||||
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
|
||||
@{bin}/xdg-settings rPx,
|
||||
@{open_path} rPx -> child-open,
|
||||
|
||||
# A/V players
|
||||
@{bin}/smplayer rPUx,
|
||||
@{bin}/vlc rPUx,
|
||||
@{bin}/mpv rPUx,
|
||||
|
||||
# Open in a web browser
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
/usr/share/gpodder/{,**} r,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/mime.types r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/gPodder/ rw,
|
||||
owner @{HOME}/gPodder/** rwk,
|
||||
|
||||
owner /var/tmp/etilqs_@{hex16} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
@{bin}/xdg-open mr,
|
||||
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/readlink rix,
|
||||
@{bin}/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
@{lib}/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/gpodder>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,9 +8,10 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/hw-probe
|
||||
profile hw-probe @{exec_path} {
|
||||
profile hw-probe @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/perl>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
|
|
@ -20,111 +21,134 @@ profile hw-probe @{exec_path} {
|
|||
@{exec_path} rm,
|
||||
@{bin}/perl r,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/{,e}grep rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/dd rix,
|
||||
@{bin}/efibootmgr rix,
|
||||
@{bin}/efivar rix,
|
||||
@{bin}/md5sum rix,
|
||||
@{bin}/pwd rix,
|
||||
@{bin}/sleep rix,
|
||||
@{bin}/tar rix,
|
||||
@{bin}/uname rix,
|
||||
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/dpkg rPx -> child-dpkg,
|
||||
|
||||
@{bin}/acpi rPx,
|
||||
@{bin}/amixer rPx,
|
||||
@{bin}/aplay rPx,
|
||||
@{bin}/biosdecode rPx,
|
||||
@{bin}/cpuid rPx,
|
||||
@{bin}/cpupower rPx,
|
||||
@{bin}/df rPx,
|
||||
@{bin}/dkms rPx,
|
||||
@{bin}/dmesg rPx,
|
||||
@{bin}/dmidecode rPx,
|
||||
@{bin}/edid-decode rPx,
|
||||
@{bin}/fdisk rPx,
|
||||
@{bin}/glxgears rPx,
|
||||
@{bin}/glxinfo rPx,
|
||||
@{bin}/hciconfig rPx,
|
||||
@{bin}/hdparm rPx,
|
||||
@{bin}/hwinfo rPx,
|
||||
@{bin}/i2cdetect rPx,
|
||||
@{bin}/inxi rPx,
|
||||
@{bin}/lsblk rPx,
|
||||
@{bin}/lscpu rPx,
|
||||
@{bin}/lspci rPx,
|
||||
@{bin}/lsusb rPx,
|
||||
@{bin}/memtester rPx,
|
||||
@{bin}/rfkill rPx,
|
||||
@{bin}/sensors rPx,
|
||||
@{bin}/smartctl rPx,
|
||||
@{bin}/upower rPx,
|
||||
@{bin}/uptime rPx,
|
||||
@{bin}/usb-devices rPx,
|
||||
@{bin}/xdpyinfo rPx,
|
||||
@{bin}/xinput rPx,
|
||||
@{bin}/xrandr rPx,
|
||||
@{sh_path} rix,
|
||||
@{bin}/{,e}grep rix,
|
||||
@{bin}/{m,g,}awk rix,
|
||||
@{bin}/dd rix,
|
||||
@{bin}/efibootmgr rix,
|
||||
@{bin}/efivar rix,
|
||||
@{bin}/find rix,
|
||||
@{bin}/md5sum rix,
|
||||
@{bin}/pwd rix,
|
||||
@{bin}/sleep rix,
|
||||
@{bin}/sort rix,
|
||||
@{bin}/tar rix,
|
