205 lines
6.3 KiB
Text
205 lines
6.3 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2017-2021 Mikhail Morfikov
|
|
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
|
# Copyright (C) 2022 Jeroen Rijken
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/pulseaudio
|
|
profile pulseaudio @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/audio>
|
|
include <abstractions/consoles>
|
|
include <abstractions/dbus-gtk>
|
|
include <abstractions/dbus-session-strict>
|
|
include <abstractions/dbus-strict>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/dri-common>
|
|
include <abstractions/dri-enumerate>
|
|
include <abstractions/fonts>
|
|
include <abstractions/freedesktop.org>
|
|
include <abstractions/gstreamer>
|
|
include <abstractions/hosts_access>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
include <abstractions/X-strict>
|
|
|
|
ptrace (trace) peer=@{profile_name},
|
|
|
|
signal (receive) peer=pacmd,
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
network bluetooth stream,
|
|
network bluetooth seqpacket,
|
|
|
|
dbus send bus=session path=/Client[0-9]*/EntryGroup[0-9]*
|
|
interface=org.freedesktop.Avahi.EntryGroup
|
|
member={GetState,AddService,AddServiceSubtype,Commit}
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus receive bus=system path=/Client[0-9]*/EntryGroup[0-9]*
|
|
interface=org.freedesktop.Avahi.EntryGroup
|
|
member={AddService,AddServiceSubtype,Commit,GetState,StateChanged}
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus receive bus=system path=/Client[0-9]*/ServiceBrowser[0-9]*
|
|
interface=org.freedesktop.Avahi.ServiceBrowser
|
|
member={ItemNew,ItemRemove}
|
|
peer=(name=org.freedesktop.Avahi), # no peer's label
|
|
|
|
dbus receive bus=system path=/Client[0-9]*/ServiceResolver[0-9]*
|
|
interface=org.freedesktop.Avahi.ServiceResolver
|
|
member=Found
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus send bus=system path=/Client[0-9]*/ServiceResolver[0-9]*
|
|
interface=org.freedesktop.Avahi.ServiceResolver
|
|
member=Free
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus send bus=session path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={RequestName,ReleaseName}
|
|
peer=(name=org.freedesktop.DBus),
|
|
|
|
dbus receive bus=session path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={Hello,RequestName,ReleaseName}
|
|
peer=(name=:*),
|
|
|
|
dbus receive bus=session
|
|
interface=org.freedesktop.DBus.Introspectable
|
|
member=Introspect
|
|
peer=(name=:*, label=gnome-shell),
|
|
|
|
dbus bind bus=session
|
|
name=org.freedesktop.ReserveDevice[0-9].Audio[0-9],
|
|
|
|
dbus bind bus=session
|
|
name=org.PulseAudio[0-9],
|
|
|
|
dbus bind bus=session
|
|
name=org.pulseaudio*,
|
|
|
|
dbus send bus=system
|
|
path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={Hello,AddMatch,RemoveMatch}
|
|
peer=(name=org.freedesktop.DBus),
|
|
|
|
dbus send bus=system path=/org/freedesktop/RealtimeKit[0-9]
|
|
member={Get,MakeThreadHighPriority,MakeThreadRealtime}
|
|
peer=(name=org.freedesktop.RealtimeKit[0-9]),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.DBus.ObjectManager
|
|
member=GetManagedObjects
