da93eb29d8
Add vim modeline instructing the editor to use syntax plugin provided by apparmor. Continuation of #393 to keep the diff list relatively short.
166 lines
6.6 KiB
Text
166 lines
6.6 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{lib}/gnome-session-binary
|
|
profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/bus-accessibility>
|
|
include <abstractions/bus-session>
|
|
include <abstractions/bus-system>
|
|
include <abstractions/bus/org.a11y>
|
|
include <abstractions/bus/org.freedesktop.login1.Session>
|
|
include <abstractions/bus/org.freedesktop.login1>
|
|
include <abstractions/bus/org.freedesktop.systemd1-session>
|
|
include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
|
|
include <abstractions/bus/org.gnome.ScreenSaver>
|
|
include <abstractions/dconf-write>
|
|
include <abstractions/gnome-strict>
|
|
include <abstractions/graphics>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network netlink raw,
|
|
|
|
signal (receive) set=(term, hup) peer=gdm*,
|
|
signal (send) set=(term) peer=gsd-*,
|
|
|
|
#aa:dbus own bus=session name=org.gnome.SessionManager
|
|
|
|
dbus send bus=session path=/org/freedesktop/DBus
|
|
interface=org.freedesktop.DBus
|
|
member={GetConnectionUnixUser,GetConnectionUnixProcessID,UpdateActivationEnvironment}
|
|
peer=(name=org.freedesktop.DBus label=dbus-session),
|
|
|
|
dbus send bus=system path=/org/freedesktop/login1
|
|
interface=org.freedesktop.login1.Manager
|
|
member={CanPowerOff,PowerOff,Reboot}
|
|
peer=(name=:*, label=systemd-logind),
|
|
|
|
dbus send bus=session path=/org/freedesktop/systemd1
|
|
interface=org.freedesktop.systemd1.Manager
|
|
peer=(name=org.freedesktop.systemd1, label="@{p_systemd_user}"),
|
|
|
|
@{exec_path} mr,
|
|
|
|
@{sh_path} rix,
|
|
@{bin}/dbus-daemon rPx -> dbus-session,
|
|
@{bin}/env rix,
|
|
@{bin}/gnome-session rPx,
|
|
@{bin}/gnome-shell rPx,
|
|
@{bin}/session-migration rPx,
|
|
|
|
@{lib}/gnome-session-check-accelerated rix,
|
|
@{lib}/gnome-session-check-accelerated-gl-helper rix,
|
|
@{lib}/gnome-session-check-accelerated-gles-helper rix,
|
|
@{lib}/gnome-session-failed rix,
|
|
|
|
@{lib}/gio-launch-desktop rCx -> open,
|
|
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
|
|
|
|
/usr/share/dconf/profile/gdm r,
|
|
/usr/share/gdm/greeter-dconf-defaults r,
|
|
/usr/share/gdm/greeter/applications/{,**} r,
|
|
/usr/share/gdm/greeter/autostart/{,*.desktop} r,
|
|
/usr/share/gnome-session/hardware-compatibility r,
|
|
/usr/share/gnome-session/sessions/*.session r,
|
|
/usr/share/gnome-shell/extensions/*/metadata.json r,
|
|
/usr/share/gnome/autostart/{,*.desktop} r,
|
|
|
|
@{etc_ro}/xdg/autostart/{,*.desktop} r,
|
|
|
|
owner @{gdm_cache_dirs}/gdm/Xauthority r,
|
|
owner @{gdm_config_dirs}/dconf/user rw,
|
|
owner @{gdm_config_dirs}/gnome-session/ rw,
|
|
owner @{gdm_config_dirs}/gnome-session/saved-session/ rw,
|
|
owner @{GDM_HOME}/greeter-dconf-defaults r,
|
|
owner @{gdm_share_dirs}/applications/{,**} r,
|
|
|
|
owner @{user_config_dirs}/autostart/{,*.desktop} r,
|
|
owner @{user_config_dirs}/gnome-session/ rw,
|
|
owner @{user_config_dirs}/gnome-session/saved-session/ rw,
|
|
|
|
@{run}/systemd/inhibit/[0-9]*.ref rw,
|
|
@{run}/systemd/sessions/* r,
|
|
@{run}/systemd/sessions/*.ref rw,
|
|
@{run}/systemd/users/@{uid} r,
|
|
owner @{run}/user/@{uid}/gnome-session-leader-fifo rw,
|
|
owner @{run}/user/@{uid}/ICEauthority rw,
|
|
owner @{run}/user/@{uid}/ICEauthority-c w,
|
|
owner @{run}/user/@{uid}/ICEauthority-l wl -> @{run}/user/@{uid}/ICEauthority-c,
|
|
owner @{run}/user/@{uid}/systemd/notify w,
|
|
|
|
@{sys}/devices/**/{vendor,device} r,
|
|
|
|
@{PROC}/@{pid}/cgroup r,
|
|
@{PROC}/cmdline r,
|
|
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
|
|
owner @{PROC}/@{pid}/cmdline r,
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/loginuid r,
|
|
|
|
/dev/tty rw,
|
|
/dev/tty@{int} rw,
|
|
|
|
profile open flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/app-launcher-user>
|
|
|
|
@{lib}/gio-launch-desktop mr,
|
|
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
|
|
@{sh_path} rix,
|
|
|
|
@{bin}/aa-notify rPx,
|
|
@{bin}/blueman-applet rPx,
|
|
@{bin}/firewall-applet rPx,
|
|
@{bin}/gnome-keyring-daemon rPx,
|
|
@{bin}/gnome-shell rPx,
|
|
@{bin}/gnome-software rPx,
|
|
@{bin}/im-launch rPx,
|
|
@{bin}/keepassxc rPx,
|
|
@{bin}/opensuse-welcome rPx,
|
|
@{bin}/parcellite rPUx,
|
|
@{bin}/pkcs11-register rPx,
|
|
@{bin}/snap rPUx,
|
|
@{bin}/snapshot-detect rPUx,
|
|
@{bin}/spice-vdagent rPx,
|
|
@{bin}/start-pulseaudio-x11 rPx,
|
|
@{bin}/ubuntu-report rPx,
|
|
@{bin}/update-notifier rPx,
|
|
@{bin}/xbrlapi rPx,
|
|
@{bin}/xdg-user-dirs-gtk-update rPx,
|
|
@{bin}/xdg-user-dirs-update rPx,
|
|
@{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
|
|
@{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh rPx,
|
|
@{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx,
|
|
@{lib}/caribou/caribou rPUx,
|
|
@{lib}/deja-dup/deja-dup-monitor rPx,
|
|
@{lib}/gsd-* rPx,
|
|
@{lib}/update-notifier/ubuntu-advantage-notification rPx,
|
|
@{lib}/xapps/sn-watcher/* rPUx,
|
|
@{thunderbird_path} rPx,
|
|
/usr/share/libpam-kwallet-common/pam_kwallet_init rPUx,
|
|
|
|
#aa:exec baloo
|
|
#aa:exec evolution-alarm-notify
|
|
@{lib}/kdeconnectd rPUx,
|
|
@{lib}/@{multiarch}/{,libexec/}kdeconnectd rPUx,
|
|
|
|
/dev/tty@{int} rw,
|
|
|
|
include if exists <usr/gnome-session-binary_open.d>
|
|
include if exists <local/gnome-session-binary_open>
|
|
}
|
|
|
|
include if exists <usr/gnome-session-binary.d>
|
|
include if exists <local/gnome-session-binary>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|