172 lines
5.1 KiB
Text
172 lines
5.1 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2017-2021 Mikhail Morfikov
|
|
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
|
# Copyright (C) 2022 Jeroen Rijken
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}bin/pulseaudio
|
|
profile pulseaudio @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/audio>
|
|
include <abstractions/consoles>
|
|
include <abstractions/dbus-session-strict>
|
|
include <abstractions/dbus-strict>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/dri-common>
|
|
include <abstractions/dri-enumerate>
|
|
include <abstractions/gstreamer>
|
|
include <abstractions/hosts_access>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/X-strict>
|
|
|
|
ptrace (trace) peer=@{profile_name},
|
|
|
|
signal (receive) peer=pacmd,
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
network bluetooth stream,
|
|
network bluetooth seqpacket,
|
|
|
|
dbus send bus=session path=/Client0/EntryGroup[0-9]*
|
|
interface=org.freedesktop.Avahi.EntryGroup
|
|
member={GetState,AddService,AddServiceSubtype,Commit}
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus receive bus=system path=/Client0/EntryGroup[0-9]*
|
|
interface=org.freedesktop.Avahi.EntryGroup
|
|
member=StateChanged
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus send bus=session path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={RequestName,ReleaseName}
|
|
peer=(name=org.freedesktop.DBus),
|
|
|
|
dbus receive bus=session path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={Hello,RequestName,ReleaseName}
|
|
peer=(name=:*),
|
|
|
|
dbus receive bus=session
|
|
interface=org.freedesktop.DBus.Introspectable
|
|
member=Introspect,
|
|
|
|
dbus bind bus=session
|
|
name=org.freedesktop.ReserveDevice[0-9].Audio[0-9],
|
|
|
|
dbus bind bus=session
|
|
name=org.PulseAudio[0-9],
|
|
|
|
dbus bind bus=session
|
|
name=org.pulseaudio*,
|
|
|
|
dbus send bus=system
|
|
path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={Hello,AddMatch,RemoveMatch}
|
|
peer=(name=org.freedesktop.DBus),
|
|
|
|
dbus send bus=system path=/org/freedesktop/RealtimeKit[0-9]
|
|
member={Get,MakeThreadHighPriority,MakeThreadRealtime}
|
|
peer=(name=org.freedesktop.RealtimeKit[0-9]),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.DBus.ObjectManager
|
|
member=GetManagedObjects
|
|
peer=(name=org.bluez),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.DBus.Peer
|
|
member=Ping
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.Avahi.Server
|
|
member={GetAPIVersion,GetState,EntryGroupNew}
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus receive bus=system path=/
|
|
interface=org.freedesktop.Avahi.Server
|
|
member=StateChanged
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.hostname[0-9]
|
|
member=Get
|
|
peer=(name=/org/freedesktop/hostname[0-9]),
|
|
|
|
dbus send bus=system path=/org/freedesktop/hostname[0-9]
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=Get
|
|
peer=(name=/org/freedesktop/hostname[0-9]),
|
|
|
|
@{exec_path} mrix,
|
|
|
|
@{libexec}/pulse/gsettings-helper mrix,
|
|
/{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
|
|
/{usr/,}lib/pulse-*/modules/*.so mr,
|
|
|
|
/usr/share/applications/{,**} r,
|
|
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
|
/usr/share/pulseaudio/{,**} r,
|
|
/usr/share/ubuntu/applications/{,*} r,
|
|
|
|
/var/lib/snapd/desktop/applications/ r,
|
|
|
|
# For GDM
|
|
owner /var/lib/gdm{[1-9],}/.config/pulse/{,**} rw,
|
|
owner /var/lib/gdm{[1-9],}/.config/pulse/cookie k,
|
|
owner /var/lib/gdm{[1-9],}/.config/dconf/user r,
|
|
|
|
# For SDDM
|
|
owner /var/lib/sddm/.config/pulse/ rw,
|
|
owner /var/lib/sddm/.config/pulse/*-{device,stream}-volumes.tdb rw,
|
|
owner /var/lib/sddm/.config/pulse/*-default-{sink,source} rw,
|
|
owner /var/lib/sddm/.config/pulse/*-card-database.tdb rw,
|
|
owner /var/lib/sddm/.config/pulse/cookie rwk,
|
|
|
|
# For lightdm
|
|
owner /var/lib/lightdm/.config/ w,
|
|
owner /var/lib/lightdm/.config/pulse/{,**} rw,
|
|
owner /var/lib/lightdm/.config/pulse/cookie k,
|
|
|
|
owner @{user_config_dirs}/ w,
|
|
owner @{user_config_dirs}/pulse/{,**} rw,
|
|
|
|
owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin r,
|
|
/var/lib/gdm{3,}/.cache/gstreamer-1.0/ rw,
|
|
/var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp*} rw,
|
|
|
|
owner @{run}/user/@{uid}/ rw,
|
|
owner @{run}/user/@{uid}/pulse/{,*} rw,
|
|
owner @{run}/user/@{uid}/pulse/*.lock k,
|
|
owner @{run}/user/@{uid}/systemd/notify rw,
|
|
|
|
@{run}/systemd/users/@{uid} r,
|
|
|
|
@{run}/udev/data/+sound* r,
|
|
@{run}/udev/data/c116:[0-9]* r, # For ALSA
|
|
|
|
@{sys}/class/sound/ r,
|
|
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,
|
|
@{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
|
|
|
|
deny @{sys}/module/apparmor/parameters/enabled r,
|
|
|
|
owner @{PROC}/@{pids}/fd/ r,
|
|
owner @{PROC}/@{pids}/stat r,
|
|
owner @{PROC}/@{pids}/cmdline r,
|
|
|
|
# file_inherit
|
|
owner /dev/tty[0-9]* rw,
|
|
owner @{HOME}/.xsession-errors w,
|
|
|
|
include if exists <local/pulseaudio>
|
|
}
|