Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Various fixes: man, nvidia-strict, iwd, lynx #645

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −7
Open

Various fixes: man, nvidia-strict, iwd, lynx #645

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion apparmor.d/abstractions/nvidia-strict
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,8 @@
@{PROC}/sys/vm/max_map_count r,
@{PROC}/sys/vm/mmap_min_addr r,
@{PROC}/modules r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/{,task/*/}comm r,
owner @{PROC}/@{pid}/cmdline r,

/dev/char/195:@{int} w, # Nvidia graphics devices
/dev/nvidia-modeset rw,
Expand Down
6 changes: 6 additions & 0 deletions apparmor.d/groups/network/iwd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,10 @@ profile iwd @{exec_path} {
network netlink raw,
network netlink dgram,
network alg seqpacket,
network packet dgram,

@{exec_path} mr,
@{bin}/resolvconf rPx,

/etc/iwd/{,**} r,
/var/lib/iwd/{,**} rw,
Expand All @@ -33,9 +35,13 @@ profile iwd @{exec_path} {
@{PROC}/sys/net/ipv{4,6}/conf/wlan@{int}/arp_* rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlan@{int}/drop_* rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlan@{int}/ndisc_* rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlan@{int}/accept_ra rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlan@{int}/optimistic_dad rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlp*/arp_* rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlp*/drop_* rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlp*/ndisc_* rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlp*/accept_ra rw,
@{PROC}/sys/net/ipv{4,6}/conf/wlp*/optimistic_dad rw,

/dev/rfkill rw,

Expand Down
3 changes: 2 additions & 1 deletion apparmor.d/profiles-g-l/lynx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@ profile lynx @{exec_path} {
/etc/mime.types r,

owner @{tmp}/lynxXXXX*/ rw,
owner @{tmp}/lynxXXXX*/*TMP.html{,.gz} rw,
# soon there may be .zst here as well. Maybe just give it the whole dir?
owner @{tmp}/lynxXXXX*/*TMP.html{,.{gz,br}} rw,

include if exists <local/lynx>
}
Expand Down
15 changes: 10 additions & 5 deletions apparmor.d/profiles-m-r/man
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,13 @@ profile man @{exec_path} {

@{exec_path} mr,

@{bin}/{n,g}roff rmix,
@{bin}/grotty rmix,

# Use a special profile when man calls anything groff-related. We only include
# the programs that actually parse input data in a non-trivial way, not
# wrappers such as groff and nroff, since they would need a broader profile.
@{bin}/eqn rCx -> man_groff,
@{bin}/{,n}eqn rCx -> man_groff,
@{bin}/grap rCx -> man_groff,
@{bin}/pic rCx -> man_groff,
@{bin}/preconv rCx -> man_groff,
Expand All @@ -46,9 +49,10 @@ profile man @{exec_path} {

/usr/share/groff/{,**} r,

/usr/**/man/{,**} r,
/usr{,/local}{,/share}{,/X11R6}/man/{,**} r,
/opt/man/{,**} r,
/var/**/man/{,**} r,
/var/cache/man/index.db rk,
/var/cache/man{,/**}/index.{db,bt,dir,pag} rk,

/etc/man_db.conf r,
/etc/manpath.config r,
Expand All @@ -58,7 +62,7 @@ profile man @{exec_path} {
include if exists <local/man>
}

profile man_groff {
profile man//man_groff {
include <abstractions/base>
include <abstractions/consoles>

Expand All @@ -85,7 +89,7 @@ profile man_groff {
include if exists <local/man_groff>
}

profile man_filter {
profile man//man_filter {
include <abstractions/base>
include <abstractions/consoles>

Expand All @@ -97,6 +101,7 @@ profile man_filter {
@{bin}/compress mr,
@{bin}/iconv mr,
@{bin}/lzip.lzip mr,
@{bin}/lzip mr,
@{bin}/tr mr,
@{bin}/xz mr,

Expand Down