||||
@{bin}/uname rix,
|
||||
|
||||
@{bin}/acpi rPx,
|
||||
@{bin}/amixer rPx,
|
||||
@{bin}/aplay rPx,
|
||||
@{bin}/biosdecode rPx,
|
||||
@{bin}/cpuid rPx,
|
||||
@{bin}/cpupower rPx,
|
||||
@{bin}/curl rCx -> curl,
|
||||
@{bin}/df rPx,
|
||||
@{bin}/dkms rPx,
|
||||
@{bin}/dmesg rPx,
|
||||
@{bin}/dmidecode rPx,
|
||||
@{bin}/dpkg rPx -> child-dpkg,
|
||||
@{bin}/edid-decode rPx,
|
||||
@{bin}/ethtool rCx -> netconfig,
|
||||
@{bin}/find rCx -> find,
|
||||
@{bin}/fdisk rPx,
|
||||
@{bin}/glxgears rPx,
|
||||
@{bin}/glxinfo rPx,
|
||||
@{bin}/hciconfig rPx,
|
||||
@{bin}/hdparm rPx,
|
||||
@{bin}/hwinfo rPx,
|
||||
@{bin}/i2cdetect rPx,
|
||||
@{bin}/ifconfig rCx -> netconfig,
|
||||
@{bin}/inxi rPx,
|
||||
@{bin}/iw rCx -> netconfig,
|
||||
@{bin}/iwconfig rCx -> netconfig,
|
||||
@{bin}/journalctl rCx -> journalctl,
|
||||
@{bin}/killall rCx -> killall,
|
||||
@{bin}/kmod rCx -> kmod,
|
||||
@{bin}/kmod rix,
|
||||
@{bin}/lsb_release rPx -> lsb_release,
|
||||
@{bin}/lsblk rPx,
|
||||
@{bin}/lscpu rPx,
|
||||
@{bin}/lspci rPx,
|
||||
@{bin}/lsusb rPx,
|
||||
@{bin}/memtester rPx,
|
||||
@{bin}/nmcli rPx,
|
||||
@{bin}/pacman rCx -> pacman,
|
||||
@{bin}/rfkill rPx,
|
||||
@{bin}/rpm rCx -> rpm,
|
||||
@{bin}/sensors rPx,
|
||||
@{bin}/smartctl rPx,
|
||||
@{bin}/systemctl rCx -> systemctl,
|
||||
@{bin}/systemd-analyze rPx,
|
||||
@{bin}/udevadm rCx -> udevadm,
|
||||
|
||||
/usr/share/X11/xorg.conf.d/{,*.conf} r,
|
||||
@{bin}/upower rPx,
|
||||
@{bin}/uptime rPx,
|
||||
@{bin}/usb-devices rPx,
|
||||
@{bin}/xdpyinfo rPx,
|
||||
@{bin}/xinput rPx,
|
||||
@{bin}/xrandr rPx,
|
||||
|
||||
/etc/modprobe.d/{,*.conf} r,
|
||||
/etc/X11/xorg.conf.d/{,*.conf} r,
|
||||
|
||||
/var/log/Xorg.[0-9].log{,.old} r,
|
||||
owner @{HOME}/HW_PROBE/{,**} rw,
|
||||
|
||||
owner /root/HW_PROBE/{,**} rw,
|
||||
|
||||
owner @{tmp}/*/ rw,
|
||||
audit owner @{tmp}/*/ rw,
|
||||
owner @{tmp}/*/cpu_perf rw,
|
||||
|
||||
@{sys}/class/drm/ r,
|
||||
@{sys}/class/power_supply/ r,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/* r,
|
||||
@{sys}/devices/@{pci}/drm/card@{int}/*/edid r,
|
||||
@{sys}/devices/**/power_supply/*/uevent r,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/* r,
|
||||
@{sys}/firmware/efi/efivars/ r,
|
||||
@{sys}/firmware/efi/efivars/* r,
|
||||
@{sys}/module/*/ r,
|
||||
@{sys}/module/*/{coresize,refcnt} r,
|
||||
@{sys}/module/*/holders/ r,
|
||||
|
||||
@{PROC}/bus/input/devices r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/interrupts r,
|
||||
@{PROC}/ioports r,
|
||||
@{PROC}/modules r,
|
||||
@{PROC}/scsi/scsi r,
|
||||
|
||||
profile find {
|
||||
/dev/{,**} r,
|
||||
|
||||
profile pacman flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{bin}/pacman mr,
|
||||
|
||||
@{bin}/gpg rPx -> pacman//gpg,
|
||||
@{bin}/gpgconf rPx -> pacman//gpg,
|
