API tools faq
paste
Guest User

gradm

a guest
Sep 7th, 2013
292
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 141.87 KB | None | 0 0
raw download clone embed print report
  1. # policy generated from full system learning
  2.  
  3. define grsec_denied {
  4. /boot h
  5. /dev/grsec h
  6. /dev/kmem h
  7. /dev/mem h
  8. /dev/port h
  9. /etc/grsec h
  10. /proc/kcore h
  11. /proc/slabinfo h
  12. /proc/modules h
  13. /proc/kallsyms h
  14. /lib/modules hs
  15. /lib64/modules hs
  16. /etc/ssh h
  17. }
  18.  
  19. role admin sA
  20. subject / rvka
  21. / rwcdmlxi
  22.  
  23. role shutdown sARG
  24. subject / rvka
  25. /
  26. /dev
  27. /dev/urandom r
  28. /dev/random r
  29. /etc r
  30. /bin rx
  31. /sbin rx
  32. /lib rx
  33. /lib64 rx
  34. /usr rx
  35. /proc r
  36. $grsec_denied
  37. -CAP_ALL
  38. connect disabled
  39. bind disabled
  40.  
  41. role default
  42. subject /
  43. / h
  44. -CAP_ALL
  45. connect disabled
  46. bind disabled
  47.  
  48. role colord u
  49. role_allow_ip 0.0.0.0/32
  50. # Role: colord
  51. subject / {
  52. / h
  53. /usr/lib/colord/colord x
  54. -CAP_ALL
  55. bind disabled
  56. connect disabled
  57. }
  58.  
  59. # Role: colord
  60. subject /usr/lib/colord/colord o {
  61. / h
  62. /dev h
  63. /dev/console
  64. /dev/log rw
  65. /etc r
  66. /etc/grsec h
  67. /etc/gshadow h
  68. /etc/gshadow- h
  69. /etc/ppp h
  70. /etc/samba/smbpasswd h
  71. /etc/shadow h
  72. /etc/shadow- h
  73. /etc/ssh h
  74. /etc/udev h
  75. /etc/udev/udev.conf r
  76. /lib rx
  77. /lib/modules h
  78. /media h
  79. /media/colin
  80. /proc r
  81. /proc/bus h
  82. /proc/kallsyms h
  83. /proc/kcore h
  84. /proc/modules h
  85. /proc/mounts
  86. /proc/slabinfo h
  87. /proc/sys h
  88. /run h
  89. /run/dbus h
  90. /run/dbus/system_bus_socket rw
  91. /run/udev h
  92. /run/udev/data r
  93. /selinux
  94. /sys r
  95. /usr h
  96. /usr/lib rx
  97. /usr/share r
  98. /var h
  99. /var/lib/colord
  100. /var/lib/colord/mapping.db rw
  101. /var/lib/colord/storage.db rw
  102. -CAP_ALL
  103. bind disabled
  104. connect disabled
  105. sock_allow_family netlink
  106. }
  107.  
  108. role messagebus u
  109. role_allow_ip 0.0.0.0/32
  110. # Role: messagebus
  111. subject / {
  112. / h
  113. -CAP_ALL
  114. bind disabled
  115. connect disabled
  116. }
  117.  
  118. # Role: messagebus
  119. subject /bin/dbus-daemon o {
  120. / h
  121. /dev h
  122. /dev/log rw
  123. /etc h
  124. /etc/group r
  125. /etc/passwd r
  126. /run h
  127. /run/console h
  128. /run/console/colin
  129. /run/console/lightdm
  130. /run/console/root
  131. /run/dbus h
  132. /run/dbus/pid wd
  133. /run/dbus/system_bus_socket wd
  134. /usr h
  135. /usr/lib/dbus-1.0/dbus-daemon-launch-helper x
  136. /usr/share/dbus-1/system-services
  137. -CAP_ALL
  138. bind disabled
  139. connect disabled
  140. }
  141.  
  142. # Role: messagebus
  143. subject /usr/lib/dbus-1.0/dbus-daemon-launch-helper o {
  144. user_transition_allow root colord
  145. group_transition_allow root colord
  146.  
  147. / h
  148. /etc r
  149. /etc/dbus-1 h
  150. /etc/dbus-1/system.conf r
  151. /etc/grsec h
  152. /etc/gshadow h
  153. /etc/gshadow- h
  154. /etc/ppp h
  155. /etc/samba/smbpasswd h
  156. /etc/shadow h
  157. /etc/shadow- h
  158. /etc/ssh h
  159. /lib h
  160. /lib/x86_64-linux-gnu rx
  161. /proc h
  162. /proc/sys/kernel/ngroups_max r
  163. /usr h
  164. /usr/lib h
  165. /usr/lib/dbus-1.0/dbus-daemon-launch-helper x
  166. /usr/share r
  167. -CAP_ALL
  168. +CAP_SETGID
  169. +CAP_SETUID
  170. bind disabled
  171. connect disabled
  172. }
  173.  
  174. role rtkit u
  175. role_allow_ip 0.0.0.0/32
  176. # Role: rtkit
  177. subject / {
  178. / h
  179. -CAP_ALL
  180. bind disabled
  181. connect disabled
  182. }
  183.  
  184. # Role: rtkit
  185. subject /usr/lib/rtkit/rtkit-daemon o {
  186. / h
  187. -CAP_ALL
  188. +CAP_SYS_NICE
  189. bind disabled
  190. connect disabled
  191. }
  192.  
  193. role root uG
  194. role_transitions admin shutdown
  195. role_allow_ip 0.0.0.0/32
  196. # Role: root
  197. subject / {
  198. /
  199. /bin rx
  200. /boot h
  201. /dev
  202. /dev/grsec h
  203. /dev/kmem h
  204. /dev/mem h
  205. /dev/null rw
  206. /dev/port h
  207. /dev/tty rw
  208. /dev/urandom r
  209. /etc rx
  210. /etc/grsec h
  211. /etc/gshadow h
  212. /etc/gshadow- h
  213. /etc/ppp h
  214. /etc/samba/smbpasswd h
  215. /etc/shadow h
  216. /etc/shadow- h
  217. /etc/ssh h
  218. /home h
  219. /home/colin
  220. /home/colin/.Xauthority r
  221. /lib rx
  222. /lib/modules h
  223. /lib64/modules h
  224. /media h
  225. /media/colin/56E6F045E6F026C1
  226. /proc h
  227. /proc/filesystems r
  228. /proc/meminfo r
  229. /proc/sys/kernel/core_pattern r
  230. /run
  231. /run/network/ifstate r
  232. /run/resolvconf
  233. /run/resolvconf/interface
  234. /sbin rx
  235. /sys w
  236. /usr
  237. /usr/bin rx
  238. /usr/lib rx
  239. /usr/local h
  240. /usr/local/lib/python3.3/dist-packages
  241. /usr/local/sbin/dnscrypt-proxy x
  242. /usr/sbin rx
  243. /usr/share r
  244. /usr/src h
  245. /var h
  246. /var/lib/apt
  247. /var/lib/apt/lists r
  248. /var/lib/dpkg/arch r
  249. /var/lib/dpkg/status
  250. -CAP_ALL
  251. bind disabled
  252. connect disabled
  253. }
  254.  
  255. # Role: root
  256. subject /bin/bash o {
  257. / h
  258. /bin h
  259. /bin/bash x
  260. /bin/lesspipe x
  261. /dev h
  262. /dev/tty rw
  263. /etc r
  264. /etc/grsec h
  265. /etc/gshadow h
  266. /etc/gshadow- h
  267. /etc/ppp h
  268. /etc/samba/smbpasswd h
  269. /etc/shadow h
  270. /etc/shadow- h
  271. /etc/ssh h
  272. /home h
  273. /home/colin
  274. /lib rx
  275. /lib/modules h
  276. /proc h
  277. /proc/meminfo r
  278. /root h
  279. /root/.bash_history ra
  280. /root/.bashrc r
  281. /sbin h
  282. /sbin/gradm x
  283. /sbin/shutdown x
  284. /usr h
  285. /usr/bin x
  286. /usr/lib h
  287. /usr/lib/command-not-found x
  288. /usr/lib/locale/locale-archive r
  289. /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache r
  290. /usr/local h
  291. /usr/local/sbin/dnscrypt-proxy x
  292. /usr/sbin h
  293. /usr/sbin/aa-logprof x
  294. -CAP_ALL
  295. bind disabled
  296. connect disabled
  297. }
  298.  
