From 541b804405520026f961529696ca2aa096d61012 Mon Sep 17 00:00:00 2001 From: nobodysu Date: Tue, 23 Nov 2021 02:35:17 +0300 Subject: [PATCH] update --- usr.lib.systemd.systemd-timesyncd | 50 +++++++++++++++++++++++++++++++ usr.local.bin.gallery-dl | 40 +++++++++++++++++++++++++ usr.local.bin.youtube-dl | 43 +++++++++++++++----------- usr.local.bin.youtubedl-gui | 18 +++++------ 4 files changed, 124 insertions(+), 27 deletions(-) create mode 100644 usr.lib.systemd.systemd-timesyncd create mode 100644 usr.local.bin.gallery-dl diff --git a/usr.lib.systemd.systemd-timesyncd b/usr.lib.systemd.systemd-timesyncd new file mode 100644 index 0000000..9585a7d --- /dev/null +++ b/usr.lib.systemd.systemd-timesyncd @@ -0,0 +1,50 @@ +# vim:syntax=apparmor + +#include + +# adjust in local +@{ETC_DIRS} = /etc /var/local/etc +#include if exists + +#profile systemd_timesyncd /{,usr/}lib/systemd/systemd-timesyncd { # Debian +profile systemd_timesyncd /{,usr/}lib/systemd/systemd-timesyncd flags=(attach_disconnected) { # Ubuntu + #include + #include + + capability sys_time, + + @{ETC_DIRS}/adjtime r, + /etc/systemd/timesyncd.conf r, + + owner @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/sched r, + @{PROC}/cmdline r, + @{PROC}/sys/kernel/random/boot_id r, + @{PROC}/sys/kernel/osrelease r, + + owner /var/lib/systemd/timesync/clock rw, + owner /{,var/}run/systemd/timesync/synchronized rw, + + # Ubuntu + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + + /{,var/}run/systemd/journal/socket rw, + /{,var/}run/systemd/notify rw, + /{,var/}run/dbus/system_bus_socket rw, + + dbus send + bus=system + path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,RequestName} + peer=(name=org.freedesktop.DBus), + + dbus bind + bus=system + name=org.freedesktop.timesync1, + + #include if exists +} diff --git a/usr.local.bin.gallery-dl b/usr.local.bin.gallery-dl new file mode 100644 index 0000000..b0c8843 --- /dev/null +++ b/usr.local.bin.gallery-dl @@ -0,0 +1,40 @@ +# vim:syntax=apparmor + +#include + +# adjust in local +@{GLDL_DIRS} = @{HOME}/Downloads/gallery-dl @{HOME}/gallery-dl /tmp/gallery-dl +#include if exists + +profile gallery_dl /usr/{,local/}bin/gallery-dl { + /usr/{,local/}bin/gallery-dl rix, + #include + #include + #include + #include + #include + + owner @{GLDL_DIRS}/{,**} rwk, + + /etc/gallery-dl.conf r, + + owner @{HOME}/.config/gallery-dl/config.json r, + owner @{HOME}/.gallery-dl.conf r, + owner @{HOME}/.cache/gallery-dl/{,**} rwk, + + owner @{HOME}/.netrc r, + + /usr/local/lib{,32,64}/python{2.[4-7],3.[0-9],3.[0-9][0-9]}/{site,dist}-packages/gallery_dl/{,**} r, + /usr/lib/python3/dist-packages/idna/__pycache__/{,**} rw, + + deny /usr/local/bin/ r, # ?? + + # Ubuntu + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + #include if exists +} diff --git a/usr.local.bin.youtube-dl b/usr.local.bin.youtube-dl index aa8f8cd..7f8471b 100644 --- a/usr.local.bin.youtube-dl +++ b/usr.local.bin.youtube-dl @@ -2,19 +2,20 @@ #include -# changeme -@{DOWNLOAD_FOLDERS}=@{HOME}/Downloads /tmp/ytdl -@{YTDL_PATH}=/usr/{,local/}bin/{youtube-dl,yt-dlp}* +# adjust in local +@{YTDL_DIRS} = @{HOME}/Downloads /tmp/ytdl +@{YTDL_BINS} = /usr/{,local/}bin/{youtube-dl,yt-dlp}* +#include if exists -profile youtube_dl @{YTDL_PATH} { - @{YTDL_PATH} r, +profile youtube_dl @{YTDL_BINS} { + @{YTDL_BINS} r, #include #include #include # #include #include - @{DOWNLOAD_FOLDERS}/** rwk, + @{YTDL_DIRS}/** rwk, /etc/youtube-dl.conf r, /etc/mime.types r, @@ -24,7 +25,7 @@ profile youtube_dl @{YTDL_PATH} { owner @{HOME}/.cache/youtube-dl/{,**} rwk, owner @{HOME}/.config/youtube-dl/{,**} r, -# owner @{HOME}/.netrc r, + owner @{HOME}/.netrc r, owner /tmp/ytdl_prg rw, owner /tmp/ytdl_stderr rw, @@ -36,6 +37,9 @@ profile youtube_dl @{YTDL_PATH} { /{,usr/}bin/stty rix, /{,usr/}sbin/ldconfig{,.real} rix, /{,usr/}bin/uname rix, + /{,usr/}bin/file rix, + + /etc/magic r, /usr/local/lib{,32,64}/python{2.[4-7],3.[0-9],3.[0-9][0-9]}/{site,dist}-packages/{,youtube_dl/**} r, deny /usr/bin/ r, # ?; noisy @@ -45,12 +49,18 @@ profile youtube_dl @{YTDL_PATH} { /usr/bin/ffmpeg r, #include - @{DOWNLOAD_FOLDERS}/** rw, + @{YTDL_DIRS}/** rw, /sys/devices/system/node/{,node[0-9]*/meminfo} r, - include if exists -# #include + # livestreams +# #include +# #include +# network tcp, +# network udp, +# network netlink raw, + + #include if exists } /usr/bin/ffprobe Cx, @@ -58,15 +68,14 @@ profile youtube_dl @{YTDL_PATH} { /usr/bin/ffprobe r, #include - @{DOWNLOAD_FOLDERS}/** r, + @{YTDL_DIRS}/** r, /sys/devices/system/node/{,node[0-9]*/meminfo} r, # some media-providers require network network tcp, - include if exists -# #include + #include if exists } /{,usr/}bin/dash Cx, @@ -74,14 +83,13 @@ profile youtube_dl @{YTDL_PATH} { /{,usr/}bin/dash r, #include - @{DOWNLOAD_FOLDERS}/** rw, + @{YTDL_DIRS}/** rw, # --exec commands goes here # /bin/mv rix, # /bin/cp Ux, # Unrestricted, DANGEROUS - include if exists -# #include + #include if exists } # yt-dlp @@ -101,6 +109,5 @@ profile youtube_dl @{YTDL_PATH} { network udp, network netlink raw, - include if exists -# #include + #include if exists } diff --git a/usr.local.bin.youtubedl-gui b/usr.local.bin.youtubedl-gui index c01f0d2..569ea3f 100644 --- a/usr.local.bin.youtubedl-gui +++ b/usr.local.bin.youtubedl-gui @@ -2,9 +2,10 @@ #include -# changeme -@{DOWNLOAD_FOLDERS}=@{HOME}/Downloads /tmp/ytdl -@{YTDL_PATH}=/usr/{,local/}bin/{youtube-dl,yt-dlp}* +# adjust in local +@{YTDL_DIRS} = @{HOME}/Downloads /tmp/ytdl +@{YTDL_BINS} = /usr/{,local/}bin/{youtube-dl,yt-dlp}* +#include if exists profile youtubedl_gui /usr/{,local/}bin/youtubedl-gui { /usr/{,local/}bin/youtubedl-gui r, @@ -19,10 +20,10 @@ profile youtubedl_gui /usr/{,local/}bin/youtubedl-gui { #include # #include #include -# #include -# #include + #include if exists + #include if exists - @{DOWNLOAD_FOLDERS}/** rw, + @{YTDL_DIRS}/** rwk, # qt5-settings-write-deny (modification) deny owner @{HOME}/.config/QtProject.conf* wkl, @@ -51,7 +52,7 @@ profile youtubedl_gui /usr/{,local/}bin/youtubedl-gui { /{,usr/}bin/grep rix, /{,usr/}bin/bash rix, - @{YTDL_PATH} rPx -> youtube_dl, + @{YTDL_BINS} rPx -> youtube_dl, dbus send bus="session" @@ -127,6 +128,5 @@ profile youtubedl_gui /usr/{,local/}bin/youtubedl-gui { deny network tcp, deny network udp, - include if exists -# #include + #include if exists }