aboutsummaryrefslogtreecommitdiff
path: root/lightdm-remote-session-x2go.in
diff options
context:
space:
mode:
authorMike Gabriel <mike.gabriel@das-netzwerkteam.de>2012-11-09 21:53:05 +0100
committerMike Gabriel <mike.gabriel@das-netzwerkteam.de>2012-11-09 21:53:05 +0100
commit76687af8e8abfc8ef85708494728b15f5e1493b0 (patch)
tree78767ca115a70feab15efd9d623a5ef58a566674 /lightdm-remote-session-x2go.in
parentac2cd157d017ebc997ea846fc6272b20f1c06a31 (diff)
downloadlightdm-remote-session-x2go-76687af8e8abfc8ef85708494728b15f5e1493b0.tar.gz
lightdm-remote-session-x2go-76687af8e8abfc8ef85708494728b15f5e1493b0.tar.bz2
lightdm-remote-session-x2go-76687af8e8abfc8ef85708494728b15f5e1493b0.zip
more and more faking freerdp
Diffstat (limited to 'lightdm-remote-session-x2go.in')
-rw-r--r--lightdm-remote-session-x2go.in71
1 files changed, 0 insertions, 71 deletions
diff --git a/lightdm-remote-session-x2go.in b/lightdm-remote-session-x2go.in
deleted file mode 100644
index 9709a92..0000000
--- a/lightdm-remote-session-x2go.in
+++ /dev/null
@@ -1,71 +0,0 @@
-# vim:syntax=apparmor
-# Profile for restricting lightdm remote session for X2Go
-# Based on the Guest Account Apparmor script from:
-# Author: Martin Pitt <martin.pitt@ubuntu.com>
-
-#include <tunables/global>
-
-@libexecdir@/x2go-session-wrapper {
- #include <abstractions/authentication>
- #include <abstractions/nameservice>
- #include <abstractions/wutmp>
- /etc/compizconfig/config rw, # bug in compiz https://launchpad.net/bugs/697678
-
- / r,
- /bin/ rmix,
- /bin/fusermount Px,
- /bin/** rmix,
- /cdrom/ rmix,
- /cdrom/** rmix,
- /dev/ r,
- /dev/** rmw, # audio devices etc.
- owner /dev/shm/** rmw,
- /etc/ r,
- /etc/** rmk,
- /etc/gdm/Xsession ix,
- /lib/ r,
- /lib/** rmixk,
- /lib32/ r,
- /lib32/** rmixk,
- /lib64/ r,
- /lib64/** rmixk,
- owner /media/ r,
- owner /media/** rmwlixk, # we want access to USB sticks and the like
- /opt/ r,
- /opt/** rmixk,
- @{PROC}/ r,
- @{PROC}/* rm,
- @{PROC}/asound rm,
- @{PROC}/asound/** rm,
- @{PROC}/ati rm,
- @{PROC}/ati/** rm,
- owner @{PROC}/** rm,
- # needed for gnome-keyring-daemon
- @{PROC}/*/status r,
- /sbin/ r,
- /sbin/** rmixk,
- /sys/ r,
- /sys/** rm,
- /tmp/ rw,
- owner /tmp/** rwlkmix,
- /usr/ r,
- /usr/** rmixk,
- /var/ r,
- /var/** rmixk,
- /var/guest-data/** rw, # allow to store files permanently
- /var/tmp/ rw,
- owner /var/tmp/** rwlkm,
- /{,var/}run/ r,
- # necessary for writing to sockets, etc.
- /{,var/}run/** rmkix,
- /{,var/}run/shm/** wl,
-
- capability ipc_lock,
-
- # silence warnings for stuff that we really don't want to grant
- deny capability dac_override,
- deny capability dac_read_search,
- #deny /etc/** w, # re-enable once LP#697678 is fixed
- deny /usr/** w,
- deny /var/crash/ w,
-}