ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: etc / apparmor.d / abstractions

# vim:syntax=apparmor
# privacy-violations contains rules for common files that you want to
# explicitly deny access

# privacy violations (don't audit files under $HOME otherwise get a
  # lot of false positives when reading contents of directories)
  deny @{HOME}/.*history mrwkl,
  deny @{HOME}/.fetchmail* mrwkl,
  deny @{HOME}/.mutt** mrwkl,
  deny @{HOME}/.viminfo* mrwkl,
  deny @{HOME}/.*~ mrwkl,
  deny @{HOME}/.*.swp mrwkl,
  deny @{HOME}/.*~1~ mrwkl,
  deny @{HOME}/.*.bak mrwkl,

# special attention to (potentially) executable files
  audit deny @{HOME}/bin/{,**} wl,
  audit deny @{HOME}/.config/ w,
  audit deny @{HOME}/.config/autostart/{,**} wl,
  audit deny @{HOME}/.config/upstart/{,**} wl,
  audit deny @{HOME}/.init/{,**} wl,
  audit deny @{HOME}/.kde{,4}/ w,
  audit deny @{HOME}/.kde{,4}/Autostart/{,**} wl,
  audit deny @{HOME}/.kde{,4}/env/{,**} wl,
  audit deny @{HOME}/.local/{,share/} w,
  audit deny @{HOME}/.local/share/thumbnailers/{,**} wl,
  audit deny @{HOME}/.pki/ w,
  audit deny @{HOME}/.pki/nssdb/{,*.so{,.[0-9]*}} wl,

# don't allow reading/updating of run control files
  deny @{HOME}/.*rc mrk,
  audit deny @{HOME}/.*rc wl,

# bash
  deny @{HOME}/.bash* mrk,
  audit deny @{HOME}/.bash* wl,
  deny @{HOME}/.inputrc mrk,
  audit deny @{HOME}/.inputrc wl,

# sh/dash/csh/tcsh/pdksh/zsh
  deny @{HOME}/.{,z}profile* mrk,
  audit deny @{HOME}/.{,z}profile* wl,
  deny @{HOME}/.{,z}log{in,out} mrk,
  audit deny @{HOME}/.{,z}log{in,out} wl,

deny @{HOME}/.zshenv mrk,
  audit deny @{HOME}/.zshenv wl,

[+] ..
[-] qt5-compose-cache-write [edit]
[-] dri-common [edit]
[-] private-files-strict [edit]
[-] ubuntu-console-browsers [edit]
[-] user-manpages [edit]
[-] perl [edit]
[-] user-mail [edit]
[-] opencl [edit]
[-] opencl-pocl [edit]
[-] p11-kit [edit]
[-] vulkan [edit]
[-] qt5 [edit]
[-] kde [edit]
[+] ubuntu-browsers.d
[-] user-write [edit]
[-] dbus-accessibility-strict [edit]
[-] ubuntu-unity7-messaging [edit]
[-] dbus-session-strict [edit]
[-] svn-repositories [edit]
[-] postfix-common [edit]
[-] dri-enumerate [edit]
[-] ubuntu-console-email [edit]
[-] recent-documents-write [edit]
[-] gnome [edit]
[-] xad [edit]
[-] xdg-desktop [edit]
[-] kde-language-write [edit]
[-] dconf [edit]
[-] ruby [edit]
[-] samba [edit]
[-] consoles [edit]
[-] mdns [edit]
[-] kde-globals-write [edit]
[-] authentication [edit]
[-] winbind [edit]
[-] ubuntu-email [edit]
[-] ubuntu-bittorrent-clients [edit]
[-] mysql [edit]
[-] gnupg [edit]
[-] freedesktop.org [edit]
[-] dbus-session [edit]
[-] fonts [edit]
[-] dbus-accessibility [edit]
[-] likewise [edit]
[-] aspell [edit]
[-] cups-client [edit]
[-] wutmp [edit]
[-] mozc [edit]
[-] ubuntu-unity7-launcher [edit]
[-] libpam-systemd [edit]
[-] ubuntu-gnome-terminal [edit]
[-] opencl-common [edit]
[-] ibus [edit]
[-] ubuntu-media-players [edit]
[-] qt5-settings-write [edit]
[-] opencl-nvidia [edit]
[-] X [edit]
[-] opencl-mesa [edit]
[-] apache2-common [edit]
[-] enchant [edit]
[-] opencl-intel [edit]
[-] fcitx-strict [edit]
[-] python [edit]
[-] nameservice [edit]
[-] ssl_certs [edit]
[-] bash [edit]
[-] php5 [edit]
[-] dbus [edit]
[-] php [edit]
[-] ldapclient [edit]
[-] user-tmp [edit]
[-] wayland [edit]
[-] smbpass [edit]
[-] audio [edit]
[-] fcitx [edit]
[-] mesa [edit]
[-] web-data [edit]
[-] nis [edit]
[+] apparmor_api
[-] base [edit]
[-] ubuntu-unity7-base [edit]
[-] ubuntu-helpers [edit]
[-] dovecot-common [edit]
[-] private-files [edit]
[-] kde-icon-cache-write [edit]
[-] nvidia [edit]
[-] ubuntu-xterm [edit]
[-] dbus-strict [edit]
[-] ubuntu-feed-readers [edit]
[-] openssl [edit]
[-] orbit2 [edit]
[-] kerberosclient [edit]
[-] user-download [edit]
[-] ubuntu-browsers [edit]
[-] ssl_keys [edit]
[-] video [edit]
[-] mir [edit]
[-] ubuntu-konsole [edit]