87 lines
2.7 KiB
Text
87 lines
2.7 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{runtime} = SteamLinuxRuntime_sniper
|
|
@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
|
|
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
|
|
@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
|
|
@{app_dirs} = @{share_dirs}/steamapps/common/
|
|
|
|
@{exec_path} = @{lib_dirs}/reaper
|
|
profile steam-runtime @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/audio-client>
|
|
include <abstractions/graphics>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/wayland>
|
|
include <abstractions/X-strict>
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network unix stream,
|
|
|
|
@{exec_path} mr,
|
|
|
|
@{sh_path} rix,
|
|
@{bin}/getopt rix,
|
|
@{bin}/readlink rix,
|
|
|
|
@{lib_dirs}/** mr,
|
|
@{lib_dirs}/steam-launch-wrapper rix,
|
|
|
|
# Native linux games (steam-game-native)
|
|
@{app_dirs}/[^S]*/** rpx -> steam-game-native, # Only for @{app_dirs}/@{runtime}/**
|
|
|
|
# Proton games, sandboxed (steam-game-proton)
|
|
@{app_dirs}/@{runtime}/*entry-point rmix,
|
|
@{app_dirs}/@{runtime}/pressure-vessel/@{bin}/pressure-vessel-* rix,
|
|
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/** mr,
|
|
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix,
|
|
@{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rpx -> steam-game-proton,
|
|
@{app_dirs}/@{runtime}/run rix,
|
|
@{bin}/bwrap rpx -> steam-game-proton,
|
|
|
|
/ r,
|
|
@{lib}/ r,
|
|
@{lib_dirs}/ r,
|
|
|
|
owner @{HOME}/.steam/steam.pipe r,
|
|
|
|
owner @{app_dirs}/*/ r,
|
|
owner @{app_dirs}/config/config.vdf{,.*} rw,
|
|
owner @{app_dirs}/@{runtime}/** r,
|
|
owner @{app_dirs}/@{runtime}/pressure-vessel/** rwk,
|
|
owner @{app_dirs}/@{runtime}/sniper_platform_*/** rwk,
|
|
owner @{app_dirs}/@{runtime}/var/** rwk,
|
|
owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/pressure-vessel/**,
|
|
owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/sniper_platform_*/**,
|
|
|
|
owner @{share_dirs}/config/config.vdf{,.*} rw,
|
|
owner @{share_dirs}/steamapps/appmanifest_* rw,
|
|
|
|
owner @{tmp}/ r,
|
|
owner @{tmp}/#@{int} rw,
|
|
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,
|
|
|
|
owner @{run}/user/@{uid}/ r,
|
|
|
|
owner /dev/shm/u@{uid}-Shm_@{hex6} rw,
|
|
owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw,
|
|
owner /dev/shm/u@{uid}-Shm_@{hex8} rw,
|
|
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
|
|
|
|
owner @{PROC}/@{pid}/cmdline r,
|
|
owner @{PROC}/@{pid}/comm r,
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
|
|
/dev/tty rw,
|
|
|
|
include if exists <local/steam-runtime>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|