Skip to content

Commit

Permalink
feat(profile): general update.
Browse files Browse the repository at this point in the history
  • Loading branch information
@roddhjav
roddhjav committed Nov 27, 2023
1 parent fade974 commit 209688f
Show file tree
Hide file tree
Showing 16 changed files with 37 additions and 30 deletions.
1 change: 1 addition & 0 deletions apparmor.d/abstractions/bwrap-app
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,7 @@

/dev/hidraw@{int} rw,
/dev/input/ r,
/dev/ptmx rw,
/dev/pts/ptmx rw,
/dev/tty rw,

Expand Down
2 changes: 2 additions & 0 deletions apparmor.d/abstractions/dbus-gtk
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

dbus (send) bus=session path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo
Expand Down
1 change: 1 addition & 0 deletions apparmor.d/groups/_full/systemd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
capability dac_override,
capability dac_read_search,
capability fowner,
capability fsetid,
capability kill,
capability mknod,
capability perfmon,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/gnome/gdm-xsession
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ profile gdm-xsession @{exec_path} {

@{bin}/dbus-update-activation-environment rCx -> dbus,
@{bin}/dpkg-query rpx,
@{bin}/flatpak rPUx,
@{bin}/flatpak rPx,
@{bin}/gpgconf rPx,
@{bin}/gsettings rPx,
@{bin}/im-launch rPx,
Expand Down
5 changes: 4 additions & 1 deletion apparmor.d/groups/gnome/gnome-control-center-goa-helper
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,13 @@ profile gnome-control-center-goa-helper @{exec_path} {
network inet6 stream,
network netlink raw,

signal (send) set=(kill) peer=bwrap,

@{exec_path} mr,

@{bin}/bwrap rPUx,

@{lib}/webkit2gtk-{3,4}.0/WebKitNetworkProcess rix,
@{lib}/webkit2gtk-*/WebKitNetworkProcess rix,

/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/themes/{,**} r,
Expand All @@ -43,6 +45,7 @@ profile gnome-control-center-goa-helper @{exec_path} {

owner @{user_cache_dirs}/gnome-control-center-goa-helper/{,**} rwl,

owner @{user_share_dirs}/gnome-control-center-goa-helper/{,**} rwk,
owner @{user_share_dirs}/webkitgtk/{,**} rw,
owner @{user_share_dirs}/webkitgtk/localstorage/{,**} rwk,

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/kde/sddm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/Xorg rPx,
/etc/sddm/Xsession rPx,

@{bin}/flatpak rPUx,
@{bin}/flatpak rPx,
@{bin}/sway rPUx,
@{bin}/xauth rCx -> xauth,
@{bin}/xsetroot rPx,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/kde/sddm-xsession
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ profile sddm-xsession @{exec_path} {
@{bin}/zsh rix,

@{bin}/dbus-update-activation-environment rCx -> dbus,
@{bin}/flatpak rPUx,
@{bin}/flatpak rPx,
@{bin}/numlockx rPx,
@{bin}/xhost rPx,
@{bin}/xrdb rPx,
Expand Down
10 changes: 2 additions & 8 deletions apparmor.d/groups/kde/xdm-xsession
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ profile xdm-xsession @{exec_path} {
@{bin}/whoami rix,

@{bin}/dbus-update-activation-environment rCx -> dbus,
@{bin}/flatpak rPUx,
@{bin}/flatpak rPx,
@{bin}/pidof rPx,
@{bin}/startplasma-x11 rPx,
@{bin}/systemctl rPx -> child-systemctl,
Expand Down Expand Up @@ -77,13 +77,7 @@ profile xdm-xsession @{exec_path} {

owner @{user_share_dirs}/sddm/xorg-session.log rw,

owner @{run}/user/@{uid}/gnupg/ rw,
owner @{run}/user/@{uid}/gnupg/gpg-agent.conf r,
owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/ rw,
owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/@{hex}.key rw,
owner @{run}/user/@{uid}/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{run}/user/@{uid}/gnupg/sshcontrol r,
@{run}/user/@{uid}/xauth_@{rand6} rl,
@{run}/user/@{uid}/xauth_@{rand6} rl,

owner /tmp/ssh-*/ rw,
owner /tmp/ssh-*/agent.* rw,
Expand Down
6 changes: 3 additions & 3 deletions apparmor.d/groups/ssh/sshd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -54,10 +54,10 @@ profile sshd @{exec_path} flags=(attach_disconnected) {

ptrace (read,trace) peer=@{systemd},

dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={CreateSession,ReleaseSession}
peer=(name=org.freedesktop.login[0-9]),
peer=(name=org.freedesktop.login1),

