1 files changed, 39 insertions, 0 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict
new file mode 100644
index 0000000..1796a55
--- /dev/null
+++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict
@@ -0,0 +1,39 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2011-2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # unique per-machine identifier
+  /etc/machine-id r,
+  /var/lib/dbus/machine-id r,
+
+  unix (connect, receive, send, accept) type=stream peer=(addr="@/tmp/dbus-*"),
+
+  unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-*",
+  unix (bind, listen) type=stream addr="@/tmp/dbus-*",
+
+  # dbus with systemd and --enable-user-session
+  owner @{run}/user/[0-9]*/bus rw,
+
+  dbus send
+       bus=session
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
+       peer=(name=org.freedesktop.DBus),
+
+  owner @{run}/user/@{uid}/at-spi/ rw,
+  owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw,
+
+  owner /tmp/dbus-[0-9a-zA-Z]* rw,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/dbus-session-strict.d>