File: lightdm-remote-session-x2go.in

package info (click to toggle)
lightdm-remote-session-x2go 0.0.2.0-2
  • links: PTS, VCS
  • area: main
  • in suites: buster, sid
  • size: 160 kB
  • sloc: makefile: 73; ansic: 11; sh: 7
file content (85 lines) | stat: -rw-r--r-- 2,091 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# vim:syntax=apparmor
# Profile for restricting lightdm remote session for X2Go
# Based on the Guest Account Apparmor script from:
# Author: Martin Pitt <martin.pitt@ubuntu.com>
#         Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

#include <tunables/global>

@libexecdir@/x2go-session-wrapper {
  #include <abstractions/authentication>
  #include <abstractions/nameservice>
  #include <abstractions/wutmp>
  /etc/compizconfig/config rw, # bug in compiz https://launchpad.net/bugs/697678
 
  / r,
  /bin/ rmix,
  /bin/fusermount Px,
  /bin/** rmix,
  /cdrom/ rmix,
  /cdrom/** rmix,
  /dev/ r,
  /dev/** rmw, # audio devices etc.
  owner /dev/shm/** rmw,
  /etc/ r,
  /etc/** rmk,
  /etc/gdm/Xsession ix,
  /lib/ r,
  /lib/** rmixk,
  /lib32/ r,
  /lib32/** rmixk,
  /lib64/ r,
  /lib64/** rmixk,
  owner /media/ r,
  owner /media/** rmwlixk,  # we want access to USB sticks and the like
  /opt/ r,
  /opt/** rmixk,
  @{PROC}/ r,
  @{PROC}/* rm,
  @{PROC}/asound rm,
  @{PROC}/asound/** rm,
  @{PROC}/ati rm,
  @{PROC}/ati/** rm,
  owner @{PROC}/** rm,
  # needed for gnome-keyring-daemon
  @{PROC}/*/status r,
  /sbin/ r,
  /sbin/** rmixk,
  /sys/ r,
  /sys/** rm,
  /tmp/ rw,
  owner /tmp/** rwlkmix,
  /usr/ r,
  /usr/** rmixk,
  /var/ r,
  /var/** rmixk,
  /var/guest-data/** rw, # allow to store files permanently
  /var/tmp/ rw,
  owner /var/tmp/** rwlkm,
  /{,var/}run/ r,
  # necessary for writing to sockets, etc.
  /{,var/}run/** rmkix,
  /{,var/}run/shm/** wl,
  # access to kernel's UUID generator (required by pyhoca-cli)
  @{PROC}/sys/kernel/random/uuid r,
  /var/lib/libuuid/clock.txt rw,
  /run/systemd/journal/dev-log w,
  /tmp/**/.x2go-socket r,
  /tmp/.X11-unix/X[0-9]* wr,
  /run/uuidd/request w,
  /proc/sys/kernel/ngroups_max r,

  network,

  dbus(send) bus=session,
  dbus(send, receive) bus=accessibility,

  capability ipc_lock,

  # silence warnings for stuff that we really don't want to grant
  deny capability dac_override,
  deny capability dac_read_search,
  #deny /etc/** w, # re-enable once LP#697678 is fixed
  deny /usr/** w,
  deny /var/crash/ w,
}