On 01/03/2014 02:26 PM, Tyler Hicks wrote: > Move the file rule from the existing permissive accessibility bus > abstraction into a new strict accessibility bus abstraction. > > The strict abstraction only allows for calling the Hello, AddMatch, > RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods > that are exported by the D-Bus daemon. > > The permissive abstraction reuses the strict abstraction and then allows > all communications on the accessibility bus. > > Signed-off-by: Tyler Hicks <[email protected]>
Acked-by: John Johansen <[email protected]> > --- > profiles/apparmor.d/abstractions/dbus-accessibility | 4 ++++ > .../apparmor.d/abstractions/dbus-accessibility-strict | 17 > +++++++++++++++++ > 2 files changed, 21 insertions(+) > create mode 100644 profiles/apparmor.d/abstractions/dbus-accessibility-strict > > diff --git a/profiles/apparmor.d/abstractions/dbus-accessibility > b/profiles/apparmor.d/abstractions/dbus-accessibility > index f52eb7b..40a3308 100644 > --- a/profiles/apparmor.d/abstractions/dbus-accessibility > +++ b/profiles/apparmor.d/abstractions/dbus-accessibility > @@ -9,4 +9,8 @@ > # > # ------------------------------------------------------------------ > > + # This abstraction grants full accessibility bus access. Consider using the > + # dbus-accessibility-strict abstraction for fine-grained bus mediation. > + > + #include <abstractions/dbus-accessibility-strict> > dbus bus=accessibility, > diff --git a/profiles/apparmor.d/abstractions/dbus-accessibility-strict > b/profiles/apparmor.d/abstractions/dbus-accessibility-strict > new file mode 100644 > index 0000000..a853ce2 > --- /dev/null > +++ b/profiles/apparmor.d/abstractions/dbus-accessibility-strict > @@ -0,0 +1,17 @@ > +# vim:syntax=apparmor > +# ------------------------------------------------------------------ > +# > +# Copyright (C) 2013 Canonical Ltd. > +# > +# This program is free software; you can redistribute it and/or > +# modify it under the terms of version 2 of the GNU General Public > +# License published by the Free Software Foundation. > +# > +# ------------------------------------------------------------------ > + > + dbus send > + bus=accessibility > + path=/org/freedesktop/DBus > + interface=org.freedesktop.DBus > + > member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} > + peer=(name=org.freedesktop.DBus), > -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
