54 lines
1.9 KiB
Text
54 lines
1.9 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/xdg-dbus-proxy
|
|
profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/accessibility>
|
|
include <abstractions/consoles>
|
|
include <abstractions/bus-session>
|
|
include <abstractions/bus-system>
|
|
include <abstractions/bus/system/org.freedesktop.Avahi.Server>
|
|
include <abstractions/bus/org.freedesktop.NetworkManager>
|
|
include <abstractions/bus/org.freedesktop.portal.Desktop>
|
|
include <abstractions/user-download-strict>
|
|
|
|
network unix stream,
|
|
|
|
#aa:dbus talk bus=session name=org.freedesktop.portal.Flatpak label=flatpak-portal
|
|
#aa:dbus talk bus=session name=org.freedesktop.portal.Request path=/org/freedesktop/portal/desktop label=xdg-desktop-portal
|
|
|
|
dbus send bus=session path=/org/freedesktop/portal/desktop
|
|
interface=org.freedesktop.portal.Realtime
|
|
member=MakeThread*
|
|
peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal),
|
|
|
|
@{exec_path} mr,
|
|
|
|
owner @{att}/@{HOME}/.var/app/** r,
|
|
owner @{att}/@{HOME}/.var/app/*/.local/share/*/logs/* rw,
|
|
owner @{att}/@{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw,
|
|
|
|
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
|
|
owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw,
|
|
owner @{run}/flatpak/doc/** r,
|
|
owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw,
|
|
owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw,
|
|
owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw,
|
|
owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-@{rand6} rw,
|
|
|
|
@{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/temp* r,
|
|
|
|
/dev/dri/card@{int} rw,
|
|
|
|
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
|
|
|
include if exists <local/xdg-dbus-proxy>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|