  299. # Role: root
  300. subject /bin/cat o {
  301. / h
  302. /bin h
  303. /bin/cat x
  304. /etc r
  305. /etc/apparmor.d h
  306. /etc/apparmor.d/opt.google.chrome.chrome r
  307. /etc/apparmor.d/usr.bin.file-roller r
  308. /etc/apparmor.d/usr.bin.indicator-cpufreq r
  309. /etc/apparmor.d/usr.bin.vlc r
  310. /etc/grsec h
  311. /etc/gshadow h
  312. /etc/gshadow- h
  313. /etc/passwd h
  314. /etc/ppp h
  315. /etc/resolvconf h
  316. /etc/resolvconf/resolv.conf.d/head r
  317. /etc/samba/smbpasswd h
  318. /etc/shadow h
  319. /etc/shadow- h
  320. /etc/ssh h
  321. /lib h
  322. /lib/x86_64-linux-gnu/ld-2.17.so x
  323. /lib/x86_64-linux-gnu/libc-2.17.so rx
  324. /run h
  325. /run/pm-utils h
  326. /run/pm-utils/pm-powersave/storage/state:laptop_mode_default r
  327. /run/resolvconf r
  328. /run/resolvconf/interface h
  329. /run/resolvconf/interface/NetworkManager r
  330. /sys r
  331. /usr h
  332. /usr/lib/locale/locale-archive r
  333. -CAP_ALL
  334. bind disabled
  335. connect disabled
  336. }
  337.  
  338. # Role: root
  339. subject /bin/dash o {
  340. /
  341. /bin x
  342. /boot h
  343. /dev h
  344. /dev/null w
  345. /dev/tty7 w
  346. /etc h
  347. /etc/acpi/power.sh x
  348. /etc/default/rcS r
  349. /etc/init.d/rc x
  350. /etc/ld.so.cache r
  351. /home h
  352. /home/colin
  353. /lib h
  354. /lib/x86_64-linux-gnu/ld-2.17.so x
  355. /lib/x86_64-linux-gnu/libc-2.17.so rx
  356. /lib64/modules h
  357. /proc r
  358. /proc/bus h
  359. /proc/kallsyms h
  360. /proc/kcore h
  361. /proc/modules h
  362. /proc/mounts
  363. /proc/slabinfo h
  364. /proc/sys/fs/suid_dumpable w
  365. /proc/sys/kernel/core_pattern w
  366. /run h
  367. /run/dbus/system_bus_socket
  368. /sbin rx
  369. /usr h
  370. /usr/bin x
  371. /var h
  372. /var/lib/rfkill/saved-state w
  373. -CAP_ALL
  374. +CAP_SYS_ADMIN
  375. bind disabled
  376. connect disabled
  377. }
  378.  
  379. # Role: root
  380. subject /bin/dbus-daemon o {
  381. /
  382. /bin h
  383. /bin/dbus-daemon x
  384. /boot h
  385. /dev h
  386. /dev/null rw
  387. /dev/urandom r
  388. /etc r
  389. /etc/dbus-1 h
  390. /etc/dbus-1/session.conf r
  391. /etc/dbus-1/session.d
  392. /etc/grsec h
  393. /etc/gshadow h
  394. /etc/gshadow- h
  395. /etc/ppp h
  396. /etc/samba/smbpasswd h
  397. /etc/shadow h
  398. /etc/shadow- h
  399. /etc/ssh h
  400. /lib rx
  401. /lib/modules h
  402. /lib64/modules h
  403. /proc r
  404. /proc/bus h
  405. /proc/kallsyms h
  406. /proc/kcore h
  407. /proc/modules h
  408. /proc/slabinfo h
  409. /proc/sys h
  410. /run h
  411. /run/console/root
  412. /sys h
  413. /usr h
  414. /usr/lib/dconf/dconf-service x
  415. /usr/share/dbus-1/services r
  416. /var/backups h
  417. /var/log h
  418. -CAP_ALL
  419. +CAP_SYS_RESOURCE
  420. bind disabled
  421. connect disabled
  422. }
  423.  
  424. # Role: root
  425. subject /bin/fusermount o {
  426. / h
  427. /bin/mount x
  428. /bin/umount x
  429. /etc/mtab w
  430. -CAP_ALL
  431. +CAP_SETUID
  432. bind disabled
  433. connect disabled
  434. }
  435.  
  436. # Role: root
  437. subject /bin/grep o {
  438. / h
  439. /bin h
  440. /bin/grep x
  441. /etc h
  442. /etc/ld.so.cache r
  443. /lib h
  444. /lib/x86_64-linux-gnu/ld-2.17.so x
  445. /lib/x86_64-linux-gnu/libc-2.17.so rx
  446. /lib/x86_64-linux-gnu/libdl-2.17.so rx
  447. /proc h
  448. /proc/cmdline r
  449. /sys h
  450. /sys/power/state r
  451. -CAP_ALL
  452. bind disabled
  453. connect disabled
  454. }
  455.  
  456. # Role: root
  457. subject /bin/ip o {
  458. / h
  459. /bin h
  460. /bin/ip x
  461. /etc h
  462. /etc/iproute2/rt_scopes r
  463. /etc/ld.so.cache r
  464. /lib h
  465. /lib/x86_64-linux-gnu/ld-2.17.so x
  466. /lib/x86_64-linux-gnu/libc-2.17.so rx
  467. /lib/x86_64-linux-gnu/libdl-2.17.so rx
  468. -CAP_ALL
  469. +CAP_NET_ADMIN
  470. bind disabled
  471. connect disabled
  472. sock_allow_family netlink
  473. }
  474.  
  475. # Role: root
  476. subject /bin/kmod o {
  477. / h
  478. /bin h
  479. /bin/kmod x
  480. /etc r
  481. /etc/grsec h
  482. /etc/gshadow h
  483. /etc/gshadow- h
  484. /etc/passwd h
  485. /etc/ppp h
  486. /etc/samba/smbpasswd h
  487. /etc/shadow h
  488. /etc/shadow- h
  489. /etc/ssh h
  490. /lib rx
  491. /proc h
  492. /proc/cmdline r
  493. -CAP_ALL
  494. +CAP_SYS_MODULE
  495. bind disabled
  496. connect disabled
  497. }
  498.  
  499. # Role: root
  500. subject /bin/mkdir o {
  501. / h
  502. /bin h
  503. /bin/mkdir x
  504. /etc h
  505. /etc/ld.so.cache r
  506. /lib rx
  507. /lib/modules h
  508. /proc h
  509. /proc/filesystems r
  510. /run wc
  511. /run/pm-utils
  512. /run/pm-utils/pm-powersave
  513. /selinux
  514. /var
  515. /var/backups h
  516. /var/lib
  517. /var/log h
  518. -CAP_ALL
  519. bind disabled
  520. connect disabled
  521. }
  522.  
  523. # Role: root
  524. subject /bin/mount o {
  525. user_transition_allow root
  526. group_transition_allow root
  527.  
  528. / h
  529. /bin h
  530. /bin/mount x
  531. /bin/ntfs-3g x
  532. /dev
  533. /dev/grsec h
  534. /dev/kmem h
  535. /dev/log h
  536. /dev/mem h
  537. /dev/null rw
  538. /dev/port h
  539. /etc rwcd
  540. /etc/grsec h
  541. /etc/gshadow h
  542. /etc/gshadow- h
  543. /etc/passwd h
  544. /etc/ppp h
  545. /etc/samba/smbpasswd h
  546. /etc/shadow h
  547. /etc/shadow- h
  548. /etc/ssh h
  549. /lib h
  550. /lib/x86_64-linux-gnu rx
  551. /proc h
  552. /proc/filesystems r
  553. /selinux
  554. /usr h
  555. /usr/lib/locale/locale-archive r
  556. -CAP_ALL
  557. +CAP_CHOWN
  558. +CAP_SETGID
  559. +CAP_SETUID
  560. bind disabled
  561. connect disabled
  562. }
  563.  
  564. # Role: root
  565. subject /bin/mv o {
  566. / h
  567. /bin h
  568. /bin/mv x
  569. /etc h
  570. /etc/ld.so.cache r
  571. /lib h
  572. /lib/x86_64-linux-gnu rx
  573. /proc h
  574. /proc/filesystems r
  575. /run h
  576. /run/resolvconf rwcd
  577. /selinux
  578. /usr h
  579. /usr/lib/locale/locale-archive r
  580. -CAP_ALL
  581. bind disabled
  582. connect disabled
  583. }
  584.  
  585. # Role: root
  586. subject /bin/ntfs-3g o {
  587. user_transition_allow root
  588.  
