| Server IP : 85.143.209.190 / Your IP : 216.73.217.12 Web Server : Apache/2.4.63 (Ubuntu) System : Linux 49083.simplecloud.ru 5.4.0-205-generic #225-Ubuntu SMP Fri Jan 10 22:23:35 UTC 2025 x86_64 User : vozdvizhenka37 ( 1083) PHP Version : 7.4.33 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /snap/core/17292/usr/share/apparmor/easyprof/policygroups/ubuntu-core/16.04/ |
Upload File : |
# Description: Can access the Mir display server as a client
# Usage: common
# TODO: is this needed by the client too? If it is, then we need to change the
# usage to 'reserved' until we have seccomp arg filtering implemented.
#capability chown,
#capability fowner,
# Socket to talk on
/run/mir_socket rw,
# FIXME: this is problematic with the current approach of forking and renaming
# the mir-template snap since the label will not match the server. This might
# be needed for the anonymous seqpacket socket? This needs to be refined.
unix (connect, send, receive) peer=(label="mir{,.*}_server-compositor_*"),
# For non-opengl apps
# https://www.kernel.org/doc/gorman/html/understand/understand015.html
/dev/shm/\#* rw,
# udev
deny /etc/udev/udev.conf r,
deny /run/udev/data/* r,
# FIXME: this is an information leak until AppArmor implements kernel variables
owner @{PROC}/@{pid}/cmdline r,
# FIXME: these should be part of (hw-)assign, not this policy group
# /dev/dri/card0 rw, # hardware acceleration
# /sys/devices/*/*/*/drm/card0/uevent r,
# FIXME: this is too lenient, please adjust for specific accesses
# /sys/devices/*/*/*/uevent r,
/usr/share/applications/ r,
# Library snaps will allow things like this, but this creates a tight coupling
# between mir and consumers of mir, so leave it out for now.
#@{INSTALL_DIR}/mir{,.*}/ r,
#@{INSTALL_DIR}/mir{,.*}/** r,
#@{INSTALL_DIR}/mir{,.*}/**/lib.so* mr,