255 lines
10 KiB
Text
255 lines
10 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{libexec}/gnome-session-binary
|
|
profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/dbus-session-strict>
|
|
include <abstractions/dbus-strict>
|
|
include <abstractions/dbus-accessibility-strict>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/dri-common>
|
|
include <abstractions/dri-enumerate>
|
|
include <abstractions/gtk>
|
|
include <abstractions/mesa>
|
|
include <abstractions/vulkan>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/X-strict>
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network netlink raw,
|
|
|
|
signal (receive) set=(term, hup) peer=gdm*,
|
|
signal (send) set=(term) peer=at-spi-bus-launcher,
|
|
signal (send) set=(term) peer=gsd-*,
|
|
|
|
dbus send bus=session path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={RequestName,ReleaseName,UpdateActivationEnvironment,GetConnectionUnixUser,GetConnectionUnixProcessID}
|
|
peer=(name=org.freedesktop.DBus label=dbus-daemon),
|
|
|
|
dbus send bus=system path=/org/freedesktop/login[0-9]
|
|
interface=org.freedesktop.login[0-9].Manager
|
|
member={CanPowerOff,GetSession,PowerOff,Inhibit,Reboot}
|
|
peer=(name=:*, label=systemd-logind),
|
|
|
|
dbus receive bus=system path=/org/freedesktop/login[0-9]
|
|
interface=org.freedesktop.login[0-9].Manager
|
|
member={SessionNew,PrepareForShutdown,SessionRemoved,UserNew,UserRemoved,PrepareForSleep}
|
|
peer=(name=:*, label=systemd-logind),
|
|
|
|
dbus send bus=system path=/org/freedesktop/login[0-9]/session/*
|
|
interface=org.freedesktop.login[0-9].Session
|
|
member=SetIdleHint
|
|
peer=(name=org.freedesktop.login[0-9], label=systemd-logind),
|
|
|
|
dbus (send,receive) bus=session path=/org/gnome/SessionManager{,/**}
|
|
interface={org.freedesktop.DBus.Introspectable,org.gnome.SessionManager**},
|
|
|
|
dbus receive bus=session path=/org/gnome/SessionManager
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=GetAll
|
|
peer=(name=:*, label=at-spi2-registryd),
|
|
|
|
dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
|
|
interface=org.gnome.SessionManager.ClientPrivate
|
|
member=CancelEndSession
|
|
peer=(name=org.freedesktop.DBus, label=gsd-*),
|
|
|
|
dbus send bus=session path=/org/gnome/SessionManager/Presence
|
|
interface=org.gnome.SessionManager.Presence
|
|
member=StatusChanged
|
|
peer=(name=org.freedesktop.DBus, label=gnome-shell),
|
|
|
|
dbus send bus=session path=/org/gnome/SessionManager/EndSessionDialog
|
|
interface=org.gnome.SessionManager.EndSessionDialog
|
|
member=Open
|
|
peer=(name=:*, label=gnome-shell),
|
|
|
|
dbus send bus=session path=/org/gnome/SessionManager/EndSessionDialog
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=GetAll
|
|
peer=(name=:*, label=gnome-shell),
|
|
|
|
dbus (send, receive) bus=system path=/org/freedesktop/login[0-9]*
|
|
interface=org.freedesktop.DBus.Properties
|
|
member={GetAll,PropertiesChanged}
|
|
peer=(name=:*, label=systemd-logind),
|
|
|
|
dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/**}
|
|
interface=org.freedesktop.DBus.Properties
|
|
member={GetAll,PropertiesChanged}
|
|