  589. /
  590. /bin h
  591. /bin/mount x
  592. /bin/ntfs-3g x
  593. /bin/umount x
  594. /boot h
  595. /dev
  596. /dev/fuse rw
  597. /dev/grsec h
  598. /dev/kmem h
  599. /dev/log rw
  600. /dev/mem h
  601. /dev/null rw
  602. /dev/port h
  603. /dev/sda2 rw
  604. /etc h
  605. /etc/ld.so.cache r
  606. /etc/localtime r
  607. /etc/mtab rw
  608. /lib h
  609. /lib/x86_64-linux-gnu rx
  610. /lib64/modules h
  611. /media
  612. /media/colin
  613. /proc
  614. /proc/bus h
  615. /proc/filesystems r
  616. /proc/kallsyms h
  617. /proc/kcore h
  618. /proc/modules h
  619. /proc/slabinfo h
  620. /proc/sys h
  621. /sys h
  622. /usr/src h
  623. /var/backups h
  624. /var/log h
  625. -CAP_ALL
  626. +CAP_SETUID
  627. +CAP_SYS_ADMIN
  628. bind disabled
  629. connect disabled
  630. }
  631.  
  632. # Role: root
  633. subject /bin/plymouth o {
  634. / h
  635. /bin h
  636. /bin/plymouth x
  637. /etc h
  638. /etc/ld.so.cache r
  639. /lib h
  640. /lib/x86_64-linux-gnu rx
  641. /proc h
  642. /proc/cmdline r
  643. -CAP_ALL
  644. bind disabled
  645. connect disabled
  646. }
  647.  
  648. # Role: root
  649. subject /bin/plymouth-upstart-bridge o {
  650. / h
  651. /bin h
  652. /bin/plymouth-upstart-bridge x
  653. /etc h
  654. /etc/ld.so.cache r
  655. /etc/terminfo
  656. /lib rx
  657. /lib/modules h
  658. -CAP_ALL
  659. +CAP_SYS_TTY_CONFIG
  660. bind disabled
  661. connect disabled
  662. }
  663.  
  664. # Role: root
  665. subject /bin/rm o {
  666. /
  667. /bin h
  668. /bin/rm x
  669. /boot h
  670. /dev/grsec h
  671. /dev/kmem h
  672. /dev/log h
  673. /dev/mem h
  674. /dev/port h
  675. /etc h
  676. /etc/ld.so.cache r
  677. /lib h
  678. /lib/x86_64-linux-gnu/ld-2.17.so x
  679. /lib/x86_64-linux-gnu/libc-2.17.so rx
  680. /lib64/modules h
  681. /proc/bus h
  682. /proc/kallsyms h
  683. /proc/kcore h
  684. /proc/modules h
  685. /proc/slabinfo h
  686. /proc/sys h
  687. /run wd
  688. /sys h
  689. /usr h
  690. /usr/lib/locale/locale-archive r
  691. /var/backups h
  692. /var/log h
  693. -CAP_ALL
  694. +CAP_DAC_OVERRIDE
  695. +CAP_DAC_READ_SEARCH
  696. bind disabled
  697. connect disabled
  698. }
  699.  
  700. # Role: root
  701. subject /bin/sed o {
  702. / h
  703. /bin h
  704. /bin/sed x
  705. /etc h
  706. /etc/ld.so.cache r
  707. /etc/resolvconf/interface-order r
  708. /etc/resolvconf/resolv.conf.d/base r
  709. /lib rx
  710. /lib/modules h
  711. /proc h
  712. /proc/filesystems r
  713. /run rwcd
  714. /selinux
  715. /usr h
  716. /usr/lib/locale/locale-archive r
  717. /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache r
  718. -CAP_ALL
  719. bind disabled
  720. connect disabled
  721. }
  722.  
  723. # Role: root
  724. subject /bin/setfont o {
  725. / h
  726. /bin h
  727. /bin/setfont x
  728. /dev h
  729. /dev/tty1 rw
  730. /dev/tty2 rw
  731. /dev/tty3 rw
  732. /dev/tty4 rw
  733. /dev/tty5 rw
  734. /dev/tty6 rw
  735. /etc h
  736. /etc/console-setup/Uni2-Fixed16.psf r
  737. /etc/ld.so.cache r
  738. /lib h
  739. /lib/x86_64-linux-gnu/ld-2.17.so x
  740. /lib/x86_64-linux-gnu/libc-2.17.so rx
  741. -CAP_ALL
  742. +CAP_SYS_TTY_CONFIG
  743. bind disabled
  744. connect disabled
  745. }
  746.  
  747. # Role: root
  748. subject /bin/su o {
  749. user_transition_allow root
  750. group_transition_allow root
  751.  
  752. / h
  753. /bin h
  754. /bin/bash x
  755. /bin/su x
  756. /dev h
  757. /dev/log rw
  758. /dev/pts
  759. /etc r
  760. /etc/grsec h
  761. /etc/gshadow h
  762. /etc/gshadow- h
  763. /etc/ppp h
  764. /etc/samba/smbpasswd h
  765. /etc/shadow- h
  766. /etc/ssh h
  767. /lib rx
  768. /lib/modules h
  769. /proc r
  770. /proc/bus h
  771. /proc/kallsyms h
  772. /proc/kcore h
  773. /proc/modules h
  774. /proc/slabinfo h
  775. /run h
  776. /run/dbus/system_bus_socket rw
  777. /run/user
  778. /run/user/.root.lock rw
  779. /run/user/root w
  780. /run/utmp r
  781. /selinux
  782. /usr h
  783. /usr/lib/locale/locale-archive r
  784. /usr/lib/x86_64-linux-gnu/libck-connector.so.0.0.0 rx
  785. -CAP_ALL
  786. +CAP_SETGID
  787. +CAP_SETUID
  788. +CAP_AUDIT_WRITE
  789. bind disabled
  790. connect disabled
  791. sock_allow_family netlink
  792. }
  793.  
  794. # Role: root
  795. subject /bin/touch o {
  796. / h
  797. /bin h
  798. /bin/touch x
  799. /etc h
  800. /etc/ld.so.cache r
  801. /lib rx
  802. /lib/modules h
  803. /run h
  804. /run/pm-utils/locks/pm-powersave.lock wc
  805. /usr h
  806. /usr/lib/locale/locale-archive r
  807. /var h
  808. /var/lib/apt/periodic/update-success-stamp w
  809. -CAP_ALL
  810. bind disabled
  811. connect disabled
  812. }
  813.  
  814. # Role: root
  815. subject /bin/umount o {
  816. / h
  817. /bin h
  818. /bin/umount x
  819. /etc rwcd
  820. /etc/grsec h
  821. /etc/gshadow h
  822. /etc/gshadow- h
  823. /etc/passwd h
  824. /etc/ppp h
  825. /etc/samba/smbpasswd h
  826. /etc/shadow h
  827. /etc/shadow- h
  828. /etc/ssh h
  829. /lib h
  830. /lib/x86_64-linux-gnu rx
  831. /media
  832. /media/colin
  833. /proc h
  834. /proc/filesystems r
  835. /selinux
  836. /usr h
  837. /usr/lib/locale/locale-archive r
  838. -CAP_ALL
  839. +CAP_CHOWN
  840. +CAP_SYS_ADMIN
  841. bind disabled
  842. connect disabled
  843. }
  844.  
  845. # Role: root
  846. subject /etc/init.d o {
  847. user_transition_allow root
  848.  
