[apparmor] [PATCH 3/4] profiles: Add strict accessibility bus abstraction

[John Johansen]

On 01/03/2014 02:26 PM, Tyler Hicks wrote:
> Move the file rule from the existing permissive accessibility bus
> abstraction into a new strict accessibility bus abstraction.
> 
> The strict abstraction only allows for calling the Hello, AddMatch,
> RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods
> that are exported by the D-Bus daemon.
> 
> The permissive abstraction reuses the strict abstraction and then allows
> all communications on the accessibility bus.
> 
> Signed-off-by: Tyler Hicks <tyhicks at canonical.com>

Acked-by: John Johansen <john.johansen at canonical.com>

> ---
>  profiles/apparmor.d/abstractions/dbus-accessibility     |  4 ++++
>  .../apparmor.d/abstractions/dbus-accessibility-strict   | 17 +++++++++++++++++
>  2 files changed, 21 insertions(+)
>  create mode 100644 profiles/apparmor.d/abstractions/dbus-accessibility-strict
> 
> diff --git a/profiles/apparmor.d/abstractions/dbus-accessibility b/profiles/apparmor.d/abstractions/dbus-accessibility
> index f52eb7b..40a3308 100644
> --- a/profiles/apparmor.d/abstractions/dbus-accessibility
> +++ b/profiles/apparmor.d/abstractions/dbus-accessibility
> @@ -9,4 +9,8 @@
>  #
>  # ------------------------------------------------------------------
>  
> +  # This abstraction grants full accessibility bus access. Consider using the
> +  # dbus-accessibility-strict abstraction for fine-grained bus mediation.
> +
> +  #include <abstractions/dbus-accessibility-strict>
>    dbus bus=accessibility,
> diff --git a/profiles/apparmor.d/abstractions/dbus-accessibility-strict b/profiles/apparmor.d/abstractions/dbus-accessibility-strict
> new file mode 100644
> index 0000000..a853ce2
> --- /dev/null
> +++ b/profiles/apparmor.d/abstractions/dbus-accessibility-strict
> @@ -0,0 +1,17 @@
> +# vim:syntax=apparmor
> +# ------------------------------------------------------------------
> +#
> +#    Copyright (C) 2013 Canonical Ltd.
> +#
> +#    This program is free software; you can redistribute it and/or
> +#    modify it under the terms of version 2 of the GNU General Public
> +#    License published by the Free Software Foundation.
> +#
> +# ------------------------------------------------------------------
> +
> +  dbus send
> +       bus=accessibility
> +       path=/org/freedesktop/DBus
> +       interface=org.freedesktop.DBus
> +       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
> +       peer=(name=org.freedesktop.DBus),
>