160 lines
4.2 KiB
Text
160 lines
4.2 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /usr/share/apport/apport-gtk
|
|
profile apport-gtk @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/apt>
|
|
include <abstractions/audio-client>
|
|
include <abstractions/bus-accessibility>
|
|
include <abstractions/bus-session>
|
|
include <abstractions/bus/org.a11y>
|
|
include <abstractions/bus/org.gtk.vfs.MountTracker>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/gnome-strict>
|
|
include <abstractions/gschemas>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/python>
|
|
include <abstractions/ssl_certs>
|
|
|
|
capability fowner,
|
|
capability sys_ptrace,
|
|
capability syslog,
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network netlink raw,
|
|
|
|
@{exec_path} mr,
|
|
|
|
@{sh_path} rix,
|
|
@{python_path} rix,
|
|
@{bin}/{f,}grep rix,
|
|
@{bin}/apt-cache rPx,
|
|
@{bin}/cut rix,
|
|
@{bin}/dpkg rPx,
|
|
@{bin}/dpkg-divert rPx,
|
|
@{bin}/dpkg-query rpx,
|
|
@{bin}/gdb rCx -> gdb,
|
|
@{bin}/gsettings rPx,
|
|
@{bin}/ischroot rPx,
|
|
@{bin}/journalctl rPx,
|
|
@{bin}/kmod rPx,
|
|
@{bin}/ldd rix,
|
|
@{bin}/lsb_release rPx,
|
|
@{bin}/md5sum rix,
|
|
@{bin}/pkexec rCx -> pkexec,
|
|
@{bin}/readlink rix,
|
|
@{bin}/systemctl rCx -> systemctl,
|
|
@{bin}/systemd-detect-virt rPx,
|
|
@{bin}/uname rix,
|
|
@{bin}/which{,.debianutils} rix,
|
|
@{sbin}/killall5 rix,
|
|
@{lib}/{,colord/}colord-sane rPx,
|
|
@{lib}/@{multiarch}/ld*.so* rix,
|
|
/usr/share/apport/root_info_wrapper rix,
|
|
|
|
@{bin}/* r,
|
|
@{sbin}/* r,
|
|
|
|
/usr/share/apport/{,**} r,
|
|
/usr/share/apport/general-hooks/*.py r,
|
|
|
|
/etc/apport/{,**} r,
|
|
/etc/bash_completion.d/apport_completion r,
|
|
/etc/cloud/{,**} r,
|
|
/etc/cron.daily/apport r,
|
|
/etc/default/apport r,
|
|
/etc/gtk-3.0/settings.ini r,
|
|
/etc/init.d/apport r,
|
|
/etc/logrotate.d/apport r,
|
|
/etc/xdg/autostart/*.desktop r,
|
|
|
|
/var/lib/dpkg/info/ r,
|
|
/var/lib/dpkg/info/*.list r,
|
|
/var/lib/usbutils/*.ids r,
|
|
/var/lib/dpkg/info/*.md5sums r,
|
|
/var/log/installer/media-info r,
|
|
|
|
/var/crash/ rw,
|
|
owner /var/crash/*.@{uid}.{crash,upload} rw,
|
|
|
|
@{run}/cloud-init/cloud.cfg r,
|
|
@{run}/snapd.socket rw,
|
|
|
|
owner @{tmp}/@{word8} rw,
|
|
owner @{tmp}/apport_core_@{rand8} rw,
|
|
owner @{tmp}/launchpadlib.cache.@{rand8}/ rw,
|
|
owner @{tmp}/tmp@{rand8}/{,**} rw,
|
|
|
|
@{PROC}/ r,
|
|
@{PROC}/@{pids}/cmdline r,
|
|
@{PROC}/@{pids}/fd/ r,
|
|
@{PROC}/@{pids}/mounts r,
|
|
@{PROC}/@{pids}/stat r,
|
|
@{PROC}/modules r,
|
|
@{PROC}/version_signature r,
|
|
owner @{PROC}/@{pid}/cgroup r,
|
|
|
|
profile gdb {
|
|
include <abstractions/base>
|
|
include <abstractions/dconf>
|
|
include <abstractions/fonts>
|
|
include <abstractions/python>
|
|
|
|
@{bin}/gdb mr,
|
|
|
|
@{bin}/iconv rix,
|
|
@{bin}/* r,
|
|
|
|
/usr/share/gcc/python/{,**/}__pycache__/{,**} rw,
|
|
/usr/share/gdb/python/{,**/}__pycache__/{,**} rw,
|
|
|
|
/usr/share/gdb/{,**} r,
|
|
/usr/share/gnome-shell/{,**} r,
|
|
/usr/share/terminfo/** r,
|
|
/usr/share/themes/{,**} r,
|
|
|
|
/etc/gdb/{,**} r,
|
|
|
|
/tmp/apport_core_* r,
|
|
|
|
@{PROC}/@{pids}/fd/ r,
|
|
|
|
include if exists <local/apport-gtk_gdb>
|
|
}
|
|
|
|
profile pkexec {
|
|
include <abstractions/base>
|
|
include <abstractions/app/pkexec>
|
|
|
|
include if exists <local/apport-gtk_pkexec>
|
|
}
|
|
|
|
profile systemctl {
|
|
include <abstractions/base>
|
|
include <abstractions/app/systemctl>
|
|
|
|
dbus send bus=system path=/org/freedesktop/systemd1
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=Get
|
|
peer=(name=org.freedesktop.systemd1, label=unconfined),
|
|
dbus send bus=system path=/org/freedesktop/systemd1
|
|
interface=org.freedesktop.systemd1.Manager
|
|
member=GetUnitFileState
|
|
peer=(name=org.freedesktop.systemd1, label=unconfined),
|
|
|
|
include if exists <local/apport-gtk_systemctl>
|
|
}
|
|
|
|
include if exists <local/apport-gtk>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|