felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update flatpak profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-11 23:06:35 +02:00
parent 009fb9285d
commit fecb4dbca6
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
apparmor.d/groups/flatpak/flatpak
View file

@ -40,6 +40,9 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
signal send peer=flatpak-app, signal send peer=flatpak-app,
unix type=seqpacket peer=(label=flatpak-system-helper),
unix type=stream peer=(label=flatpak//fusermount),
#aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}"
#aa:dbus talk bus=system name=org.freedesktop.Flatpak.SystemHelper label=flatpak-system-helper #aa:dbus talk bus=system name=org.freedesktop.Flatpak.SystemHelper label=flatpak-system-helper
#aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}"
@ -47,6 +50,16 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
#aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper #aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper
#aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal
dbus send bus=session path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=ReloadConfig
peer=(name=org.freedesktop.DBus, label=dbus-session//&unconfined),
dbus send bus=system path=/org/freedesktop/Flatpak/SystemHelper
interface=org.freedesktop.Flatpak.SystemHelper
member=GetRevokefsFd
peer=(name=org.freedesktop.Flatpak.SystemHelper),
@{exec_path} mr, @{exec_path} mr,
@{bin}/bwrap rPx -> flatpak-app, @{bin}/bwrap rPx -> flatpak-app,

1
apparmor.d/groups/flatpak/flatpak-portal
View file

@ -11,6 +11,7 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore>
include <abstractions/mime> include <abstractions/mime>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

5
apparmor.d/groups/flatpak/flatpak-session-helper
View file

@ -21,6 +21,11 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
#aa:dbus own bus=session name=org.freedesktop.Flatpak #aa:dbus own bus=session name=org.freedesktop.Flatpak
dbus receive bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=@{busname}, label=gnome-shell),
@{exec_path} mr, @{exec_path} mr,
@{shells_path} rUx -> user_unconfined, @{shells_path} rUx -> user_unconfined,

1
apparmor.d/groups/flatpak/flatpak-system-helper
View file

@ -34,6 +34,7 @@ profile flatpak-system-helper @{exec_path} {
unix type=seqpacket peer=(label=unconfined), unix type=seqpacket peer=(label=unconfined),
#aa:dbus own bus=system name=org.freedesktop.Flatpak.SystemHelper #aa:dbus own bus=system name=org.freedesktop.Flatpak.SystemHelper
#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon
@{exec_path} mr, @{exec_path} mr,