felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
3996 commits 5 branches 0 tags 16 MiB
Commit graph

1812 commits

Author SHA1 Message Date
Alexandre Pujol
a68cd26d41
fix(profile): yay: pacman can be used by yay without installing anything 
ie: without `sudo pacmcan -U ...`

see #420
 2025-01-26 21:10:26 +01:00
curiosityseeker
4a978ef9b6
systemd-journald: adding mediate_deleted (#657) 
* Update systemd-journald

profile systemd-journald flags=(mediate_deleted) {
link /var/log/journal/@{hex32}/#42742 ,                                                   # Failed name lookup - deleted entry
link /var/log/journal/@{hex32}/#42744 ,                                                   # Failed name lookup - deleted entry
link /var/log/journal/@{hex32}/.#system@@{hex32}-@{hex16}-@{hex16}.journal@{hex16} -> /var/log/journal/@{hex32}/#42744,
link /var/log/journal/@{hex32}/.#user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal@{hex16} -> /var/log/journal/@{hex32}/#42742,
}

* Update main.flags

Adding `systemd-journald attach_disconnected,mediate_deleted`
 2025-01-26 20:07:44 +00:00
curiosityseeker
d802bf82f2 Update pacman 
profile pacman//systemctl {
  signal send set=(cont term) peer=systemd-tty-ask-password-agent,
}
 2025-01-26 21:06:37 +01:00
curiosityseeker
aec02b8f64 Update systemd-tmpfiles 
profile systemd-tmpfiles {
  @{sys}/devices/system/cpu/cpufreq/ r,
  @{sys}/devices/system/cpu/cpufreq/policy0/scaling_governor w,
  @{sys}/devices/system/cpu/cpufreq/policy1/scaling_governor w,
  @{sys}/devices/system/cpu/cpufreq/policy2/scaling_governor w,
  @{sys}/devices/system/cpu/cpufreq/policy3/scaling_governor w,
  @{sys}/devices/system/cpu/cpufreq/policy4/scaling_governor w,
  @{sys}/devices/system/cpu/cpufreq/policy5/scaling_governor w,
  @{sys}/devices/system/cpu/cpufreq/policy6/scaling_governor w,
  @{sys}/devices/system/cpu/cpufreq/policy7/scaling_governor w,
  @{sys}/module/pcie_aspm/parameters/policy w,
}
 2025-01-26 20:58:41 +01:00
curiosityseeker
5a1a5418ec Update kscreenlocker_greet 2025-01-26 20:58:18 +01:00
curiosityseeker
54a16eb055 Update okular 
Typo.
 2025-01-26 20:57:55 +01:00
Alexandre Pujol
8806030a0a
feat(profile): more use @{etc_ro} when we know it is needed. 2025-01-25 22:31:29 +01:00
nobody43
45f5689d6a xfce, fixes 2025-01-24 21:48:31 +00:00
nobody43
39b38b9ee5 Adapt to RO root 2025-01-23 00:13:29 +00:00
nobody43
bb3bbb492b xfce, proper abi 2025-01-22 23:10:29 +00:00
nobody43
c04ee92d26 xfce, new profiles 2025-01-22 23:06:56 +00:00
nobody43
4286b5330c xfce, updates 2025-01-22 22:50:59 +00:00
beroal
044c490f10
pacat: a CLI utility for playing and recording audio from the PulseAudio suite (#653) 2025-01-22 22:26:31 +00:00
Alexandre Pujol
ef99c81eb1
feat(abs): rewrite the app/open abstraction to accomodate kde requirements. 
See #630 #605  #647
 2025-01-20 22:40:36 +01:00
Alexandre Pujol
cf254c8021
feat(profile): do not use the uname profile directly 
see #611
 2025-01-20 21:31:08 +01:00
Alexandre Pujol
2f98d0817e
fix(profile): child-open-any 
See #647
 2025-01-20 21:26:54 +01:00
Alexandre Pujol
693259d8c1
feat(profile): general update 2025-01-20 21:23:31 +01:00
Alexandre Pujol
d20435eb21
feat(profiles): remove unused user role & mappings 
- Not enabled, tested.
- Will come back under another form later.
 2025-01-15 00:08:43 +01:00
Alexandre Pujol
f66ef4d5ea
chore: fix profile styling issue. 2025-01-09 23:36:42 +01:00
nobody43
0769e42ea2 regression: session names 2 2025-01-09 23:34:29 +01:00
Alexandre Pujol
fa85d909d7
feat(profile): general update. 2025-01-09 22:58:53 +01:00
Alexandre Pujol
f21006dfd2
fix(profile): xfce-terminal graphics 
fix #638
 2025-01-09 22:41:17 +01:00
Alexandre Pujol
6348dafa8e
fix(profile): gnome on X 
fix #641
 2025-01-09 22:23:45 +01:00
Alexandre Pujol
2560e9645f
feat(profile): various improvements and update. 2024-12-25 00:05:36 +01:00
Alexandre Pujol
57ddfd29ce
fix(profile): pacman-hook-systemd: add systemd-tty-ask-password-agent. 
fix  #632
 2024-12-24 23:56:12 +01:00
Roman Beslik
f8fc1aa387 systemd user ask-password 2024-12-23 22:49:27 +01:00
Roman Beslik
b35c2a0abf non-owner accesses authorized_keys 2024-12-23 22:41:42 +01:00
Alexandre Pujol
01c1562e7c
feat(profile): firefox: better naming of possible attachment. 2024-12-23 22:19:29 +01:00
Alexandre Pujol
7167de932c
feat(profile): firefox: restric access to /tmp 2024-12-23 22:17:35 +01:00
Besanon
3721d12a5d
more lxqt-files (#613) 
* Create abstraction for lxqt desktop group

