diff options
Diffstat (limited to 'straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open')
| -rw-r--r-- | straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open b/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open new file mode 100644 index 0000000..06b3585 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open @@ -0,0 +1,47 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This abstraction is designed to be used in a child profile to limit what +# confined application can invoke via gvfs-open helper. +# +# NOTE: most likely you want to use xdg-open abstraction instead for better +# portability across desktop environments, unless you are sure that confined +# application only uses /usr/bin/gvfs-open directly. +# +# Usage example: +# +# ``` +# profile foo /usr/bin/foo { +# ... +# /usr/bin/gvfs-open rPx -> foo//gvfs-open, +# ... +# } # end of main profile +# +# # out-of-line child profile +# profile foo//gvfs-open { +# include <abstractions/gvfs-open> +# +# # needed for ubuntu-* abstractions +# include <abstractions/ubuntu-helpers> +# +# # Only allow to handle http[s]: and mailto: links +# include <abstractions/ubuntu-browsers> +# include <abstractions/ubuntu-email> +# +# # < add additional allowed applications here > +# } +# ``` + + include <abstractions/base> + + # gvfs-open is deprecated, it launches gio open <uri> + include <abstractions/gio-open> + + # Main executables + + /usr/bin/gvfs-open r, + /{,usr/}bin/dash mr, + + # Include additions to the abstraction + include if exists <abstractions/gvfs-open.d> |