@{exec_path} mrix,

Expand Down
15 changes: 7 additions & 8 deletions apparmor.d/groups/systemd/systemd-resolved
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,22 +29,21 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
network inet6 stream,
network netlink raw,

dbus bind bus=system name=org.freedesktop.resolve1,

dbus receive bus=system path=/org/freedesktop/resolve1
interface=org.freedesktop.{resolve1.Manager,DBus.Peer,DBus.Properties},

dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={RequestName,GetConnectionUnixUser}
peer=(name=org.freedesktop.DBus),

dbus receive bus=system path=/org/freedesktop/resolve[0-9]
interface=org.freedesktop.{resolve[0-9].Manager,DBus.Peer,DBus.Properties},

dbus receive bus=system path=/org/freedesktop/login[0-9]*
interface=org.freedesktop.login[0-9]*.Manager
dbus receive bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={PrepareForSleep,PrepareForShutdown}
peer=(name=:*, label=systemd-logind),

dbus bind bus=system
name=org.freedesktop.resolve[0-9],

@{exec_path} mr,

/etc/systemd/resolved.conf r,
Expand Down
1 change: 1 addition & 0 deletions apparmor.d/groups/virt/libvirtd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {

@{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} r,
@{etc_rw}/libvirt/{,**} rw,
/etc/gnutls/config r,
/etc/mdevctl.d/{,**} r,
/etc/sasl2/qemu.conf r,
/etc/xml/catalog r,
Expand Down
4 changes: 3 additions & 1 deletion apparmor.d/profiles-s-z/snap
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,9 @@ profile snap @{exec_path} {
@{bin}/systemctl rPx -> child-systemctl,

/snap/{,**} rw,
# @{lib_dirs}/snap-confine rPx -> /usr/lib/snapd/snap-confine,
/snap/snapd/@{int}/usr/lib/snapd/snap-confine rPx,
@{lib}/snapd/snap-confine rPx,

@{lib_dirs}/snapd/snap-seccomp rPx,
@{lib_dirs}/snapd/snapd rPx,

Expand Down
9 changes: 5 additions & 4 deletions apparmor.d/profiles-s-z/sudo
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,14 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <[email protected]>
# Copyright (C) 2021-2023 Alexandre Pujol <[email protected]>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{bin}/sudo
#@{bin}/su
profile sudo @{exec_path} {
include <abstractions/base>
include <abstractions/app-launcher-root>
Expand Down Expand Up @@ -40,10 +41,10 @@ profile sudo @{exec_path} {
signal (send) set=(cont,hup) peer=su,
signal (send) set=(winch),

dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.logi1.Manager
member=CreateSession
peer=(name=org.freedesktop.login[0-9]),
peer=(name=org.freedesktop.login1),

dbus (send receive) bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd.Manager
Expand Down
3 changes: 3 additions & 0 deletions apparmor.d/profiles-s-z/transmission-gtk
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ profile transmission-gtk @{exec_path} {

@{exec_path} mr,

@{bin}/xdg-open rPx -> child-open,
@{lib}/gio-launch-desktop rPx -> child-open,

/usr/share/X11/xkb/{,**} r,

owner @{user_torrents_dirs}/ r,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/profiles-s-z/x11-xsession
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ profile x11-xsession @{exec_path} {
@{bin}/run-parts rCx -> run-parts,
@{bin}/udevadm rCx -> udevadm,

@{bin}/flatpak rPUx,
@{bin}/flatpak rPx,
@{bin}/xrdb rPx,
@{bin}/numlockx rPx,
@{bin}/xhost rPx,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/profiles-s-z/xinit
View file
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ profile xinit @{exec_path} {
@{bin}/run-parts rCx -> run-parts,
@{bin}/udevadm rCx -> udevadm,

@{bin}/flatpak rPUx,
@{bin}/flatpak rPx,
@{bin}/glxinfo rPx,
@{bin}/numlockx rPx,
@{bin}/X rPx,
Expand Down

2 comments on commit 209688f

@curiosityseeker
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After reloading apparmor I got an error:

Reload failed for Load AppArmor profiles.
...
Profile transmission-gtk has too many specified profile transitions.
Error: At least one profile failed to load
apparmor.service: Control process exited, code=exited, status=1/FAILURE

@roddhjav
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, it should be fixed now.

Please sign in to comment.