first file for the LXQT 2.0 desktop group

* Update lxqt

* xdg-desktop abstraction added

* removing tabs

* Create startlxqt

starter file for LXQT Desktop

* Create startlxqt

* fixing startlxqt

I use sddm as display manager

I cant remove the other file - only use graphical env., sorry

After startlxqt i would add  2 lines to sddm to enable the start of LXQT desktop

* Delete apparmor.d/profiles-s-z/startlxqt

* indented by 2 spaces (like other entries)

* Update sddm

Enable sddm to start an lxqt desktop session

* Create lxqt-session

lxqt-session to be started by startlxqt. Display manager: sddm

* Update lxqt-session

* Update lxqt-session

* removed trailing whitespace

* Update kscreen_backend_launcher to support lxqt desktop

is needed for several complaints:
DENIED  kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r
DENIED  kscreen_backend_launcher open /usr/share/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r
DENIED  kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r
DENIED  kscreen_backend_launcher open /usr/share/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r

* Update lxqt-session

* Create lxqt-panel

* Update lxqt-panel

* Update lxqt-panel

* Update lxqt-panel

* fix conflicting x

* Update lxqt-panel

add child-open

* remove  include <abstractions/app-launcher-user>

you think its too permissive to have app-launcher-user here, right?

* Update lxqt-panel

add needed programs

* Update lxqt-panel

turning back to layout of corresponding xfce file.

* Create lxqt-globalkeysd

* Create lxqt-about

* Create lxqt-leave

* Create lxqt-runner

* Update lxqt-leave

* Update lxqt-runner

* Update lxqt-globalkeysd

* remove video in lxqt-about

* Update lxqt-about

* Update lxqt-runner

* remove abstr. in lxqt-globalkeysd

* remove abstr. in lxqt-runner

* remove abstr. in lxqt-leave

* Create lxqt-config-notificationd

* Create lxqt-config-locale

* Create lxqt-config-printer

* Create lxqt-config-file-associations

* Create lxqt-config-powermanagement

* enable wayland-session for lxqt 2.1

startlxqtwayland for starting the session, support for labwc and kwin_wayland

* Update lxqt-config-printer

* Update lxqt-config-powermanagement

* Update sddm

* Update sddm

* adapt pci-rules

ok, havent seen this profile yet. I will change that in lxqt-powermanagement as well and check the other profiles

