▲ 0 r/archlinux
Working on an apparmor profile for wine
I want the last 3 perms to only apply to xsim but i found no way to actually make that work so far. Unfortunately wine also tends to work with malware so i want proper safety measures in place.
This is also more permissive than ideal in other ways. Had a hard time finding proper documentation so i ended up with a frankenstein-profile consisting of a mix between 2 profiles i found online in addition to my own hacks for this. Not exactly ideal in terms of security.
Trying to find some good way to make profiles for specific windows programs.
#include <tunables/global>
"/**/{wine*,*.exe}" {
#include <abstractions/base>
#include <abstractions/fonts>
#include <abstractions/nameservice>
#include <abstractions/ubuntu-gnome-terminal>
/dev/** r,
/proc/** r,
/sys/** r,
/usr/** r,
/lib/** r,
/etc/** r,
/tmp/** r,
/var/** r,
/opt/** r,
/dev/dri/renderD128 rw,
/dev/dri/renderD128 rw,
/usr/lib/wine/x86_64-unix/* rmix,
/usr/bin/wineserver rmix,
/usr/bin/wine rmix,
/usr/lib{,32,64}/** mr,
/run/media/CENSORED/CENSORED/** rwix,
/home/*/.wine/** rwix,
/run/media/*/CENSORED/** r,
/tmp/.wine-*/server-*/ r,
/tmp/.wine-*/server-*/* wk,
/home/** r,
/home/*/XSim/** rix,
/home/*/Documents/CENSORED/CENSORED/CENSORED/data/** rw,
}
u/vintologi24 — 21 hours ago