  849. /
  850. /bin xi
  851. /boot h
  852. /dev
  853. /dev/.blkid.tab rwcdl
  854. /dev/.blkid.tab-7U46zp rwcd
  855. /dev/.blkid.tab-ExNCpP rwcd
  856. /dev/.blkid.tab-IsbHBM rwcd
  857. /dev/.blkid.tab-OA7UvQ rwcd
  858. /dev/.blkid.tab-T83LdD rwcd
  859. /dev/.blkid.tab-WdkLZL rwcd
  860. /dev/.blkid.tab.old wd
  861. /dev/disk
  862. /dev/disk/by-uuid
  863. /dev/grsec h
  864. /dev/kmem h
  865. /dev/log h
  866. /dev/mem h
  867. /dev/null rw
  868. /dev/port h
  869. /dev/sda1 r
  870. /dev/sda2 r
  871. /dev/sda5 r
  872. /dev/sda6 r
  873. /dev/sda7 r
  874. /dev/shm wcd
  875. /dev/sr0 r
  876. /dev/urandom r
  877. /etc rwcd
  878. /etc/apt h
  879. /etc/apt/apt.conf.d r
  880. /etc/default h
  881. /etc/default/kerneloops r
  882. /etc/default/rcS r
  883. /etc/default/speech-dispatcher r
  884. /etc/grsec h
  885. /etc/gshadow h
  886. /etc/gshadow- h
  887. /etc/init.d rxi
  888. /etc/ppp h
  889. /etc/python3.3 h
  890. /etc/python3.3/sitecustomize.py
  891. /etc/samba/smbpasswd h
  892. /etc/shadow h
  893. /etc/shadow- h
  894. /etc/ssh h
  895. /lib rxi
  896. /lib/modules h
  897. /lib64 h
  898. /lib64/ld-linux-x86-64.so.2
  899. /proc r
  900. /proc/bus h
  901. /proc/kallsyms h
  902. /proc/kcore h
  903. /proc/modules h
  904. /proc/slabinfo h
  905. /run rwc
  906. /run/sendsigs.omit.d
  907. /run/sendsigs.omit.d/network-manager.dhclient-wlan0.pid r
  908. /run/sendsigs.omit.d/wpasupplicant.pid r
  909. /sbin xi
  910. /sys r
  911. /sys/dev h
  912. /sys/dev/block/8:5
  913. /sys/dev/block/8:6
  914. /sys/devices r
  915. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda5
  916. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda6
  917. /sys/devices/system/cpu r
  918. /sys/devices/system/cpu/cpu0 h
  919. /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors r
  920. /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor w
  921. /sys/devices/system/cpu/cpu1 h
  922. /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor w
  923. /sys/devices/system/cpu/cpu2 h
  924. /sys/devices/system/cpu/cpu2/cpufreq/scaling_governor w
  925. /sys/devices/system/cpu/cpu3 h
  926. /sys/devices/system/cpu/cpu3/cpufreq/scaling_governor w
  927. /usr
  928. /usr/bin xi
  929. /usr/lib rxi
  930. /usr/local h
  931. /usr/local/lib/python3.3/dist-packages
  932. /usr/sbin h
  933. /usr/sbin/kerneloops
  934. /usr/share
  935. /usr/share/unattended-upgrades
  936. /usr/share/unattended-upgrades/unattended-upgrade-shutdown r
  937. /usr/src h
  938. /var
  939. /var/backups h
  940. /var/lib h
  941. /var/lib/apt
  942. /var/lib/urandom/random-seed w
  943. /var/lock wcd
  944. /var/log h
  945. /var/log/unattended-upgrades
  946. /var/log/unattended-upgrades/unattended-upgrades-shutdown.log a
  947. /var/run wcd
  948. -CAP_ALL
  949. +CAP_DAC_READ_SEARCH
  950. +CAP_KILL
  951. +CAP_SETUID
  952. +CAP_IPC_LOCK
  953. +CAP_SYS_ADMIN
  954. +CAP_SYS_TTY_CONFIG
  955. bind disabled
  956. connect disabled
  957. }
  958.  
  959. # Role: root
  960. subject /etc/network/if-up.d/upstart o {
  961. /
  962. /bin h
  963. /bin/dash x
  964. /bin/mkdir x
  965. /boot h
  966. /dev h
  967. /dev/null w
  968. /etc h
  969. /etc/ld.so.cache r
  970. /etc/lsb-base-logging.sh r
  971. /etc/network/if-up.d/upstart r
  972. /lib h
  973. /lib/lsb/init-functions r
  974. /lib/x86_64-linux-gnu/ld-2.17.so x
  975. /lib/x86_64-linux-gnu/libc-2.17.so rx
  976. /lib64/modules h
  977. /proc/bus h
  978. /proc/kallsyms h
  979. /proc/kcore h
  980. /proc/modules h
  981. /proc/slabinfo h
  982. /proc/sys h
  983. /run h
  984. /run/network/ifup.lo
  985. /run/network/ifup.wlan0 wc
  986. /sbin h
  987. /sbin/ifquery x
  988. /sbin/initctl x
  989. /sys h
  990. /usr/src h
  991. /var/backups h
  992. /var/log h
  993. -CAP_ALL
  994. bind disabled
  995. connect disabled
  996. }
  997.  
  998. # Role: root
  999. subject /etc/resolvconf/update.d/libc o {
  1000. / h
  1001. /bin x
  1002. /dev h
  1003. /dev/null w
  1004. /etc h
  1005. /etc/ld.so.cache r
  1006. /etc/resolv.conf
  1007. /etc/resolvconf h
  1008. /etc/resolvconf/resolv.conf.d/base
  1009. /etc/resolvconf/resolv.conf.d/head
  1010. /etc/resolvconf/update.d/libc r
  1011. /lib h
  1012. /lib/resolvconf/list-records x
  1013. /lib/x86_64-linux-gnu/ld-2.17.so x
  1014. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1015. /run h
  1016. /run/resolvconf wc
  1017. -CAP_ALL
  1018. bind disabled
  1019. connect disabled
  1020. }
  1021.  
  1022. # Role: root
  1023. subject /lib/systemd/systemd-hostnamed o {
  1024. /
  1025. /boot h
  1026. /dev h
  1027. /dev/kmsg w
  1028. /etc h
  1029. /etc/hostname r
  1030. /etc/ld.so.cache r
  1031. /lib x
  1032. /lib/modules h
  1033. /lib/x86_64-linux-gnu rx
  1034. /lib64/modules h
  1035. /proc r
  1036. /proc/bus h
  1037. /proc/kallsyms h
  1038. /proc/kcore h
  1039. /proc/modules h
  1040. /proc/slabinfo h
  1041. /proc/sys h
  1042. /run h
  1043. /run/dbus/system_bus_socket rw
  1044. /sys h
  1045. /sys/devices/virtual/dmi/id/bios_vendor r
  1046. /sys/devices/virtual/dmi/id/board_vendor r
  1047. /sys/devices/virtual/dmi/id/sys_vendor r
  1048. /sys/firmware/acpi/pm_profile r
  1049. /usr h
  1050. /usr/lib
  1051. /var/backups h
  1052. /var/log h
  1053. -CAP_ALL
  1054. bind disabled
  1055. connect disabled
  1056. }
  1057.  
  1058. # Role: root
  1059. subject /lib/udev/udev-acl o {
  1060. / h
  1061. /dev h
  1062. /dev/dri h
  1063. /dev/dri/card0 w
  1064. /dev/rfkill w
  1065. /dev/sg1 w
  1066. /dev/snd w
  1067. /dev/sr0 w
  1068. /dev/video0 w
  1069. /etc h
  1070. /etc/ld.so.cache r
  1071. /etc/locale.alias r
  1072. /etc/udev/udev.conf r
  1073. /lib rx
  1074. /lib/modules h
  1075. /run r
  1076. /run/udev
  1077. /run/udev/data r
  1078. /run/udev/tags h
  1079. /run/udev/tags/udev-acl
  1080. /sys r
  1081. -CAP_ALL
  1082. bind disabled
  1083. connect disabled
  1084. }
  1085.  
  1086. # Role: root
  1087. subject /lib/udev/udisks-part-id o {
  1088. / h
  1089. /dev h
  1090. /dev/mem r
  1091. /dev/sda r
  1092. /dev/sda2
  1093. /etc h
  1094. /etc/ld.so.cache r
  1095. /etc/udev/udev.conf r
  1096. /lib rx
  1097. /lib/modules h
  1098. /proc h
  1099. /proc/filesystems r
  1100. /selinux
  1101. /sys
  1102. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda
  1103. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2 r
  1104. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/uevent r
  1105. /usr h
  1106. /usr/lib
  1107. /usr/lib/x86_64-linux-gnu
  1108. /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache r
  1109. -CAP_ALL
  1110. +CAP_SYS_RAWIO
  1111. bind disabled
  1112. connect disabled
  1113. }
  1114.  
