From 83f7fe4b8402bab171d110703a1b1115efbc9b28 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Tue, 14 Apr 2026 22:32:43 +0200 Subject: cleaned up many scrits and deleted some that were of no use; renamed a lot --- .../apparmor/apparmor.d/abstractions/snap_browsers | 39 ---------------------- 1 file changed, 39 deletions(-) delete mode 100644 straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers (limited to 'straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers') diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers b/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers deleted file mode 100644 index b6ee4ee..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers +++ /dev/null @@ -1,39 +0,0 @@ -profile snap_browsers { - include if exists - include - include - - /etc/passwd r, - /etc/nsswitch.conf r, - /etc/fstab r, - - # noisy - deny owner /run/user/[0-9]*/gdm/Xauthority r, # not needed on Ubuntu - - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrix, # re-exec - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/info r, - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snapd r, - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-seccomp rPix, - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-confine Pix, - /var/lib/snapd/system-key r, - /run/snapd.socket rw, - - @{PROC}/version r, - @{PROC}/cmdline r, - @{PROC}/sys/net/core/somaxconn r, - @{PROC}/sys/kernel/seccomp/actions_avail r, - @{PROC}/sys/kernel/random/uuid r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{HOME}/.snap/auth.json r, # if exists, required - - dbus send bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="StartTransientUnit" peer=(name="org.freedesktop.systemd1"), - dbus receive bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="JobRemoved", - - /sys/kernel/security/apparmor/features/ r, - - # allow launching official browser snaps. - /snap/{brave,chromium,firefox,opera}/[0-9]*/meta/{snap.yaml,hooks/} r, - /var/lib/snapd/sequence/{brave,chromium,firefox,opera}.json r, - /var/lib/snapd/inhibit/{brave,chromium,firefox,opera}.lock rk, -} -- cgit v1.3