||||
@{bin}/gpgsm rPx -> pacman//gpg,
|
||||
|
||||
/etc/pacman.conf r,
|
||||
/etc/pacman.d/{,**} r,
|
||||
|
||||
/var/lib/pacman/{,**} r,
|
||||
|
||||
include if exists <local/hw-probe_pacman>
|
||||
}
|
||||
|
||||
profile rpm flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{bin}/find mr,
|
||||
@{bin}/rpm mr,
|
||||
|
||||
/root/ r,
|
||||
/var/ r,
|
||||
/var/lib/ r,
|
||||
/var/lib/rpm/ r,
|
||||
/var/lib/rpm/rpmdb.sqlite rk,
|
||||
/var/lib/rpm/rpmdb.sqlite-shm rwk,
|
||||
/var/lib/rpm/rpmdb.sqlite-wal rw,
|
||||
|
||||
/dev/{,**} r,
|
||||
|
||||
include if exists <local/hw-probe_find>
|
||||
include if exists <local/hw-probe_rpm>
|
||||
}
|
||||
|
||||
profile journalctl {
|
||||
profile journalctl flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/journalctl mr,
|
||||
|
|
@ -133,18 +157,18 @@ profile hw-probe @{exec_path} {
|
|||
/etc/machine-id r,
|
||||
|
||||
@{run}/log/ rw,
|
||||
/{run,var}/log/journal/ rw,
|
||||
/{run,var}/log/journal/@{hex32}/ rw,
|
||||
/{run,var}/log/journal/@{hex32}/user-@{hex}.journal* rw,
|
||||
/{run,var}/log/journal/@{hex32}/system.journal* rw,
|
||||
/{run,var}/log/journal/@{hex32}/system@@{hex}.journal* rw,
|
||||
/{run,var}/log/journal/ r,
|
||||
/{run,var}/log/journal/@{hex32}/ r,
|
||||
/{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r,
|
||||
/{run,var}/log/journal/@{hex32}/system.journal* r,
|
||||
/{run,var}/log/journal/@{hex32}/system@@{hex}.journal* r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
include if exists <local/hw-probe_journalctl>
|
||||
}
|
||||
|
||||
profile killall {
|
||||
profile killall flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
|
@ -155,8 +179,6 @@ profile hw-probe @{exec_path} {
|
|||
|
||||
@{bin}/killall mr,
|
||||
|
||||
# The /proc/ dir is needed to avoid the following error:
|
||||
# /proc: Permission denied
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
|
||||
|
|
@ -170,22 +192,7 @@ profile hw-probe @{exec_path} {
|
|||
include if exists <local/hw-probe_udevadm>
|
||||
}
|
||||
|
||||
profile kmod {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/kmod mr,
|
||||
|
||||
@{sys}/module/*/ r,
|
||||
@{sys}/module/*/{coresize,refcnt} r,
|
||||
@{sys}/module/*/holders/ r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/modules r,
|
||||
|
||||
include if exists <local/hw-probe_kmod>
|
||||
}
|
||||
|
||||
profile netconfig {
|
||||
profile netconfig flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
|
||||
# Not needed
|
||||
|
|
@ -210,7 +217,7 @@ profile hw-probe @{exec_path} {
|
|||
include if exists <local/hw-probe_netconfig>
|
||||
}
|
||||
|
||||
profile systemctl {
|
||||
profile systemctl flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
|
|
|
|||
|
|
@ -12,19 +12,10 @@ profile hwinfo @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