peer=(name="{org.freedesktop.DBus,:*}", label="{gsd-*,gnome-*,xdg-desktop-portal-*}"),
|
|
|
|
dbus send bus=session path=/org/freedesktop/systemd[0-9]*
|
|
interface=org.freedesktop.systemd[0-9]*.Manager
|
|
peer=(name=org.freedesktop.systemd[0-9]*, label=unconfined), # all members
|
|
|
|
dbus send bus=session path=/org/gnome/Mutter/IdleMonitor
|
|
interface=org.freedesktop.DBus.ObjectManager
|
|
member=GetManagedObjects
|
|
peer=(name=:*, label=gnome-shell),
|
|
|
|
dbus send bus=session path=/org/gnome/Mutter/IdleMonitor/Core
|
|
interface=org.gnome.Mutter.IdleMonitor
|
|
member={AddIdleWatch,AddUserActiveWatch,RemoveWatch}
|
|
peer=(name=:*, label=gnome-shell),
|
|
|
|
dbus receive bus=session path=/org/gnome/Mutter/IdleMonitor/Core
|
|
interface=org.gnome.Mutter.IdleMonitor
|
|
member=WatchFired
|
|
peer=(name=:*, label=gnome-shell),
|
|
|
|
dbus send bus=session path=/org/gnome/ScreenSaver
|
|
interface=org.gnome.ScreenSaver
|
|
member=GetActive
|
|
peer=(name=:*),
|
|
|
|
dbus receive bus=session path=/org/gnome/ScreenSaver
|
|
interface=org.gnome.ScreenSaver
|
|
member=ActiveChanged
|
|
peer=(name=:*, label=gjs-console),
|
|
|
|
dbus send bus=session path=/org/a11y/bus
|
|
interface=org.a11y.Bus
|
|
member=GetAddress
|
|
peer=(name=org.a11y.Bus), # all peer's labels
|
|
|
|
dbus receive bus=session path={/,/org}
|
|
interface=org.freedesktop.DBus.Introspectable
|
|
member=Introspect
|
|
peer=(name=:*, label=gnome-shell),
|
|
|
|
dbus bind bus=session
|
|
name=org.gnome.SessionManager,
|
|
|
|
@{exec_path} mr,
|
|
|
|
/{usr/,}bin/{,z,ba,da}sh rix,
|
|
/{usr/,}bin/env rix,
|
|
/{usr/,}bin/gnome-session rix,
|
|
/{usr/,}bin/grep rix,
|
|
/{usr/,}bin/gsettings rix,
|
|
/{usr/,}bin/gsettings-data-convert rix,
|
|
/{usr/,}bin/mkdir rix,
|
|
/{usr/,}bin/session-migration rix,
|
|
/{usr/,}bin/xdg-user-dirs-gtk-update rix,
|
|
@{libexec}/at-spi-bus-launcher rPx,
|
|
@{libexec}/gnome-session-check-accelerated rix,
|
|
@{libexec}/gnome-session-check-accelerated-gl-helper rix,
|
|
@{libexec}/gnome-session-check-accelerated-gles-helper rix,
|
|
@{libexec}/gnome-session-failed rix,
|
|
@{libexec}/gnome-shell-overrides-migration.sh rix,
|
|
@{libexec}/gsd-* rPx,
|
|
|
|
# TODO: rCx gio-launch-desktop and put all the following program in this
|
|
# subprofile. Not done yet as it breaks compatibility with Ubuntu/Debian
|
|
/{usr/,}lib/gio-launch-desktop rix,
|
|
|
|
/{usr/,}bin/aa-notify rPx,
|
|
/{usr/,}bin/baloo_file rPUx,
|
|
/{usr/,}bin/blueman-applet rPx,
|
|
/{usr/,}bin/firewall-applet rPUx,
|
|
/{usr/,}bin/gnome-keyring-daemon rPx,
|
|
/{usr/,}bin/gnome-shell rPx,
|
|
/{usr/,}bin/gnome-software rPUx,
|
|
/{usr/,}bin/im-launch rPx,
|
|
/{usr/,}bin/keepassxc rPx,
|
|
/{usr/,}bin/parcellite rPUx,
|
|
/{usr/,}bin/pkcs11-register rPx,
|
|
/{usr/,}bin/snap rPUx,
|
|
/{usr/,}bin/spice-vdagent rPx,
|
|
/{usr/,}bin/start-pulseaudio-x11 rPx,
|
|
/{usr/,}bin/ubuntu-report rPx,
|
|
/{usr/,}bin/update-notifier rPx,
|
|
/{usr/,}bin/xbrlapi rPx,
|
|
/{usr/,}bin/xdg-user-dirs-update rPx,
|
|
/{usr/,}lib/@{multiarch}/libexec/kdeconnectd rPUx,
|
|
/{usr/,}lib/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
|
|
/{usr/,}lib/caribou/caribou rPUx,
|
|
/{usr/,}lib/update-notifier/ubuntu-advantage-notification rPx,
|
|
/{usr/,}share/libpam-kwallet-common/pam_kwallet_init rPUx,
|
|
@{libexec}/deja-dup/deja-dup-monitor rPUx,
|
|
@{libexec}/evolution-data-server/evolution-alarm-notify rPx,
|
|
@{libexec}/gsd-disk-utility-notify rPx,
|
|
|
|
/usr/share/applications/{,**} r,
|
|
/usr/share/dconf/profile/gdm r,
|
|
/usr/share/gdm/greeter-dconf-defaults r,
|
|
/usr/share/gdm/greeter/applications/{,**} r,
|
|
/usr/share/gdm/greeter/autostart/{,*.desktop} r,
|
|
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
|
/usr/share/glvnd/egl_vendor.d/ r,
|
|
/usr/share/gnome-session/hardware-compatibility r,
|
|
/usr/share/gnome-session/sessions/*.session r,
|
|
/usr/share/gnome/autostart/{,*.desktop} r,
|
|
/usr/share/icons/{,**} r,
|
|
/usr/share/mime/mime.cache r,
|
|
/usr/share/*ubuntu/applications/{,*.desktop} r,
|
|
/usr/share/*ubuntu/applications/mimeinfo.cache r,
|
|
/usr/share/X11/xkb/{,**} r,
|
|
/usr/share/session-migration/scripts/{,*} r,
|
|
|
|
/etc/gnome/defaults.list r,
|
|
/etc/xdg/autostart/{,*.desktop} r,
|
|
|
|
/var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
|
|
/var/lib/gdm{3,}/.config/dconf/user r,
|
|
/var/lib/gdm{3,}/.config/gnome-session/ rw,
|
|
/var/lib/gdm{3,}/.config/gnome-session/saved-session/ rw,
|
|
/var/lib/gdm{3,}/.local/share/applications/{,**} r,
|
|
/var/lib/gdm{3,}/.local/share/session_migration-* r,
|
|
/var/lib/gdm{3,}/greeter-dconf-defaults r,
|
|
|
|
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
|
|
/var/lib/flatpak/exports/share/applications/{,**} r,
|
|
|
|
owner /tmp/dirs-?????? rw,
|
|
|
|
owner @{user_config_dirs}/autostart/{,*.desktop} r,
|
|
owner @{user_config_dirs}/gnome-session/ rw,
|
|
owner @{user_config_dirs}/gnome-session/saved-session/ rw,
|
|
owner @{user_config_dirs}/gtk-3.0/bookmarks rw,
|
|
owner @{user_config_dirs}/gtk-3.0/bookmarks.[0-9A-Z]* rw,
|
|
owner @{user_config_dirs}/mimeapps.list r,
|
|
owner @{user_config_dirs}/user-dirs.dirs r,
|
|
owner @{user_config_dirs}/user-dirs.locale r,
|
|
owner @{user_share_dirs}/applications/ r,
|
|
owner @{user_share_dirs}/applications/defaults.list r,
|
|
owner @{user_share_dirs}/applications/mimeinfo.cache r,
|
|
owner @{user_share_dirs}/gnome-shell/gnome-overrides-migrated rw,
|
|
owner @{user_share_dirs}/mime/mime.cache r,
|
|
owner @{user_share_dirs}/session_migration-ubuntu r,
|
|
|
|
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
|
@{run}/systemd/sessions/* r,
|
|
@{run}/systemd/sessions/*.ref rw,
|
|
@{run}/systemd/users/@{uid} r,
|
|
owner @{run}/user/@{uid}/gnome-session-leader-fifo rw,
|
|
owner @{run}/user/@{uid}/ICEauthority{,-[a-z]} rwl,
|
|
owner @{run}/user/@{uid}/systemd/notify w,
|
|
owner @{run}/user/@{uid}/wayland-[0-9]* rw,
|
|
|
|
@{sys}/devices/**/{vendor,device} r,
|
|
|
|
@{PROC}/@{pid}/cgroup r,
|
|
@{PROC}/cmdline r,
|
|
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
|
|
owner @{PROC}/@{pid}/cmdline r,
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/loginuid r,
|
|
|
|
/dev/tty rw,
|
|
/dev/tty[0-9]* rw,
|
|
|
|
include if exists <usr/gnome-session-binary.d>
|
|
include if exists <local/gnome-session-binary>
|
|
}
|