Simon Déziel has proposed merging
lp:~sdeziel/apparmor-profiles/refresh-pulseaudio into lp:apparmor-profiles.
Requested reviews:
AppArmor Developers (apparmor-dev)
For more details, see:
https://code.launchpad.net/~sdeziel/apparmor-profiles/refresh-pulseaudio/+merge/281910
--
Your team AppArmor Developers is requested to review the proposed merge of
lp:~sdeziel/apparmor-profiles/refresh-pulseaudio into lp:apparmor-profiles.
=== modified file 'ubuntu/16.04/usr.bin.pulseaudio'
--- ubuntu/16.04/usr.bin.pulseaudio 2015-10-27 01:49:53 +0000
+++ ubuntu/16.04/usr.bin.pulseaudio 2016-01-07 18:21:04 +0000
@@ -5,9 +5,20 @@
#include <abstractions/base>
#include <abstractions/audio>
#include <abstractions/dbus-session>
+ #include <abstractions/dbus-strict>
#include <abstractions/nameservice>
#include <abstractions/X>
+ dbus send
+ bus=system
+ path=/org/freedesktop/RealtimeKit1
+ interface=org.freedesktop.RealtimeKit1
+ member={MakeThreadRealtime,MakeThreadHighPriority}
+ peer=(name=org.freedesktop.RealtimeKit1),
+
+ unix (connect, receive, send) type=stream peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
+ ptrace (read,trace) peer=@{profile_name},
+
/usr/bin/pulseaudio mixr,
/dev/null rw,
@@ -19,22 +30,25 @@
/etc/udev/udev.conf r,
/etc/timidity/.pulse_cookie w,
- @{HOME}/.esd_auth rwk,
- @{HOME}/.pulse-cookie rwk,
- @{HOME}/.config/pulse/cookie rwk,
- @{HOME}/{.config/pulse,.pulse}/ rw,
- @{HOME}/{.config/pulse,.pulse}/* rw,
+ owner @{HOME}/.esd_auth rwk,
+ owner @{HOME}/.pulse-cookie rwk,
+ owner @{HOME}/.config/pulse/cookie rwk,
+ owner @{HOME}/{.config/pulse,.pulse}/ rw,
+ owner @{HOME}/{.config/pulse,.pulse}/* rw,
- /run/pulse/ rw,
- /run/pulse/.pulse-cookie rwk,
- /run/pulse/dbus-socket rwk,
- /run/pulse/native rwk,
- /run/pulse/pid rwk,
+ owner /run/pulse/ rw,
+ owner /run/pulse/.pulse-cookie rwk,
+ owner /run/pulse/dbus-socket rwk,
+ owner /run/pulse/native rwk,
+ owner /run/pulse/pid rwk,
+ owner /run/user/[0-9]*/pulse/ rw,
+ owner /run/user/[0-9]*/pulse/* rwk,
/run/udev/data/+sound:card* r,
+ /run/udev/data/c116:[0-9]* r,
# logind
- /run/systemd/users/* r,
- /run/user/*/dconf/user k,
+ /run/systemd/users/[0-9]* r,
+ /run/user/[0-9]*/dconf/user k,
/sys/bus/ r,
/sys/class/ r,
@@ -46,7 +60,7 @@
/sys/devices/virtual/dmi/id/bios_vendor r,
/sys/devices/virtual/dmi/id/board_vendor r,
/sys/devices/virtual/dmi/id/sys_vendor r,
- /sys/devices/**/sound/card[0-9]*/uevent r,
+ /sys/devices/virtual/sound/**/uevent r,
/usr/share/alsa/** r,
/usr/share/applications/ r,
@@ -61,10 +75,9 @@
owner /var/lib/lightdm/.Xauthority r,
owner /var/lib/lightdm/.esd_auth rwk,
- owner /var/lib/lightdm/.pulse-cookie rwk,
- owner /var/lib/lightdm/.pulse/ rw,
- owner /var/lib/lightdm/.pulse/* w,
- owner /var/lib/lightdm/.pulse/* r,
+ owner /var/lib/lightdm/.config/pulse/cookie rwk,
+ owner /var/lib/lightdm/.config/pulse/ rw,
+ owner /var/lib/lightdm/.config/pulse/* rw,
# are these needed?
/var/lib/pulse/ rw,
@@ -72,9 +85,9 @@
/var/lib/pulse/*-default-source rw,
/var/lib/pulse/*.tdb rw,
- @{PROC}/[0-9]*/fd/ r,
- @{PROC}/[0-9]*/maps r,
- @{PROC}/[0-9]*/stat r,
+ owner @{PROC}/@{pid}/fd/ r,
+ owner @{PROC}/@{pid}/maps r,
+ owner @{PROC}/@{pid}/stat r,
owner /tmp/pulse-*/pid rwk,
owner /tmp/pulse-*/native rwk,
@@ -83,11 +96,10 @@
owner /tmp/orcexec.* mrw,
owner /{,var/}run/user/[0-9]*/orcexec.* mrw,
# needed if /tmp is mounted noexec:
- owner @{HOME}/orcexec.* mr,
+ owner @{HOME}/orcexec.* mrw,
- # replace with @{pid}
- owner /tmp/.esd-[0-9]*/ rw,
- owner /tmp/.esd-[0-9]*/socket rw,
+ owner /tmp/.esd-@{pid}*/ rw,
+ owner /tmp/.esd-@{pid}*/socket rw,
profile /usr/lib/pulseaudio/pulse/gconf-helper {
#include <abstractions/base>
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
