felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): cleanup some profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2023-02-04 23:36:49 +00:00
parent bac87f9547
commit ff64fbfa51
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
9 changed files with 194 additions and 257 deletions
Download patch file Download diff file Expand all files Collapse all files

52
apparmor.d/profiles-a-f/claws-mail
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -9,16 +10,16 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/claws-mail
profile claws-mail @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/enchant>
include <abstractions/user-download-strict>
include <abstractions/nameservice-strict>
include <abstractions/audio>
include <abstractions/thumbnails-cache-read>
include <abstractions/enchant>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/user-download-strict>
@{exec_path} mr,
@ -29,43 +30,34 @@ profile claws-mail @{exec_path} flags=(complain) {
/{usr/,}bin/gpgsm rCx -> gpg,
/{usr/,}bin/gpgconf rCx -> gpg,
# For Orage integration
/{usr/,}bin/orage rPUx,
/{usr/,}bin/orage rPUx,
/{usr/,}{s,}bin/exim4 rPUx,
/{usr/,}bin/geany rPUx,
# For sending local mails
/{usr/,}{s,}bin/exim4 rPUx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/publicsuffix/*.dafsa r,
/usr/share/sounds/freedesktop/stereo/*.oga r,
# For editing in an external editor
/{usr/,}bin/geany rPUx,
/etc/fstab r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner /var/mail/* rwk,
owner @{HOME}/ r,
owner @{HOME}/.claws-mail/ rw,
owner @{HOME}/.claws-mail/** rwl -> @{HOME}/.claws-mail/**,
owner @{HOME}/Mail/ rw,
owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**,
owner /tmp/claws-mail-[0-9]*/ rw,
owner /tmp/claws-mail-[0-9]*/@{hex} rw,
owner /tmp/claws-mail-[0-9]*/@{hex}.lock rwk,
owner /var/mail/* rwk,
owner @{HOME}/Mail/ rw,
owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
/etc/fstab r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/usr/share/sounds/freedesktop/stereo/*.oga r,
/usr/share/publicsuffix/*.dafsa r,
profile gpg {
include <abstractions/base>

10
apparmor.d/profiles-a-f/dino-im
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -10,10 +11,10 @@ include <tunables/global>
profile dino-im @{exec_path} {
include <abstractions/base>
include <abstractions/dconf-write>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
@ -30,14 +31,13 @@ profile dino-im @{exec_path} {
/{usr/,}bin/gpgconf rCx -> gpg,
/{usr/,}bin/gpgsm rCx -> gpg,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
owner @{user_share_dirs}/dino/ rw,
owner @{user_share_dirs}/dino/** rwk,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
owner @{PROC}/@{pid}/fd/ r,
profile gpg {
include <abstractions/base>

11
apparmor.d/profiles-a-f/execute-dput
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -13,29 +14,27 @@ profile execute-dput @{exec_path} flags=(complain) {
include <abstractions/nameservice-strict>
@{exec_path} r,
/{usr/,}bin/python3.[0-9]* r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/dpkg rPx -> child-dpkg,
/{usr/,}bin/gpgconf rCx -> gpg,
/{usr/,}bin/gpg{,2} rCx -> gpg,
/{usr/,}bin/gpgconf rCx -> gpg,
/{usr/,}bin/gpgsm rCx -> gpg,
/usr/share/dput/{,**} r,
/etc/dput.cf r,
owner @{HOME}/.dput.cf r,
owner @{PROC}/@{pid}/fd/ r,
# sources dir
owner @{user_build_dirs}/**.changes r,
owner @{user_build_dirs}/**.dsc r,
owner @{user_build_dirs}/**.buildinfo r,
owner @{user_build_dirs}/**.tar.xz r,
owner @{PROC}/@{pid}/fd/ r,
profile gpg {
include <abstractions/base>