69 lines
2 KiB
Text
69 lines
2 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/code /usr/share/code/{bin/,}code
|
|
profile code @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/chromium-common>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/fontconfig-cache-read>
|
|
include <abstractions/fonts>
|
|
include <abstractions/freedesktop.org>
|
|
include <abstractions/gtk>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/opencl>
|
|
include <abstractions/ssl_certs>
|
|
|
|
# ptrace (read) peer=lsb_release,
|
|
|
|
@{exec_path} mrix,
|
|
|
|
@{lib}/code/extensions/git/dist/askpass.sh rPx,
|
|
@{lib}/code/extensions/git/dist/git-editor.sh rPx,
|
|
|
|
# The shell is not confined on purpose.
|
|
@{bin}/{,b,d,rb}ash rUx,
|
|
@{bin}/{c,k,tc,z}sh rUx,
|
|
|
|
@{bin}/git rPx,
|
|
@{bin}/gpg{,2} rPUx,
|
|
@{bin}/lsb_release rPx -> lsb_release,
|
|
|
|
# /usr/share/code/** r,
|
|
# /usr/share/code/libffmpeg.so mr,
|
|
# /usr/share/code/resources/**/bin/* rix,
|
|
# /usr/share/code/resources/**.node mr,
|
|
|
|
/var/lib/dbus/machine-id r,
|
|
/etc/machine-id r,
|
|
|
|
owner @{user_config_dirs}/Code/ rw,
|
|
owner @{user_config_dirs}/Code/** rwkl -> {HOME}/.config/Code/**,
|
|
owner @{HOME}/.vscode/ rw,
|
|
owner @{HOME}/.vscode/** rwlk -> @{HOME}/.vscode/**,
|
|
|
|
owner @{user_projects_dirs}/ r,
|
|
owner @{user_projects_dirs}/** rwkl -> @{user_projects_dirs}/**,
|
|
|
|
owner /tmp/@{uuid} rw,
|
|
owner /tmp/vscode-*/{,**} rw,
|
|
owner /tmp/vscode-ipc-@{uuid}.sock rw,
|
|
|
|
owner @{run}/user/@{uid}/vscode-@{hex}-*-{shared,main}.sock rw,
|
|
owner @{run}/user/@{uid}/vscode-git-askpass-@{hex}.sock rw,
|
|
|
|
@{PROC}/ r,
|
|
@{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pids}/task/ r,
|
|
owner @{PROC}/@{pids}/task/@{tid}/status r,
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
owner @{PROC}/@{pid}/mounts r,
|
|
|
|
include if exists <local/code>
|
|
}
|