1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
#include <tunables/global>
profile gotosocial flags=(attach_disconnected, mediate_deleted) {
include <abstractions/base>
include <abstractions/dbus-session-strict>
include <abstractions/gio-open>
include <abstractions/nameservice>
include <abstractions/user-tmp>
/gotosocial/gotosocial mrix,
/usr/local/bin/gotosocial mrix,
/usr/bin/gotosocial mrix,
/usr/sbin/gotosocial mrix,
owner /gotosocial/{,**} r,
owner /gotosocial/db/* wk,
owner /gotosocial/storage/** wk,
# Allow GoToSocial to write logs
# NOTE: you only need to allow write permissions to /var/log/syslog if you've
# enabled logging to syslog.
# owner /var/log/syslog w,
# These directories are not currently used by any of the recommended
# GoToSocial installation methods, but they may be used in the future and/or
# for custom installations.
owner /etc/gotosocial/{,**} r,
owner /usr/local/etc/gotosocial/{,**} r,
owner /usr/share/gotosocial/{,**} r,
owner /usr/local/share/gotosocial/{,**} r,
owner /usr/lib/gotosocial/{,**} r,
owner /usr/lib/gotosocial/db/* wk,
owner /usr/lib/gotosocial/storage/** wk,
owner /usr/local/lib/gotosocial/{,**} r,
owner /usr/local/lib/gotosocial/db/* wk,
owner /usr/local/lib/gotosocial/storage/** wk,
owner /var/lib/gotosocial/{,**} r,
owner /var/lib/gotosocial/db/* wk,
owner /var/lib/gotosocial/storage/** wk,
owner /opt/gotosocial/{,**} r,
owner /run/gotosocial/{,**} r,
/etc/mime.types r,
/etc/services r,
/proc/sys/net/core/somaxconn r,
/sys/fs/cgroup/system.slice/gotosocial.service/{,*} r,
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
owner /proc/*/cgroup r,
owner /proc/*/cpuset r,
owner /proc/*/mountinfo r,
# TCP / UDP network access
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
# Allow GoToSocial to receive signals from unconfined processes
signal (receive) peer=unconfined,
# Allow GoToSocial to send signals to/receive signals from worker processes
signal (send,receive) peer=gotosocial,
}
# vim:syntax=apparmor
|
