Git-Mirrors/onionshare
1
0
Fork 0
mirror of https://github.com/onionshare/onionshare.git synced 2025-02-11 04:09:08 -05:00
Code Issues Packages Projects Releases Wiki Activity
onionshare/apparmor/abstractions/onionshare

30 lines
853 B
Plaintext
Raw Normal View History

AppArmor profiles for Onionshare, written by Tails developers
2016-11-19 21:26:57 +01:00
#include <abstractions/base>
#include <abstractions/nameservice>
Improve AppArmor profiles and enforce them. Work from Tails Developers, main git repository, currently devel branch. Upstream commits: commit 6e7ad41ca9664246856fe9553c202f09a1d1066b Remove superfluous AppArmor rule. The pattern `[^.]*` matches a subset of `[^.]**`, so we only need to keep the latter. commit b3a827d8e3c3fee78ec18450dfaf38a3d4eaf270 Make onionshare-gui able to access folders beneath $HOME. Without this change e.g. ~/Documents is inaccessible. To be honest, this does not makes sense to me, as my interpretation of the old patterns clearly should allow subfolders and files therein. commit db2b3a3f73aa01a54c9b7cb5ab83da1d083b7169 WIP: AppArmor profile improvements.
2017-01-18 20:58:03 +01:00
#include <abstractions/private-files-strict>
AppArmor profiles for Onionshare, written by Tails developers
2016-11-19 21:26:57 +01:00
#include <abstractions/python>
# Why are these not in abstractions/python?
/usr/lib{,32,64}/python{2,3}.[0-9]/__pycache__/ rw,
/usr/lib{,32,64}/python{2,3}.[0-9]/__pycache__/* rw,
/usr/lib{,32,64}/python{2,3}.[0-9]/**/__pycache__/ rw,
/usr/lib{,32,64}/python{2,3}.[0-9]/**/__pycache__/* rw,
/usr/lib{,32,64}/python{2,3}/**/__pycache__/ rw,
/usr/lib{,32,64}/python{2,3}/**/__pycache__/* rw,
/bin/dash rix,
/proc/*/mounts r,
/proc/*/fd/ r,
/sbin/ldconfig rix,
/sbin/ldconfig.real rix,
/bin/uname rix,
Improve AppArmor profiles and enforce them. Work from Tails Developers, main git repository, currently devel branch. Upstream commits: commit 6e7ad41ca9664246856fe9553c202f09a1d1066b Remove superfluous AppArmor rule. The pattern `[^.]*` matches a subset of `[^.]**`, so we only need to keep the latter. commit b3a827d8e3c3fee78ec18450dfaf38a3d4eaf270 Make onionshare-gui able to access folders beneath $HOME. Without this change e.g. ~/Documents is inaccessible. To be honest, this does not makes sense to me, as my interpretation of the old patterns clearly should allow subfolders and files therein. commit db2b3a3f73aa01a54c9b7cb5ab83da1d083b7169 WIP: AppArmor profile improvements.
2017-01-18 20:58:03 +01:00
/etc/mime.types r,
/usr/share/onionshare/ r,
/usr/share/onionshare/** r,
AppArmor profiles for Onionshare, written by Tails developers
2016-11-19 21:26:57 +01:00
/tmp/ rw,
/tmp/** rw,
Improve AppArmor profiles and enforce them. Work from Tails Developers, main git repository, currently devel branch. Upstream commits: commit 6e7ad41ca9664246856fe9553c202f09a1d1066b Remove superfluous AppArmor rule. The pattern `[^.]*` matches a subset of `[^.]**`, so we only need to keep the latter. commit b3a827d8e3c3fee78ec18450dfaf38a3d4eaf270 Make onionshare-gui able to access folders beneath $HOME. Without this change e.g. ~/Documents is inaccessible. To be honest, this does not makes sense to me, as my interpretation of the old patterns clearly should allow subfolders and files therein. commit db2b3a3f73aa01a54c9b7cb5ab83da1d083b7169 WIP: AppArmor profile improvements.
2017-01-18 20:58:03 +01:00
# Allow read on almost anything in @{HOME}. Lenient, but
# private-files-strict is in effect.
owner @{HOME}/ r,
owner @{HOME}/[^.]** r,
Reference in New Issue Copy Permalink