* Update lxqt-config-powermanagement

* Update lxqt-config-powermanagement

* Update lxqt-config-powermanagement

* Update lxqt-config-powermanagement
 2024-12-13 18:06:59 +01:00
Alex
64ed654fdf fix(profile): cron communication with dbus. 2024-12-12 22:52:55 +01:00
Alexandre Pujol
c7030f16a6 feat(profile): minor update. 2024-12-12 22:52:55 +01:00
Alexandre Pujol
212b8dcf54
feat(profile): improve some core profiles. 2024-11-29 15:34:10 +00:00
Besanon
7acd9079a2
add more lxqt files (#600) 
* Create abstraction for lxqt desktop group

first file for the LXQT 2.0 desktop group

* Update lxqt

* xdg-desktop abstraction added

* removing tabs

* Create startlxqt

starter file for LXQT Desktop

* Create startlxqt

* fixing startlxqt

I use sddm as display manager

I cant remove the other file - only use graphical env., sorry

After startlxqt i would add  2 lines to sddm to enable the start of LXQT desktop

* Delete apparmor.d/profiles-s-z/startlxqt

* indented by 2 spaces (like other entries)

* Update sddm

Enable sddm to start an lxqt desktop session

* Create lxqt-session

lxqt-session to be started by startlxqt. Display manager: sddm

* Update lxqt-session

* Update lxqt-session

* removed trailing whitespace

* Update kscreen_backend_launcher to support lxqt desktop

is needed for several complaints:
DENIED  kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r
DENIED  kscreen_backend_launcher open /usr/share/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r
DENIED  kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r
DENIED  kscreen_backend_launcher open /usr/share/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r

* Update lxqt-session

* Create lxqt-panel

* Update lxqt-panel

* Update lxqt-panel

* Update lxqt-panel

* fix conflicting x

* Update lxqt-panel

add child-open

* remove  include <abstractions/app-launcher-user>

you think its too permissive to have app-launcher-user here, right?

* Update lxqt-panel

add needed programs

* Update lxqt-panel

turning back to layout of corresponding xfce file.

* Create lxqt-globalkeysd

* Create lxqt-about

* Create lxqt-leave

* Create lxqt-runner

* Update lxqt-leave

* Update lxqt-runner

* Update lxqt-globalkeysd

* remove video in lxqt-about

* Update lxqt-about

* Update lxqt-runner

* remove abstr. in lxqt-globalkeysd

* remove abstr. in lxqt-runner

* remove abstr. in lxqt-leave
 2024-11-23 17:44:18 +00:00
Alexandre Pujol
044f80b1db
feat(tunable): unify some XDG and user dirs varibale name. 2024-11-21 20:59:06 +00:00
Alexandre Pujol
cb86f1c076
feat(profile): general update. 2024-11-21 20:37:39 +00:00
Alexandre Pujol
65f2d21558
feat(profile): add profile for tecla. 2024-11-21 20:37:39 +00:00
Alexandre Pujol
36d787fa44
feat(abs): add abstraction/webkit. 2024-11-21 20:37:39 +00:00
Alexandre Pujol
8d4d17fa34
feat(profile): add fc-match & fc-pattern. 2024-11-21 19:26:57 +00:00
Alexandre Pujol
815e9bfda2
feat(profile): general update. 2024-11-19 23:07:41 +00:00
Alexandre Pujol
e149e77538
fix(profile): dhcpcd executes resolvconf 
fix #608
 2024-11-19 21:52:12 +00:00
Alexandre Pujol
206bc3473d
fix: missing @{udbus} in unix bind. 2024-11-19 20:44:34 +00:00
Alexandre Pujol
5bf8d362fa
fix(profile): minor improvment to ensure tests passes. 2024-11-19 19:49:22 +00:00
Alexandre Pujol
4e5f4cb06a
feat: profiles and integration tests improvments. 
Add the udbus variable to be used in `unix bind` rule for dbus.
 2024-11-19 19:04:27 +00:00
Alexandre Pujol
24ea5f0a3a
feat(tunable): add p_dbus_* variables. 
This allow for better integration for system when dbus is not confined.
 2024-11-13 12:23:36 +00:00
Alexandre Pujol
9cb3ea244c
feat(profile): add homectl. 2024-11-12 22:18:41 +00:00
Alexandre Pujol
66455a9251
feat(profile): improve support for some profiles. 
Most of the rules have come from the integration tests.
 2024-11-12 22:18:11 +00:00
Alexandre Pujol
4108d6a987
feat(profile): update some core profiles. 2024-11-12 20:42:31 +00:00
Alexandre Pujol
ebd6d54733
feat(profile): update systemd profiles. 2024-11-12 20:36:18 +00:00
Alexandre Pujol
9a3adc66d0
feat(profile): small profile update. 2024-11-11 22:18:39 +00:00