33 lines
1 KiB
Text
33 lines
1 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
# Minimal set of rules for webkit GTK UI.
|
|
|
|
abi <abi/4.0>,
|
|
|
|
mount options=(rw rbind) /bindfile@{rand6} -> /newroot/.flatpak-info,
|
|
|
|
@{bin}/xdg-dbus-proxy rix, # TODO: stack me
|
|
|
|
@{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix,
|
|
@{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix,
|
|
|
|
owner /bindfile@{rand6} rw,
|
|
owner @{att}/.flatpak-info r,
|
|
|
|
owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw,
|
|
|
|
owner @{run}/user/@{uid}/.flatpak/ w,
|
|
owner @{run}/user/@{uid}/.flatpak/webkit-*/{,bwrapinfo.json} rw,
|
|
|
|
owner @{run}/user/@{uid}/webkitgtk/ w,
|
|
owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw,
|
|
owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw,
|
|
owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-@{rand6} rw,
|
|
|
|
@{sys}/firmware/acpi/pm_profile r,
|
|
|
|
include if exists <abstractions/webkit.d>
|
|
|
|
# vim:syntax=apparmor
|