95 lines
No EOL
2.8 KiB
Text
95 lines
No EOL
2.8 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/element-desktop
|
|
profile element @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/chromium-common>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/dri-common>
|
|
include <abstractions/dri-enumerate>
|
|
include <abstractions/fonts>
|
|
include <abstractions/freedesktop.org>
|
|
include <abstractions/gtk>
|
|
include <abstractions/mesa>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/nvidia>
|
|
include <abstractions/p11-kit>
|
|
include <abstractions/ssl_certs>
|
|
include <abstractions/video>
|
|
include <abstractions/vulkan>
|
|
include <abstractions/X-strict>
|
|
|
|
capability sys_ptrace,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
@{exec_path} mr,
|
|
|
|
@{bin}/electron@{int} rix,
|
|
@{lib}/electron@{int}/{,**} r,
|
|
@{lib}/electron@{int}/electron rix,
|
|
@{lib}/element/{,**} r,
|
|
@{lib}/element/app.asar.unpacked/node_modules/**.node mr,
|
|
|
|
@{bin}/xdg-open rPx -> child-open,
|
|
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
|
|
@{lib}/gio-launch-desktop rPx -> child-open,
|
|
|
|
/opt/intel/oneapi/{compiler,lib,mkl}/**/ r,
|
|
/opt/intel/oneapi/{compiler,lib,mkl}/**.so* mr,
|
|
|
|
/usr/share/webapps/element/{,**} r,
|
|
|
|
/etc/libva.conf r,
|
|
/etc/element/{,**} r,
|
|
/etc/webapps/element/{,**} r,
|
|
|
|
owner @{user_config_dirs}/ r,
|
|
owner @{user_config_dirs}/Element/ rw,
|
|
owner @{user_config_dirs}/Element/** rwkl -> @{user_config_dirs}/Element/**,
|
|
owner @{user_config_dirs}/pulse/client.conf r,
|
|
owner @{user_config_dirs}/pulse/cookie rk,
|
|
|
|
@{sys}/bus/pci/devices/ r,
|
|
@{sys}/devices/@{pci}/class r,
|
|
@{sys}/devices/@{pci}/resource r,
|
|
@{sys}/devices/@{pci}/irq r,
|
|
@{sys}/devices/system/cpu/cpu@{int}/cache/{,**} r,
|
|
@{sys}/devices/system/cpu/cpu@{int}/topology/{,**} r,
|
|
@{sys}/devices/system/cpu/kernel_max r,
|
|
@{sys}/devices/system/cpu/present r,
|
|
@{sys}/devices/virtual/tty/tty@{int}/active r,
|
|
@{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_{cur,min,max}_freq r,
|
|
|
|
@{PROC}/ r,
|
|
@{PROC}/sys/fs/inotify/max_user_watches r,
|
|
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
|
owner @{PROC}/@{pid}/cmdline r,
|
|
owner @{PROC}/@{pid}/comm r,
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/oom_score_adj w,
|
|
owner @{PROC}/@{pid}/stat r,
|
|
owner @{PROC}/@{pid}/statm r,
|
|
owner @{PROC}/@{pid}/status r,
|
|
owner @{PROC}/@{pid}/task/ r,
|
|
owner @{PROC}/@{pid}/task/@{tid}/status r,
|
|
|
|
/dev/tty rw,
|
|
|
|
deny / r,
|
|
deny @{HOME}/ r,
|
|
deny @{user_share_dirs}/gvfs-metadata/* r,
|
|
deny /etc/machine-id r,
|
|
|
|
include if exists <local/element>
|
|
} |