diff --git a/security/apparmor/2.12.1/tunables/usr.bin.qtox b/security/apparmor/2.12.1/tunables/usr.bin.qtox index 993b20cbe..287b27759 100644 --- a/security/apparmor/2.12.1/tunables/usr.bin.qtox +++ b/security/apparmor/2.12.1/tunables/usr.bin.qtox @@ -8,5 +8,5 @@ # needed, such as: # @{qtox_prefix} += @{HOME}/opt/qtox # @{qtox_additional_rw_dirs} = /data/nfs_storage -#include if exists +#include diff --git a/security/apparmor/2.12.1/usr.bin.qtox b/security/apparmor/2.12.1/usr.bin.qtox index be2e0208c..fb3f55abd 100644 --- a/security/apparmor/2.12.1/usr.bin.qtox +++ b/security/apparmor/2.12.1/usr.bin.qtox @@ -11,18 +11,12 @@ profile qtox /usr{,/local}/bin/qtox { #include #include #include - #include - #include #include - #include #include - #include - #include - #include #include # Site-specific additions and overrides. See local/README for details. - #include if exists + #include # Main executable @@ -81,8 +75,8 @@ profile qtox /usr{,/local}/bin/qtox { owner @{HOME}/[^.]* l -> @{HOME}/#[0-9]*[0-9], owner @{HOME}/[^.]*/** l -> @{HOME}/#[0-9]*[0-9], - owner /{,var/}run/user/@{uid}/#[0-9]*[0-9] rw, # file dialog - owner /{,var/}run/user/@{uid}/qTox*.slave-socket rwl -> /{,var/}run/user/@{uid}/#[0-9]*[0-9], # file dialog + owner /{,var/}run/user/[0-9]*[0-9]/#[0-9]*[0-9] rw, # file dialog + owner /{,var/}run/user/[0-9]*[0-9]/qTox*.slave-socket rwl -> /{,var/}run/user/[0-9]*[0-9]/#[0-9]*[0-9], # file dialog owner @{HOME}/.cache/Tox/ w, owner @{HOME}/.cache/Tox/qTox/{,**} rw, owner @{HOME}/.cache/thumbnails/** rw, # receiving image file produces thumbnail? @@ -100,4 +94,51 @@ profile qtox /usr{,/local}/bin/qtox { # commit 1250402471d9d83134b0faa90239a733a37f23f0 owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9], owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory) + + # Backport kde-globals-write abstraction + # commit fae93f1b6c7a28bb77ad186ab1de41372630272b + owner @{HOME}/.config/#[0-9]* rw, + owner @{HOME}/.config/kdeglobals rw, + owner @{HOME}/.config/kdeglobals.?????? rwl -> @{HOME}/.config/#[0-9]*, + owner @{HOME}/.config/kdeglobals.lock rwk, + + # Backport kde-icon-cache-write abstraction + # commit 94014c09f09fc63229bb10fea3f0727113fe5bae + owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader + + # Backport mesa abstraction + # commit b5be5964609b4e0927af7c9e4f0276e50ccdc3e3 + + # System files + /dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2() + /usr/share/drirc.d/{,*.conf} r, + + # User files + owner @{HOME}/.cache/ w, # if user clears all caches + owner @{HOME}/.cache/mesa_shader_cache/ w, + owner @{HOME}/.cache/mesa_shader_cache/index rw, + owner @{HOME}/.cache/mesa_shader_cache/??/ w, + owner @{HOME}/.cache/mesa_shader_cache/??/* rwk, + # End of backported mesa abstraction + + # Backport qt5-compose-cache-write abstraction + # commit 1250402471d9d83134b0faa90239a733a37f23f0 + owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9], + owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory) + + # Backport qt5-settings-write abstraction + # commit 8f6a8fb1942122705af4c45168922c4afd696c8a + owner @{HOME}/.config/#[0-9]*[0-9] rw, + owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9], + # for temporary files like QtProject.conf.Aqrgeb + owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], + owner @{HOME}/.config/QtProject.conf.lock rwk, + + # Backport recent-documents-write + # commit 4fe8ae97c43d72d7f5a948c7149f5ea35339832a + owner @{HOME}/.local/share/RecentDocuments/ rw, + owner @{HOME}/.local/share/RecentDocuments/#[0-9]* rw, + owner @{HOME}/.local/share/RecentDocuments/*.desktop rwl -> @{HOME}/.local/share/RecentDocuments/#[0-9]*, + owner @{HOME}/.local/share/RecentDocuments/*.lock rwk, + }