logo

apparmor.d

Unnamed repository; edit this file 'description' to name the repository. git clone https://hacktivis.me/git/apparmor.d.git

private-files-strict (1212B)

    

  1. # vim:syntax=apparmor
  2. # privacy-violations-strict contains additional rules for sensitive
  3. # files that you want to explicitly deny access
  5.   abi <abi/3.0>,
  7.   include <abstractions/private-files>
  9.   # potentially extremely sensitive files
  10.   audit deny @{HOME}/.aws/{,**} mrwkl,
  11.   audit deny @{HOME}/.gnupg/{,**} mrwkl,
  12.   audit deny @{HOME}/.ssh/{,**} mrwkl,
  13.   audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
  14.   audit deny @{HOME}/.gnome2/ w,
  15.   audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl,
  16.   # don't allow access to any gnome-keyring modules
  17.   audit deny @{run}/user/[0-9]*/keyring** mrwkl,
  18.   audit deny @{HOME}/.mozilla/{,**} mrwkl,
  19.   audit deny @{HOME}/.config/ w,
  20.   audit deny @{HOME}/.config/chromium/{,**} mrwkl,
  21.   audit deny @{HOME}/.config/evolution/{,**} mrwkl,
  22.   audit deny @{HOME}/.evolution/{,**} mrwkl,
  23.   audit deny @{HOME}/.{,mozilla-}thunderbird/{,**} mrwkl,
  24.   audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w,
  25.   audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/{,**} mrwkl,
  26.   audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl,
  27.   audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl,
  29.   # Include additions to the abstraction
  30.   include if exists <abstractions/private-files-strict.d>