← Back to branch summary

~ken-vandine/apparmor-easyprof-ubuntu/content_exchange_mir

« back to all changes in this revision

Viewing changes to data/policygroups/ubuntu/1.0/networking

  • Committer: Jamie Strandboge
  • Date: 2015-02-03 22:08:27 UTC
  • Revision ID: jamie@ubuntu.com-20150203220827-rfz4540yx2c1kbzt
Tags: 1.3.1
* ubuntu/ubuntu-sdk:
  - explicitly deny reads on ~/.cache/QML/Apps/ to silence noisy denials.
    Undo this when LP: 1381620 is fixed in qtdeclarative-opensource-src
  - explicitly deny dbus bind on name="org.freedesktop.Application" since
    it is noisy. Undo this when LP: 1378823 is fixed in ubuntu-ui-toolkit
* ubuntu/1.3/ubuntu-sdk: drop html5-container policy. html5 apps should use
  webapp-container and specify the 'webview' policy group with 1.3 (15.04)
  policy (LP: #1392461)
* ubuntu/ubuntu-scope-network, pending/ubuntu-scope-local-content: allow
  scopes to read data from the apps data dir (LP: #1384286)
* adjust all dbus rules to use peer=(label=unconfined) to prevent
  coordinated communications between apps over DBus (LP: #1383824)
* ubuntu/{music,pictures,video}_files*: allow access to global SD card
  directories (LP: #1391930)
* debian/control: Depends on apparmor >= 2.8.98-0ubuntu2~ for the dbus peer
  changes (we need at least apparmor_parser 2.9.beta4 for these)

Show diffs side-by-side

added added

removed removed

Lines of Context:
data/policygroups/ubuntu/1.0/networking
7
7
     bus=session
8
8
     interface="org.freedesktop.DBus.Introspectable"
9
9
     path=/
10
 
     member=Introspect,
 
10
     member=Introspect
 
11
     peer=(label=unconfined),
11
12
dbus (send)
12
13
     bus=session
13
14
     interface="org.freedesktop.DBus.Introspectable"
14
15
     path=/com/canonical/applications/download/**
15
 
     member=Introspect,
 
16
     member=Introspect
 
17
     peer=(label=unconfined),
16
18
# Allow DownloadManager to send us signals, etc
17
19
dbus (receive)
18
20
     bus=session
19
 
     interface=com.canonical.applications.Download{,er}Manager,
 
21
     interface=com.canonical.applications.Download{,er}Manager
 
22
     peer=(label=unconfined),
20
23
# Restrict apps to just their own downloads
21
24
owner @{HOME}/.local/share/ubuntu-download-manager/@{APP_PKGNAME}/   rw,
22
25
owner @{HOME}/.local/share/ubuntu-download-manager/@{APP_PKGNAME}/** rwk,
23
26
dbus (receive, send)
24
27
     bus=session
25
28
     path=/com/canonical/applications/download/@{APP_ID_DBUS}/**
26
 
     interface=com.canonical.applications.Download,
 
29
     interface=com.canonical.applications.Download
 
30
     peer=(label=unconfined),
27
31
dbus (receive, send)
28
32
     bus=session
29
33
     path=/com/canonical/applications/download/@{APP_ID_DBUS}/**
30
 
     interface=com.canonical.applications.GroupDownload,
 
34
     interface=com.canonical.applications.GroupDownload
 
35
     peer=(label=unconfined),
31
36
# Be explicit about the allowed members we can send to
32
37
dbus (send)
33
38
     bus=session
34
39
     path=/
35
40
     interface=com.canonical.applications.DownloadManager
36
 
     member=createDownload,
37
 
dbus (send)
38
 
     bus=session
39
 
     path=/
40
 
     interface=com.canonical.applications.DownloadManager
41
 
     member=createDownloadGroup,
42
 
dbus (send)
43
 
     bus=session
44
 
     path=/
45
 
     interface=com.canonical.applications.DownloadManager
46
 
     member=getAllDownloads,
47
 
dbus (send)
48
 
     bus=session
49
 
     path=/
50
 
     interface=com.canonical.applications.DownloadManager
51
 
     member=getAllDownloadsWithMetadata,
52
 
dbus (send)
53
 
     bus=session
54
 
     path=/
55
 
     interface=com.canonical.applications.DownloadManager
56
 
     member=defaultThrottle,
57
 
dbus (send)
58
 
     bus=session
59
 
     path=/
60
 
     interface=com.canonical.applications.DownloadManager
61
 
     member=isGSMDownloadAllowed,
 
41
     member=createDownload
 
42
     peer=(label=unconfined),
 
43
dbus (send)
 
44
     bus=session
 
45
     path=/
 
46
     interface=com.canonical.applications.DownloadManager
 
47
     member=createDownloadGroup
 
48
     peer=(label=unconfined),
 
49
dbus (send)
 
50
     bus=session
 
51
     path=/
 
52
     interface=com.canonical.applications.DownloadManager
 
53
     member=getAllDownloads
 
54
     peer=(label=unconfined),
 
55
dbus (send)
 
56
     bus=session
 
57
     path=/
 
58
     interface=com.canonical.applications.DownloadManager
 
59
     member=getAllDownloadsWithMetadata
 
60
     peer=(label=unconfined),
 
61
dbus (send)
 
62
     bus=session
 
63
     path=/
 
64
     interface=com.canonical.applications.DownloadManager
 
65
     member=defaultThrottle
 
66
     peer=(label=unconfined),
 
67
dbus (send)
 
68
     bus=session
 
69
     path=/
 
70
     interface=com.canonical.applications.DownloadManager
 
71
     member=isGSMDownloadAllowed
 
72
     peer=(label=unconfined),
62
73
# Explicitly deny DownloadManager APIs apps shouldn't have access to in order
63
74
# to make sure they aren't accidentally added in the future (see LP: #1277578
64
75
# for details)