# Without the sys_admin CAP, some information, for instance the reserved I/O port address range
|
||||
# in the /proc/ioports, will be hidden.
|
||||
capability sys_admin,
|
||||
|
||||
# For the kernel log entries to be shown in the output
|
||||
capability syslog,
|
||||
|
||||
# To remove the following errors:
|
||||
# eth0: socket failed: Operation not permitted
|
||||
capability net_raw,
|
||||
|
||||
# Needed when passed disk related options (--block, --partition, --floppy)
|
||||
capability sys_rawio,
|
||||
capability net_raw, # Needed for network related options
|
||||
capability sys_admin, # Needed for /proc/ioports
|
||||
capability sys_rawio, # Needed for disk related options
|
||||
capability syslog, # Needed for /proc/kmsg
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
@ -36,58 +27,61 @@ profile hwinfo @{exec_path} {
|
|||
|
||||
@{bin}/kmod rCx -> kmod,
|
||||
@{bin}/udevadm rCx -> udevadm,
|
||||
@{bin}/acpidump rPUx,
|
||||
|
||||
@{bin}/dmraid rPUx,
|
||||
|
||||
@{PROC}/version r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/dma r,
|
||||
@{PROC}/interrupts r,
|
||||
@{PROC}/modules r,
|
||||
@{PROC}/tty/driver/serial r,
|
||||
@{PROC}/ioports r,
|
||||
@{PROC}/bus/input/devices r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/driver/nvram r,
|
||||
@{PROC}/sys/dev/cdrom/info r,
|
||||
/usr/share/hwinfo/{,**} r,
|
||||
|
||||
/dev/mem r,
|
||||
/dev/nvram r,
|
||||
/dev/psaux r,
|
||||
/dev/console rw,
|
||||
/dev/ttyS@{int} r,
|
||||
/dev/fb@{int} r,
|
||||
/var/lib/hardware/udi/{,**} r,
|
||||
|
||||
owner @{tmp}/hwinfo*.txt rw,
|
||||
|
||||
@{sys}/bus/{,**/} r,
|
||||
@{sys}/class/*/ r,
|
||||
@{sys}/devices/@{pci_bus}/** r,
|
||||
@{sys}/devices/**/input/**/dev r,
|
||||
@{sys}/devices/@{pci}/** r,
|
||||
@{sys}/devices/**/{modalias,uevent} r,
|
||||
@{sys}/devices/**/input/**/dev r,
|
||||
@{sys}/devices/virtual/net/*/{type,carrier,address} r,
|
||||
@{sys}/firmware/dmi/tables/DMI r,
|
||||
@{sys}/firmware/dmi/tables/smbios_entry_point r,
|
||||
@{sys}/firmware/edd/{,**} r,
|
||||
|
||||
/var/lib/hardware/udi/ r,
|
||||
|
||||
# For a log file
|
||||
owner @{tmp}/hwinfo*.txt rw,
|
||||
@{PROC}/bus/input/devices r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/dma r,
|
||||
@{PROC}/driver/nvram r,
|
||||
@{PROC}/interrupts r,
|
||||
@{PROC}/ioports r,
|
||||
@{PROC}/modules r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/sys/dev/cdrom/info r,
|
||||
@{PROC}/tty/driver/serial r,
|
||||
@{PROC}/version r,
|
||||
|
||||
/dev/console rw,
|
||||
/dev/fb@{int} r,
|
||||
/dev/mem r,
|
||||
/dev/nvram r,
|
||||
/dev/psaux r,
|
||||
/dev/ttyS@{int} r,
|
||||
|
||||
profile kmod {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{bin}/kmod mr,
|
||||
|
||||
/etc/modprobe.d/{,*.conf} r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
# file_inherit
|
||||
/dev/ttyS@{int} r,
|
||||
owner @{tmp}/hwinfo*.txt rw,
|
||||
|
||||
@{sys}/devices/@{pci}/drm/card@{int}/ r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/modules r,
|
||||
|
||||
include if exists <local/hwinfo_udevadm>
|
||||
}
|
||||
|
||||
profile udevadm {
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} += @{lib}/libreoffice/program/soffice
|
||||
profile libreoffice @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue