643a84997e
* Unbreaking Debian 11 and partially Ubuntu 22.04 * pre-cleanup * pre-cleanup2 * Update im-launch * Update gnome-extension-ding * polishing * not yet * Update ubuntu.flags Allow GDM to boot. `No new privs` fix. * Update debian.flags Allow GDM to boot. `No new privs` fix. * Update CONTRIBUTING.md * fixes * reverting w * move setpriv to main.flags
87 lines
2.4 KiB
Text
87 lines
2.4 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}bin/nautilus
|
|
profile nautilus @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/dbus-session-strict>
|
|
include <abstractions/dbus-strict>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/gnome>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
include <abstractions/trash>
|
|
|
|
dbus send bus=system path=/org/freedesktop/hostname[0-9]
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=GetAll,
|
|
|
|
dbus (send, receive) bus=session path=/org/gnome/Nautilus{,/*}
|
|
interface={org.freedesktop.DBus.{Properties,Introspectable},org.gtk.Actions},
|
|
|
|
dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
|
|
interface=org.gtk.Private.RemoteVolumeMonitor
|
|
member={IsSupported,List}
|
|
peer=(name=:*),
|
|
|
|
dbus bind bus=session
|
|
name=org.gnome.Nautilus,
|
|
|
|
dbus bind bus=session
|
|
name=org.freedesktop.FileManager1,
|
|
|
|
@{exec_path} mr,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
/{usr/,}lib/gio-launch-desktop rPx -> child-open,
|
|
|
|
/usr/share/nautilus/{,**} r,
|
|
/usr/share/poppler/{,**} r,
|
|
/usr/share/sounds/freedesktop/stereo/*.oga r,
|
|
/usr/share/thumbnailers/{,**} r,
|
|
/usr/share/tracker3/{,**} r,
|
|
/usr/share/*ubuntu/applications/{,**} r,
|
|
/usr/share/tracker/domain-ontologies/*.rule r,
|
|
|
|
/var/lib/snapd/desktop/icons/{,**} r,
|
|
|
|
# Full access to user's data
|
|
include <abstractions/deny-sensitive-home>
|
|
/ r,
|
|
/home/ r,
|
|
@{MOUNTDIRS}/ r,
|
|
@{MOUNTS}/ r,
|
|
owner @{HOME}/{,**} rw,
|
|
owner @{MOUNTS}/** rw,
|
|
owner @{run}/user/@{uid}/{,**} rw,
|
|
owner /tmp/{,**} rw,
|
|
|
|
# Silence non user's data
|
|
deny /boot/{,**} r,
|
|
deny /opt/{,**} r,
|
|
deny /root/{,**} r,
|
|
deny /tmp/.* rw,
|
|
deny /tmp/.*/{,**} rw,
|
|
|
|
owner @{user_share_dirs}/nautilus/{,**} rwk,
|
|
|
|
@{run}/mount/utab r,
|
|
|
|
@{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
|
|
@{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
|
|
@{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
|
|
@{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
|
|
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
@{PROC}/@{pids}/net/wireless r,
|
|
|
|
/dev/tty rw,
|
|
/dev/dri/card[0-9]* rw,
|
|
|
|
include if exists <local/nautilus>
|
|
}
|