[apparmor] [PATCH 3/4] profiles: Add strict accessibility bus abstraction

[Tyler Hicks]

Move the file rule from the existing permissive accessibility bus
abstraction into a new strict accessibility bus abstraction.

The strict abstraction only allows for calling the Hello, AddMatch,
RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods
that are exported by the D-Bus daemon.

The permissive abstraction reuses the strict abstraction and then allows
all communications on the accessibility bus.

Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
---
 profiles/apparmor.d/abstractions/dbus-accessibility     |  4 ++++
 .../apparmor.d/abstractions/dbus-accessibility-strict   | 17 +++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 profiles/apparmor.d/abstractions/dbus-accessibility-strict

diff --git a/profiles/apparmor.d/abstractions/dbus-accessibility b/profiles/apparmor.d/abstractions/dbus-accessibility
index f52eb7b..40a3308 100644
--- a/profiles/apparmor.d/abstractions/dbus-accessibility
+++ b/profiles/apparmor.d/abstractions/dbus-accessibility
@@ -9,4 +9,8 @@
 #
 # ------------------------------------------------------------------
 
+  # This abstraction grants full accessibility bus access. Consider using the
+  # dbus-accessibility-strict abstraction for fine-grained bus mediation.
+
+  #include <abstractions/dbus-accessibility-strict>
   dbus bus=accessibility,
diff --git a/profiles/apparmor.d/abstractions/dbus-accessibility-strict b/profiles/apparmor.d/abstractions/dbus-accessibility-strict
new file mode 100644
index 0000000..a853ce2
--- /dev/null
+++ b/profiles/apparmor.d/abstractions/dbus-accessibility-strict
@@ -0,0 +1,17 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  dbus send
+       bus=accessibility
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
+       peer=(name=org.freedesktop.DBus),
-- 
1.8.3.2