  1115. # Role: root
  1116. subject /sbin/apparmor_parser o {
  1117. / h
  1118. /etc r
  1119. /etc/grsec h
  1120. /etc/gshadow h
  1121. /etc/gshadow- h
  1122. /etc/passwd h
  1123. /etc/ppp h
  1124. /etc/samba/smbpasswd h
  1125. /etc/shadow h
  1126. /etc/shadow- h
  1127. /etc/ssh h
  1128. /lib h
  1129. /lib/x86_64-linux-gnu/ld-2.17.so x
  1130. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1131. /proc r
  1132. /proc/bus h
  1133. /proc/kallsyms h
  1134. /proc/kcore h
  1135. /proc/modules h
  1136. /proc/mounts
  1137. /proc/slabinfo h
  1138. /sbin h
  1139. /sbin/apparmor_parser rx
  1140. /sys r
  1141. /sys/kernel/security/apparmor w
  1142. /sys/kernel/security/apparmor/features r
  1143. /sys/kernel/security/apparmor/features/file
  1144. /sys/kernel/security/apparmor/features/file/mask r
  1145. /sys/kernel/security/apparmor/features/rlimit
  1146. /sys/kernel/security/apparmor/features/rlimit/mask r
  1147. /usr h
  1148. /usr/lib/locale/locale-archive r
  1149. -CAP_ALL
  1150. +CAP_MAC_ADMIN
  1151. bind disabled
  1152. connect disabled
  1153. }
  1154.  
  1155. # Role: root
  1156. subject /sbin/blkid o {
  1157. / h
  1158. /dev h
  1159. /dev/sda r
  1160. /dev/sda2 r
  1161. /etc h
  1162. /etc/ld.so.cache r
  1163. /lib rx
  1164. /lib/modules h
  1165. /sbin h
  1166. /sbin/blkid x
  1167. /sys
  1168. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda
  1169. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/dev r
  1170. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2
  1171. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2/size r
  1172. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2/start r
  1173. -CAP_ALL
  1174. bind disabled
  1175. connect disabled
  1176. }
  1177.  
  1178. # Role: root
  1179. subject /sbin/crda o {
  1180. / h
  1181. /etc h
  1182. /etc/ld.so.cache r
  1183. /lib rx
  1184. /lib/modules h
  1185. /proc r
  1186. /proc/bus h
  1187. /proc/kallsyms h
  1188. /proc/kcore h
  1189. /proc/modules h
  1190. /proc/slabinfo h
  1191. /proc/sys h
  1192. /sbin h
  1193. /sbin/crda x
  1194. -CAP_ALL
  1195. +CAP_NET_ADMIN
  1196. bind disabled
  1197. connect disabled
  1198. sock_allow_family netlink
  1199. }
  1200.  
  1201. # Role: root
  1202. subject /sbin/dhclient o {
  1203. / h
  1204. /dev h
  1205. /dev/log rw
  1206. /dev/null rw
  1207. /etc h
  1208. /etc/ld.so.cache r
  1209. /etc/localtime r
  1210. /etc/nsswitch.conf r
  1211. /etc/services r
  1212. /lib
  1213. /lib/modules h
  1214. /lib/x86_64-linux-gnu
  1215. /lib/x86_64-linux-gnu/ld-2.17.so x
  1216. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1217. /lib/x86_64-linux-gnu/libnss_files-2.17.so rx
  1218. /proc r
  1219. /proc/bus h
  1220. /proc/kallsyms h
  1221. /proc/kcore h
  1222. /proc/modules h
  1223. /proc/slabinfo h
  1224. /proc/sys h
  1225. /run h
  1226. /run/sendsigs.omit.d/network-manager.dhclient-wlan0.pid wc
  1227. /sbin h
  1228. /sbin/dhclient x
  1229. /usr h
  1230. /usr/lib
  1231. /usr/lib/NetworkManager/nm-dhcp-client.action x
  1232. /var h
  1233. /var/lib/NetworkManager/dhclient-f6051dd0-793b-44b9-b880-f96639be1617-wlan0.lease rw
  1234. /var/lib/NetworkManager/dhclient-wlan0.conf r
  1235. -CAP_ALL
  1236. +CAP_NET_BIND_SERVICE
  1237. +CAP_NET_RAW
  1238. bind 0.0.0.0/32:1024-65535 dgram udp
  1239. bind 0.0.0.0/32:68 dgram udp
  1240. connect disabled
  1241. sock_allow_family ipv6 netlink
  1242. }
  1243.  
  1244. # Role: root
  1245. subject /sbin/getty o {
  1246. / h
  1247. /dev h
  1248. /dev/tty1 rw
  1249. /etc h
  1250. /etc/group r
  1251. /etc/issue r
  1252. /etc/ld.so.cache r
  1253. /etc/locale.alias r
  1254. /etc/nsswitch.conf r
  1255. /lib h
  1256. /lib/x86_64-linux-gnu rx
  1257. /run h
  1258. /run/utmp rw
  1259. /sbin h
  1260. /sbin/getty x
  1261. /usr h
  1262. /usr/lib/locale/C.UTF-8/LC_CTYPE r
  1263. /usr/lib/locale/locale-archive r
  1264. /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache r
  1265. -CAP_ALL
  1266. +CAP_FSETID
  1267. +CAP_SYS_TTY_CONFIG
  1268. bind disabled
  1269. connect disabled
  1270. }
  1271.  
  1272. # Role: root
  1273. subject /sbin/hdparm o {
  1274. / h
  1275. /dev h
  1276. /dev/sda r
  1277. /etc h
  1278. /etc/ld.so.cache r
  1279. /lib h
  1280. /lib/x86_64-linux-gnu/ld-2.17.so x
  1281. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1282. /sbin h
  1283. /sbin/hdparm x
  1284. -CAP_ALL
  1285. +CAP_SYS_RAWIO
  1286. bind disabled
  1287. connect disabled
  1288. }
  1289.  
  1290. # Role: root
  1291. subject /sbin/hwclock o {
  1292. / h
  1293. /dev h
  1294. /dev/rtc0 r
  1295. /etc h
  1296. /etc/ld.so.cache r
  1297. /etc/localtime r
  1298. /lib h
  1299. /lib/x86_64-linux-gnu/ld-2.17.so x
  1300. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1301. /sbin h
  1302. /sbin/hwclock x
  1303. -CAP_ALL
  1304. +CAP_SYS_TIME
  1305. bind disabled
  1306. connect disabled
  1307. }
  1308.  
  1309. # Role: root
  1310. subject /sbin/ifdown o {
  1311. / h
  1312. /bin h
  1313. /bin/dash x
  1314. /etc h
  1315. /etc/ld.so.cache r
  1316. /etc/network/interfaces r
  1317. /lib h
  1318. /lib/x86_64-linux-gnu/ld-2.17.so x
  1319. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1320. /run h
  1321. /run/network/ifstate ra
  1322. /sbin h
  1323. /sbin/ifdown x
  1324. -CAP_ALL
  1325. bind disabled
  1326. connect disabled
  1327. }
  1328.  
  1329. # Role: root
  1330. subject /sbin/init o {
  1331. /
  1332. /bin rx
  1333. /boot h
  1334. /dev h
  1335. /dev/console rw
  1336. /dev/kmsg w
  1337. /dev/null rw
  1338. /dev/ptmx rw
  1339. /dev/pts rw
  1340. /etc h
  1341. /etc/group r
  1342. /etc/passwd r
  1343. /lib h
  1344. /lib/udev/console-setup-tty x
  1345. /lib64/modules h
  1346. /proc
  1347. /proc/bus h
  1348. /proc/kallsyms h
  1349. /proc/kcore h
  1350. /proc/modules h
  1351. /proc/slabinfo h
  1352. /proc/sys/kernel/ngroups_max r
  1353. /run h
  1354. /run/utmp rw
  1355. /sbin h
  1356. /sbin/getty x
  1357. /sbin/setvtrgb x
  1358. /sys h
  1359. /usr h
  1360. /usr/sbin/alsactl x
  1361. /usr/sbin/anacron rx
  1362. /var/backups h
  1363. /var/log h
  1364. -CAP_ALL
  1365. +CAP_KILL
  1366. +CAP_SETGID
  1367. bind disabled
  1368. connect disabled
  1369. }
  1370.  
  1371. # Role: root
  1372. subject /sbin/iwconfig o {
  1373. / h
  1374. /etc h
  1375. /etc/ld.so.cache r
  1376. /lib rx
  1377. /lib/modules h
  1378. /sbin h
  1379. /sbin/iwconfig x
  1380. -CAP_ALL
  1381. +CAP_NET_ADMIN
  1382. bind 0.0.0.0/32:0 dgram ip
  1383. connect disabled
  1384. }
  1385.  
