mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 13:58:22 +00:00
Code Issues Releases Wiki Activity

Subject: profiles - owner usage for @{HOME} rules

Browse Source 
From: Simon Deziel <simon.deziel@gmail.com>

A fair number of the rules that apply to files in @{HOME} predate the
existence of the 'owner' qualifier. This patch adds the 'owner'
qualifier in several places.

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
This commit is contained in:
Steve Beattie
2013-01-04 22:05:53 -08:00
parent 33bfedb95a
commit e3e47a7b61
7 changed files with 38 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
profiles/apparmor.d/abstractions/X
View File

@@ -13,10 +13,10 @@
# .ICEauthority files required for X authentication, per user # .ICEauthority files required for X authentication, per user
@{HOME}/.ICEauthority r, owner @{HOME}/.ICEauthority r,
# .Xauthority files required for X connections, per user # .Xauthority files required for X connections, per user
@{HOME}/.Xauthority r, owner @{HOME}/.Xauthority r,
owner /{,var/}run/gdm{,3}/*/database r, owner /{,var/}run/gdm{,3}/*/database r,
owner /{,var/}run/lightdm/authority/[0-9]* r, owner /{,var/}run/lightdm/authority/[0-9]* r,

6
profiles/apparmor.d/abstractions/audio
View File

@@ -40,12 +40,12 @@
/usr/share/alsa/** r, /usr/share/alsa/** r,
/usr/share/sounds/** r, /usr/share/sounds/** r,
@{HOME}/.esd_auth r, owner @{HOME}/.esd_auth r,
@{HOME}/.asoundrc r, owner @{HOME}/.asoundrc r,
/etc/esound/esd.conf r, /etc/esound/esd.conf r,
# libcanberra # libcanberra
@{HOME}/.cache/event-sound-cache.* rwk, owner @{HOME}/.cache/event-sound-cache.* rwk,
# pulse # pulse
/etc/pulse/ r, /etc/pulse/ r,

16
profiles/apparmor.d/abstractions/fonts
View File

@@ -33,14 +33,14 @@
/usr/share/texmf/{,*/}fonts/** r, /usr/share/texmf/{,*/}fonts/** r,
/var/lib/ghostscript/** r, /var/lib/ghostscript/** r,
@{HOME}/.fonts.conf r, owner @{HOME}/.fonts.conf r,
@{HOME}/.fonts/ r, owner @{HOME}/.fonts/ r,
@{HOME}/.fonts/** r, owner @{HOME}/.fonts/** r,
@{HOME}/.fonts.cache-2 mr, owner @{HOME}/.fonts.cache-2 mr,
@{HOME}/.{,cache/}fontconfig/ r, owner @{HOME}/.{,cache/}fontconfig/ r,
@{HOME}/.{,cache/}fontconfig/** mrl, owner @{HOME}/.{,cache/}fontconfig/** mrl,
@{HOME}/.fonts.conf.d/ r, owner @{HOME}/.fonts.conf.d/ r,
@{HOME}/.fonts.conf.d/** r, owner @{HOME}/.fonts.conf.d/** r,
/usr/local/share/fonts/ r, /usr/local/share/fonts/ r,
/usr/local/share/fonts/** r, /usr/local/share/fonts/** r,

24
profiles/apparmor.d/abstractions/gnome
View File

@@ -38,24 +38,24 @@
/usr/lib/@{multiarch}/gdk-pixbuf-*/** mr, /usr/lib/@{multiarch}/gdk-pixbuf-*/** mr,
# per-user gtk configuration # per-user gtk configuration
@{HOME}/.gnome/Gnome r, owner @{HOME}/.gnome/Gnome r,
@{HOME}/.gtk r, owner @{HOME}/.gtk r,
@{HOME}/.gtkrc r, owner @{HOME}/.gtkrc r,
@{HOME}/.gtkrc-2.0 r, owner @{HOME}/.gtkrc-2.0 r,
@{HOME}/.gtk-bookmarks r, owner @{HOME}/.gtk-bookmarks r,
@{HOME}/.themes/ r, owner @{HOME}/.themes/ r,
@{HOME}/.themes/** r, owner @{HOME}/.themes/** r,
# for gtk file dialog # for gtk file dialog
@{HOME}/.config/gtk-2.0/** r, owner @{HOME}/.config/gtk-2.0/** r,
@{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw, owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
# from evolution-mail # from evolution-mail
@{HOME}/.gconfd/lock/* r, owner @{HOME}/.gconfd/lock/* r,
@{HOME}/.gnome/application-info r, owner @{HOME}/.gnome/application-info r,
# per-user font business # per-user font business
@{HOME}/.fonts.cache-* rwl, owner @{HOME}/.fonts.cache-* rwl,
# icon caches # icon caches
/var/cache/**/icon-theme.cache r, /var/cache/**/icon-theme.cache r,

12
profiles/apparmor.d/abstractions/gnupg
View File

@@ -2,9 +2,9 @@
# gnupg sub-process running permissions # gnupg sub-process running permissions
# user configurations # user configurations
@{HOME}/.gnupg/options r, owner @{HOME}/.gnupg/options r,
@{HOME}/.gnupg/pubring.gpg r, owner @{HOME}/.gnupg/pubring.gpg r,
@{HOME}/.gnupg/random_seed rw, owner @{HOME}/.gnupg/random_seed rw,
@{HOME}/.gnupg/secring.gpg r, owner @{HOME}/.gnupg/secring.gpg r,
@{HOME}/.gnupg/so/*.x86_64 mr, owner @{HOME}/.gnupg/so/*.x86_64 mr,
@{HOME}/.gnupg/trustdb.gpg rw, owner @{HOME}/.gnupg/trustdb.gpg rw,

14
profiles/apparmor.d/abstractions/kde
View File

@@ -23,13 +23,13 @@
/etc/kde3/* r, /etc/kde3/* r,
/etc/kde4rc r, /etc/kde4rc r,
@{HOME}/.DCOPserver_* r, owner @{HOME}/.DCOPserver_* r,
@{HOME}/.ICEauthority r, owner @{HOME}/.ICEauthority r,
@{HOME}/.fonts.* lrw, owner @{HOME}/.fonts.* lrw,
@{HOME}/.kde{,4}/share/config/kdeglobals rw, owner @{HOME}/.kde{,4}/share/config/kdeglobals rw,
@{HOME}/.kde{,4}/share/config/*.lock rwl, owner @{HOME}/.kde{,4}/share/config/*.lock rwl,
@{HOME}/.qt/** rw, owner @{HOME}/.qt/** rw,
@{HOME}/.config/Trolltech.conf rwk, owner @{HOME}/.config/Trolltech.conf rwk,
/usr/share/icons/ r, /usr/share/icons/ r,
/usr/share/icons/** r, /usr/share/icons/** r,

1
profiles/apparmor.d/abstractions/ubuntu-browsers.d/user-files
View File

@@ -5,7 +5,6 @@
@{HOME}/ r, @{HOME}/ r,
@{HOME}/** r, @{HOME}/** r,
owner @{HOME}/** w, owner @{HOME}/** w,
owner @{HOME}/Desktop/** r,
# Do not allow read and/or write to particularly sensitive/problematic files # Do not allow read and/or write to particularly sensitive/problematic files
#include <abstractions/private-files> #include <abstractions/private-files>