63 lines
1.6 KiB
Text
63 lines
1.6 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}bin/nautilus
|
|
profile nautilus @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/app-launcher-user>
|
|
include <abstractions/dconf>
|
|
include <abstractions/gnome>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
include <abstractions/trash>
|
|
|
|
@{exec_path} mr,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
|
|
/usr/share/nautilus/{,**} r,
|
|
/usr/share/poppler/{,**} r,
|
|
/usr/share/sounds/freedesktop/stereo/*.oga r,
|
|
/usr/share/tracker3/{,**} r,
|
|
|
|
owner @{user_share_dirs}/nautilus/{,**} rwk,
|
|
|
|
# Full access to user's data
|
|
/ r,
|
|
/home/ r,
|
|
owner @{HOME}/{,**} rw,
|
|
owner @{MOUNTS}/{,**} rw,
|
|
owner @{run}/user/@{uid}/{,**} rw,
|
|
owner /tmp/{,**} rw,
|
|
|
|
# Silence non user's data
|
|
deny /boot/{,**} r,
|
|
deny /opt/{,**} r,
|
|
deny /root/{,**} r,
|
|
deny /tmp/.* rw,
|
|
deny /tmp/.*/{,**} rw,
|
|
|
|
owner @{run}/user/@{uid}/dconf/ rw,
|
|
owner @{run}/user/@{uid}/dconf/user rw,
|
|
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
@{PROC}/@{pids}/net/wireless r,
|
|
|
|
@{run}/mount/utab r,
|
|
@{run}/systemd/userdb/ r,
|
|
|
|
@{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
|
|
@{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
|
|
@{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
|
|
@{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
|
|
|
|
/dev/tty rw,
|
|
/dev/dri/card[0-9]* rw,
|
|
|
|
include if exists <local/nautilus>
|
|
}
|