|
|
peer=(name=org.bluez),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.DBus.Peer
|
|
member=Ping
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.Avahi.Server
|
|
member={GetAPIVersion,GetState,EntryGroupNew}
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus receive bus=system path=/
|
|
interface=org.freedesktop.Avahi.Server
|
|
member=StateChanged
|
|
peer=(name=org.freedesktop.Avahi),
|
|
|
|
dbus send bus=system path=/
|
|
interface=org.freedesktop.hostname[0-9]
|
|
member=Get
|
|
peer=(name=/org/freedesktop/hostname[0-9]),
|
|
|
|
dbus send bus=system path=/org/freedesktop/hostname[0-9]
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=Get
|
|
peer=(name=/org/freedesktop/hostname[0-9]),
|
|
|
|
dbus send bus=system path=/org/freedesktop/hostname[0-9]
|
|
interface=org.freedesktop.DBus.Properties
|
|
member=Get
|
|
peer=(name=org.freedesktop.hostname[0-9]),
|
|
|
|
dbus receive bus=system path=/org/bluez/hci*/**
|
|
interface=org.freedesktop.DBus.Properties
|
|
peer=(name=:*),
|
|
|
|
@{exec_path} mrix,
|
|
|
|
@{lib}/pulse/gsettings-helper rix,
|
|
@{lib}/@{multiarch}/pulse/gconf-helper rix,
|
|
@{lib}/pulse-*/modules/*.so mr,
|
|
|
|
/usr/share/ladspa/rdf/{,*} r,
|
|
/usr/share/pulseaudio/{,**} r,
|
|
|
|
/var/lib/snapd/desktop/applications/ r,
|
|
|
|
# For GDM
|
|
owner /var/lib/gdm{[1-9],}/.config/pulse/{,**} rw,
|
|
owner /var/lib/gdm{[1-9],}/.config/pulse/cookie k,
|
|
owner /var/lib/gdm{[1-9],}/.config/dconf/user r,
|
|
|
|
# For SDDM
|
|
owner /var/lib/sddm/.config/pulse/ rw,
|
|
owner /var/lib/sddm/.config/pulse/*-{device,stream}-volumes.tdb rw,
|
|
owner /var/lib/sddm/.config/pulse/*-default-{sink,source} rw,
|
|
owner /var/lib/sddm/.config/pulse/*-card-database.tdb rw,
|
|
owner /var/lib/sddm/.config/pulse/cookie rwk,
|
|
|
|
# For lightdm
|
|
owner /var/lib/lightdm/.config/ w,
|
|
owner /var/lib/lightdm/.config/pulse/{,**} rw,
|
|
owner /var/lib/lightdm/.config/pulse/cookie k,
|
|
|
|
/var/lib/gdm{3,}/.cache/gstreamer-1.0/ rw,
|
|
/var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw,
|
|
|
|
owner @{user_config_dirs}/ w,
|
|
owner @{user_config_dirs}/pulse/{,**} rw,
|
|
|
|
owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin r,
|
|
|
|
owner @{run}/user/@{uid}/ rw,
|
|
owner @{run}/user/@{uid}/pulse/{,*} rw,
|
|
owner @{run}/user/@{uid}/pulse/*.lock k,
|
|
owner @{run}/user/@{uid}/systemd/notify rw,
|
|
|
|
@{run}/systemd/users/@{uid} r,
|
|
|
|
@{run}/udev/data/+pci:* r,
|
|
@{run}/udev/data/c116:@{int} r, # for ALSA
|
|
@{run}/udev/data/c23[4-9]:@{int} r, # For dynamic assignment range 234 to 254
|
|
@{run}/udev/data/c24[0-9]:@{int} r,
|
|
@{run}/udev/data/c25[0-4]:@{int} r,
|
|
|
|
@{sys}/devices/**/sound/**/{uevent,pcm_class} r,
|
|
@{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
|
|
|
|
deny @{sys}/module/apparmor/parameters/enabled r,
|
|
|
|
owner @{PROC}/@{pids}/fd/ r,
|
|
owner @{PROC}/@{pids}/stat r,
|
|
owner @{PROC}/@{pids}/cmdline r,
|
|
|
|
/dev/media@{int} r,
|
|
/dev/video@{int} rw,
|
|
|
|
# file_inherit
|
|
owner /dev/tty@{int} rw,
|
|
owner @{HOME}/.xsession-errors w,
|
|
|
|
include if exists <local/pulseaudio>
|
|
}
|