  1386. # Role: root
  1387. subject /sbin/killall5 o {
  1388. / h
  1389. /bin
  1390. /etc h
  1391. /etc/ld.so.cache r
  1392. /lib h
  1393. /lib/systemd/systemd-hostnamed
  1394. /lib/x86_64-linux-gnu/ld-2.17.so x
  1395. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1396. /proc r
  1397. /proc/bus h
  1398. /proc/kallsyms h
  1399. /proc/kcore h
  1400. /proc/modules h
  1401. /proc/slabinfo h
  1402. /proc/sys h
  1403. /sbin x
  1404. /usr h
  1405. /usr/bin h
  1406. /usr/bin/Xorg
  1407. /usr/bin/dbus-launch
  1408. /usr/lib
  1409. /usr/sbin
  1410. -CAP_ALL
  1411. +CAP_DAC_READ_SEARCH
  1412. bind disabled
  1413. connect disabled
  1414. }
  1415.  
  1416. # Role: root
  1417. subject /sbin/plymouthd o {
  1418. /
  1419. /boot h
  1420. /dev h
  1421. /dev/dri
  1422. /dev/dri/card0 rw
  1423. /dev/tty7 rw
  1424. /etc r
  1425. /etc/grsec h
  1426. /etc/gshadow h
  1427. /etc/gshadow- h
  1428. /etc/ppp h
  1429. /etc/samba/smbpasswd h
  1430. /etc/shadow h
  1431. /etc/shadow- h
  1432. /etc/ssh h
  1433. /lib rx
  1434. /lib/modules h
  1435. /lib64/modules h
  1436. /proc h
  1437. /proc/cmdline r
  1438. /run h
  1439. /run/plymouth
  1440. /sbin h
  1441. /sbin/plymouthd x
  1442. /sys h
  1443. /sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/driver
  1444. /sys/devices/virtual/tty/console/active r
  1445. /usr h
  1446. /usr/lib rx
  1447. /usr/local h
  1448. /usr/local/share/fonts
  1449. /usr/share r
  1450. /var h
  1451. /var/cache h
  1452. /var/cache/fontconfig r
  1453. /var/lib h
  1454. /var/lib/plymouth/boot-duration w
  1455. -CAP_ALL
  1456. +CAP_SYS_ADMIN
  1457. +CAP_SYS_TTY_CONFIG
  1458. bind disabled
  1459. connect disabled
  1460. }
  1461.  
  1462. # Role: root
  1463. subject /sbin/resolvconf o {
  1464. /
  1465. /bin x
  1466. /boot h
  1467. /dev/grsec h
  1468. /dev/kmem h
  1469. /dev/log h
  1470. /dev/mem h
  1471. /dev/port h
  1472. /etc h
  1473. /etc/ld.so.cache r
  1474. /etc/nsswitch.conf r
  1475. /etc/passwd r
  1476. /lib h
  1477. /lib/x86_64-linux-gnu rx
  1478. /lib64/modules h
  1479. /proc/bus h
  1480. /proc/kallsyms h
  1481. /proc/kcore h
  1482. /proc/modules h
  1483. /proc/slabinfo h
  1484. /proc/sys h
  1485. /run h
  1486. /run/resolvconf/enable-updates
  1487. /run/resolvconf/interface
  1488. /run/resolvconf/interface/NetworkManager_new.1730 wc
  1489. /run/resolvconf/interface/NetworkManager_new.1734 wc
  1490. /run/resolvconf/interface/NetworkManager_new.1742 wc
  1491. /run/resolvconf/interface/NetworkManager_new.1753 wc
  1492. /sbin h
  1493. /sbin/resolvconf r
  1494. /sys h
  1495. /usr/src h
  1496. /var/backups h
  1497. /var/log h
  1498. -CAP_ALL
  1499. bind disabled
  1500. connect disabled
  1501. }
  1502.  
  1503. # Role: root
  1504. subject /sbin/setvtrgb o {
  1505. / h
  1506. /dev h
  1507. /dev/null rw
  1508. /dev/tty rw
  1509. /dev/tty0 rw
  1510. /etc h
  1511. /etc/console-setup/vtrgb r
  1512. /etc/ld.so.cache r
  1513. /lib h
  1514. /lib/x86_64-linux-gnu/ld-2.17.so x
  1515. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1516. /proc
  1517. /proc/bus h
  1518. /proc/kallsyms h
  1519. /proc/kcore h
  1520. /proc/modules h
  1521. /proc/slabinfo h
  1522. /proc/sys h
  1523. /sbin h
  1524. /sbin/setvtrgb x
  1525. -CAP_ALL
  1526. +CAP_SYS_TTY_CONFIG
  1527. bind disabled
  1528. connect disabled
  1529. }
  1530.  
  1531. # Role: root
  1532. subject /sbin/shutdown o {
  1533. user_transition_allow root
  1534.  
  1535. /
  1536. /boot h
  1537. /dev h
  1538. /dev/pts w
  1539. /dev/tty7 w
  1540. /etc h
  1541. /etc/ld.so.cache r
  1542. /etc/locale.alias r
  1543. /etc/localtime r
  1544. /etc/nsswitch.conf r
  1545. /etc/passwd r
  1546. /lib rx
  1547. /lib/modules h
  1548. /lib64/modules h
  1549. /proc r
  1550. /proc/bus h
  1551. /proc/kallsyms h
  1552. /proc/kcore h
  1553. /proc/modules h
  1554. /proc/slabinfo h
  1555. /proc/sys h
  1556. /run h
  1557. /run/utmp rw
  1558. /sbin h
  1559. /sbin/shutdown x
  1560. /sys h
  1561. /usr h
  1562. /usr/lib/locale/locale-archive r
  1563. /var/backups h
  1564. /var/log h
  1565. -CAP_ALL
  1566. +CAP_DAC_OVERRIDE
  1567. +CAP_SETUID
  1568. +CAP_SYS_TTY_CONFIG
  1569. bind disabled
  1570. connect disabled
  1571. }
  1572.  
  1573. # Role: root
  1574. subject /sbin/udevadm o {
  1575. / h
  1576. /dev h
  1577. /dev/sda
  1578. /etc h
  1579. /etc/ld.so.cache r
  1580. /etc/udev/udev.conf r
  1581. /lib h
  1582. /lib/x86_64-linux-gnu rx
  1583. /proc h
  1584. /proc/filesystems r
  1585. /run h
  1586. /run/udev
  1587. /run/udev/data/b8:0 r
  1588. /sbin h
  1589. /sbin/udevadm x
  1590. /selinux
  1591. /sys h
  1592. /sys/dev/block/8:0
  1593. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/subsystem
  1594. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/uevent r
  1595. -CAP_ALL
  1596. bind disabled
  1597. connect disabled
  1598. }
  1599.  
  1600. # Role: root
  1601. subject /sbin/udevd o {
  1602. / h
  1603. /bin h
  1604. /bin/kmod x
  1605. /dev h
  1606. /dev/block h
  1607. /dev/block/8:2 w
  1608. /dev/disk h
  1609. /dev/disk/by-id h
  1610. /dev/disk/by-id/ata-SAMSUNG_SSD_830_Series_S0XYNEAC406308-part2 w
  1611. /dev/disk/by-id/scsi-SATA_SAMSUNG_SSD_830S0XYNEAC406308-part2 w
  1612. /dev/disk/by-id/wwn-0x5002538043584d30-part2 w
  1613. /dev/disk/by-path h
  1614. /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0-part2 w
  1615. /dev/disk/by-uuid h
  1616. /dev/disk/by-uuid/56E6F045E6F026C1 w
  1617. /dev/null rw
  1618. /dev/sda2 w
  1619. /lib h
  1620. /lib/udev/udisks-part-id x
  1621. /run r
  1622. /run/udev rwcd
  1623. /run/udev/watch
  1624. /run/udev/watch/56 wd
  1625. /run/udev/watch/59 wc
  1626. /sbin h
  1627. /sbin/blkid x
  1628. /sbin/crda x
  1629. /sys rw
  1630. -CAP_ALL
  1631. +CAP_DAC_OVERRIDE
  1632. +CAP_DAC_READ_SEARCH
  1633. +CAP_NET_ADMIN
  1634. bind disabled
  1635. connect disabled
  1636. }
  1637.  
  1638. # Role: root
  1639. subject /sbin/wpa_supplicant o {
  1640. / h
  1641. /dev/log rw
  1642. /dev/urandom r
  1643. /etc/localtime r
  1644. /run/wpa_supplicant wd
  1645. -CAP_ALL
  1646. +CAP_NET_ADMIN
  1647. bind disabled
  1648. connect disabled
  1649. }
  1650.  
  1651. # Role: root
  1652. subject /sbin/xtables-multi o {
  1653. / h
  1654. /bin h
  1655. /bin/kmod x
  1656. /etc h
  1657. /etc/gai.conf r
  1658. /etc/ld.so.cache r
  1659. /etc/nsswitch.conf r
  1660. /etc/passwd r
  1661. /etc/protocols r
  1662. /lib rx
  1663. /lib/modules h
  1664. /proc h
  1665. /proc/sys/kernel/modprobe r
  1666. /sbin h
  1667. /sbin/xtables-multi x
  1668. /usr h
  1669. /usr/lib
  1670. -CAP_ALL
  1671. +CAP_NET_ADMIN
  1672. +CAP_NET_RAW
  1673. bind disabled
  1674. connect 0.0.0.0/32:0 raw_sock raw_proto
  1675. sock_allow_family ipv6 netlink
  1676. }
  1677.  
  1678. # Role: root
  1679. subject /usr/bin/Xorg o {
  1680. user_transition_allow nobody root
  1681.  
  1682. / h
  1683. /dev h
  1684. /dev/input/event10 rw
  1685. /dev/input/event9 rw
  1686. /etc h
  1687. /etc/ld.so.cache r
  1688. /etc/nsswitch.conf r
  1689. /etc/passwd r
  1690. /etc/udev/udev.conf r
  1691. /lib rx
  1692. /lib/modules h
  1693. /proc r
  1694. /proc/bus h
  1695. /proc/kallsyms h
  1696. /proc/kcore h
  1697. /proc/modules h
  1698. /proc/slabinfo h
  1699. /proc/sys h
  1700. /run r
  1701. /sys r
  1702. /tmp wd
  1703. /var h
  1704. /var/lib/xkb w
  1705. /var/lib/xkb/server-8C3648A5FD728529D869F46730BE1BC287DB231C.xkm r
  1706. -CAP_ALL
  1707. +CAP_DAC_READ_SEARCH
  1708. +CAP_SETUID
  1709. +CAP_IPC_OWNER
  1710. +CAP_SYS_ADMIN
  1711. bind disabled
  1712. connect disabled
  1713. }
  1714.  
  1715. # Role: root
  1716. subject /usr/bin/apt-get o {
  1717. / h
  1718. /bin h
  1719. /bin/bzip2
  1720. /bin/dash x
  1721. /dev h
  1722. /dev/null rw
  1723. /etc r
  1724. /etc/grsec h
  1725. /etc/gshadow h
  1726. /etc/gshadow- h
  1727. /etc/passwd h
  1728. /etc/ppp h
  1729. /etc/samba/smbpasswd h
  1730. /etc/shadow h
  1731. /etc/shadow- h
  1732. /etc/ssh h
  1733. /home h
  1734. /home/colin
  1735. /lib h
  1736. /lib/x86_64-linux-gnu rx
  1737. /proc h
  1738. /proc/meminfo r
  1739. /tmp
  1740. /usr h
  1741. /usr/bin h
  1742. /usr/bin/apt-get x
  1743. /usr/bin/dpkg x
  1744. /usr/bin/xz
  1745. /usr/lib rx
  1746. /var h
  1747. /var/cache h
  1748. /var/cache/apt rwcd
  1749. /var/lib rwcd
  1750. -CAP_ALL
  1751. bind disabled
  1752. connect disabled
  1753. }
  1754.  
  1755. # Role: root
  1756. subject /usr/bin/clear o {
  1757. / h
  1758. /etc h
  1759. /etc/ld.so.cache r
  1760. /etc/terminfo
  1761. /lib h
  1762. /lib/terminfo
  1763. /lib/terminfo/l/linux r
  1764. /lib/x86_64-linux-gnu/ld-2.17.so x
  1765. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1766. /lib/x86_64-linux-gnu/libtinfo.so.5.9 rx
  1767. /usr h
  1768. /usr/bin/clear x
  1769. -CAP_ALL
  1770. +CAP_SYS_TTY_CONFIG
  1771. bind disabled
  1772. connect disabled
  1773. }
  1774.  
  1775. # Role: root
  1776. subject /usr/bin/dbus-launch o {
  1777. /
  1778. /bin h
  1779. /bin/dbus-daemon x
  1780. /boot h
  1781. /dev h
  1782. /dev/null rw
  1783. /etc h
  1784. /etc/ld.so.cache r
  1785. /etc/nsswitch.conf r
  1786. /etc/passwd r
  1787. /home h
  1788. /home/colin/.Xauthority r
  1789. /lib h
  1790. /lib/x86_64-linux-gnu rx
  1791. /lib64/modules h
  1792. /proc/bus h
  1793. /proc/kallsyms h
  1794. /proc/kcore h
  1795. /proc/modules h
  1796. /proc/slabinfo h
  1797. /proc/sys h
  1798. /root h
  1799. /root/.dbus
  1800. /root/.dbus/session-bus
  1801. /root/.dbus/session-bus/2a7c9e4458ccbfd5a964c1c0520b0164-0 w
  1802. /sys h
  1803. /usr h
  1804. /usr/bin h
  1805. /usr/bin/dbus-launch x
  1806. /usr/lib rx
  1807. /var/backups h
  1808. /var/log h
  1809. -CAP_ALL
  1810. bind disabled
  1811. connect disabled
  1812. }
  1813.  
  1814. # Role: root
  1815. subject /usr/bin/gedit o {
  1816. /
  1817. /boot h
  1818. /dev h
  1819. /dev/.blkid.tab r
  1820. /dev/null r
  1821. /dev/urandom r
  1822. /etc r
  1823. /etc/.goutputstream-QWQ42W rwcd
  1824. /etc/console-setup
  1825. /etc/console-setup/vtrgb r
  1826. /etc/gtk-3.0
  1827. /etc/gtk-3.0/settings.ini r
  1828. /etc/rc.local rwcdl
  1829. /etc/rc.local~ wd
  1830. /etc/samba/smbpasswd h
  1831. /home h
  1832. /home/colin/.Xauthority r
  1833. /lib rx
  1834. /lib/modules h
  1835. /lib64/modules h
  1836. /proc r
  1837. /proc/bus h
  1838. /proc/kallsyms h
  1839. /proc/kcore h
  1840. /proc/modules h
  1841. /proc/mounts
  1842. /proc/slabinfo h
  1843. /proc/sys h
  1844. /root r
  1845. /root/.config
  1846. /root/.config/dconf/user r
  1847. /root/.config/enchant
  1848. /root/.config/enchant/en_US.dic ra
  1849. /root/.config/enchant/en_US.exc ra
  1850. /root/.config/gedit
  1851. /root/.config/gedit/accels rw
  1852. /root/.config/ibus
  1853. /root/.config/ibus/bus w
  1854. /root/.local
  1855. /root/.local/share rwcd
  1856. /run
  1857. /run/motd r
  1858. /run/resolvconf/resolv.conf r
  1859. /run/user
  1860. /run/user/root
  1861. /run/user/root/dconf rwc
  1862. /sys h
  1863. /usr h
  1864. /usr/bin h
  1865. /usr/bin/dbus-launch x
  1866. /usr/bin/gedit x
  1867. /usr/lib rx
  1868. /usr/local h
  1869. /usr/local/share/fonts
  1870. /usr/share r
  1871. /var h
  1872. /var/cache h
  1873. /var/cache/fontconfig r
  1874. /var/lib h
  1875. /var/lib/dbus/machine-id r
  1876. -CAP_ALL
  1877. bind disabled
  1878. connect disabled
  1879. }
  1880.  
  1881. # Role: root
  1882. subject /usr/bin/indicator-cpufreq-selector o {
  1883. / h
  1884. /dev h
  1885. /dev/null rw
  1886. /dev/urandom r
  1887. /etc r
  1888. /etc/grsec h
  1889. /etc/gshadow h
  1890. /etc/gshadow- h
  1891. /etc/ppp h
  1892. /etc/python3.3 h
  1893. /etc/python3.3/sitecustomize.py
  1894. /etc/samba/smbpasswd h
  1895. /etc/shadow h
  1896. /etc/shadow- h
  1897. /etc/ssh h
  1898. /lib rx
  1899. /lib/modules h
  1900. /proc r
  1901. /proc/bus h
  1902. /proc/kallsyms h
  1903. /proc/kcore h
  1904. /proc/modules h
  1905. /proc/mounts
  1906. /proc/slabinfo h
  1907. /proc/sys h
  1908. /run h
  1909. /run/dbus/system_bus_socket rw
  1910. /sbin h
  1911. /sbin/ldconfig x
  1912. /selinux
  1913. /sys h
  1914. /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor w
  1915. /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor w
  1916. /sys/devices/system/cpu/cpu2/cpufreq/scaling_governor w
  1917. /sys/devices/system/cpu/cpu3/cpufreq/scaling_governor w
  1918. /tmp rxwcd
  1919. /usr
  1920. /usr/bin rx
  1921. /usr/lib rx
  1922. /usr/src h
  1923. -CAP_ALL
  1924. bind disabled
  1925. connect disabled
  1926. }
  1927.  
  1928. # Role: root
  1929. subject /usr/bin/killall o {
  1930. / h
  1931. /etc h
  1932. /etc/ld.so.cache r
  1933. /etc/locale.alias r
  1934. /lib h
  1935. /lib/x86_64-linux-gnu/ld-2.17.so x
  1936. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1937. /proc r
  1938. /proc/bus h
  1939. /proc/kallsyms h
  1940. /proc/kcore h
  1941. /proc/modules h
  1942. /proc/slabinfo h
  1943. /proc/sys h
  1944. /usr h
  1945. /usr/bin/killall x
  1946. /usr/lib/locale/locale-archive r
  1947. -CAP_ALL
  1948. +CAP_DAC_READ_SEARCH
  1949. +CAP_KILL
  1950. bind disabled
  1951. connect disabled
  1952. }
  1953.  
  1954. # Role: root
  1955. subject /usr/bin/lockfile-create o {
  1956. / h
  1957. /etc h
  1958. /etc/ld.so.cache r
  1959. /lib h
  1960. /lib/x86_64-linux-gnu/ld-2.17.so x
  1961. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1962. /run h
  1963. /run/lock wcdl
  1964. /usr h
  1965. /usr/bin/lockfile-create x
  1966. /usr/lib/x86_64-linux-gnu/liblockfile.so.1.0 rx
  1967. -CAP_ALL
  1968. bind disabled
  1969. connect disabled
  1970. }
  1971.  
  1972. # Role: root
  1973. subject /usr/bin/lockfile-remove o {
  1974. / h
  1975. /etc h
  1976. /etc/ld.so.cache r
  1977. /lib h
  1978. /lib/x86_64-linux-gnu/ld-2.17.so x
  1979. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1980. /run h
  1981. /run/lock
  1982. /run/lock/ntpdate-ifup.lock wd
  1983. /usr h
  1984. /usr/bin/lockfile-remove x
  1985. /usr/lib/x86_64-linux-gnu/liblockfile.so.1.0 rx
  1986. -CAP_ALL
  1987. bind disabled
  1988. connect disabled
  1989. }
  1990.  
  1991. # Role: root
  1992. subject /usr/bin/lockfile-touch o {
  1993. / h
  1994. /etc h
  1995. /etc/ld.so.cache r
  1996. /lib h
  1997. /lib/x86_64-linux-gnu/ld-2.17.so x
  1998. /lib/x86_64-linux-gnu/libc-2.17.so rx
  1999. /run h
  2000. /run/lock/ntpdate-ifup.lock w
  2001. /usr h
  2002. /usr/bin/lockfile-touch x
  2003. /usr/lib/x86_64-linux-gnu/liblockfile.so.1.0 rx
  2004. -CAP_ALL
  2005. bind disabled
  2006. connect disabled
  2007. }
  2008.  
  2009. # Role: root
  2010. subject /usr/bin/logger o {
  2011. / h
  2012. /dev h
  2013. /dev/log rw
  2014. /etc h
  2015. /etc/ld.so.cache r
  2016. /etc/localtime r
  2017. /lib h
  2018. /lib/x86_64-linux-gnu/ld-2.17.so x
  2019. /lib/x86_64-linux-gnu/libc-2.17.so rx
  2020. /usr h
  2021. /usr/bin/logger x
  2022. -CAP_ALL
  2023. bind disabled
  2024. connect disabled
  2025. }
  2026.  
  2027. # Role: root
  2028. subject /usr/bin/rfcomm o {
  2029. / h
  2030. /etc/ld.so.cache r
  2031. /lib/x86_64-linux-gnu/ld-2.17.so x
  2032. /lib/x86_64-linux-gnu/libc-2.17.so rx
  2033. /usr/bin/rfcomm x
  2034. -CAP_ALL
  2035. bind disabled
  2036. connect disabled
  2037. sock_allow_family bluetooth
  2038. }
  2039.  
  2040. # Role: root
  2041. subject /usr/bin/sudo o {
  2042. group_transition_allow nogroup root colin
  2043.  
  2044. / h
  2045. /bin h
  2046. /bin/dash x
  2047. /bin/su x
  2048. /dev h
  2049. /dev/log rw
  2050. /etc r
  2051. /etc/grsec h
  2052. /etc/gshadow h
  2053. /etc/gshadow- h
  2054. /etc/ppp h
  2055. /etc/samba/smbpasswd h
  2056. /etc/shadow h
  2057. /etc/shadow- h
  2058. /etc/ssh h
  2059. /proc
  2060. /proc/bus h
  2061. /proc/kallsyms h
  2062. /proc/kcore h
  2063. /proc/modules h
  2064. /proc/slabinfo h
  2065. /proc/sys h
  2066. /run h
  2067. /run/resolvconf/resolv.conf r
  2068. /run/user
  2069. /run/user/.root.lock rwcd
  2070. /run/user/root wc
  2071. /run/utmp r
  2072. -CAP_ALL
  2073. +CAP_CHOWN
  2074. +CAP_SETGID
  2075. +CAP_SETUID
  2076. +CAP_AUDIT_WRITE
  2077. bind disabled
  2078. connect disabled
  2079. sock_allow_family netlink
  2080. }
  2081.  
  2082. # Role: root
  2083. subject /usr/lib/ConsoleKit/ck-collect-session-info o {
  2084. user_transition_allow root
  2085. group_transition_allow root
  2086.  
  2087. / h
  2088. /dev h
  2089. /dev/null r
  2090. /dev/pts
  2091. /dev/tty7
  2092. /etc h
  2093. /etc/ld.so.cache r
  2094. /etc/nsswitch.conf r
  2095. /etc/passwd r
  2096. /lib h
  2097. /lib/x86_64-linux-gnu rx
  2098. /proc r
  2099. /proc/bus h
  2100. /proc/kallsyms h
  2101. /proc/kcore h
  2102. /proc/modules h
  2103. /proc/slabinfo h
  2104. /proc/sys h
  2105. /usr h
  2106. /usr/lib/ConsoleKit/ck-collect-session-info x
  2107. /usr/lib/ConsoleKit/ck-get-x11-server-pid x
  2108. /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache r
  2109. -CAP_ALL
  2110. +CAP_SETGID
  2111. +CAP_SETUID
  2112. bind disabled
  2113. connect disabled
  2114. }
  2115.  
  2116. # Role: root
  2117. subject /usr/lib/ConsoleKit/run-session.d/pam-foreground-compat.ck o {
  2118. / h
  2119. /bin x
  2120. /etc h
  2121. /etc/ld.so.cache r
  2122. /lib h
  2123. /lib/x86_64-linux-gnu/ld-2.17.so x
  2124. /lib/x86_64-linux-gnu/libc-2.17.so rx
  2125. /run h
  2126. /run/console/colin wc
  2127. /run/console/lightdm wc
  2128. /run/console/root wc
  2129. /usr h
  2130. /usr/bin/cut x
  2131. /usr/bin/getent x
  2132. /usr/lib/ConsoleKit/run-session.d/pam-foreground-compat.ck r
  2133. -CAP_ALL
  2134. bind disabled
  2135. connect disabled
  2136. }
  2137.  
  2138. # Role: root
  2139. subject /usr/lib/NetworkManager/nm-dhcp-client.action o {
  2140. / h
  2141. /etc h
  2142. /etc/ld.so.cache r
  2143. /lib h
  2144. /lib/x86_64-linux-gnu h
  2145. /lib/x86_64-linux-gnu/ld-2.17.so x
  2146. /lib/x86_64-linux-gnu/libc-2.17.so rx
  2147. /lib/x86_64-linux-gnu/libdbus-1.so.3.7.2 rx
  2148. /lib/x86_64-linux-gnu/libpthread-2.17.so rx
  2149. /lib/x86_64-linux-gnu/librt-2.17.so rx
  2150. /run h
  2151. /run/dbus/system_bus_socket rw
  2152. /usr h
  2153. /usr/lib/NetworkManager/nm-dhcp-client.action x
  2154. -CAP_ALL
  2155. bind disabled
  2156. connect disabled
  2157. }
  2158.  
  2159. # Role: root
  2160. subject /usr/lib/NetworkManager/nm-dispatcher.action o {
  2161. /
  2162. /boot h
  2163. /dev h
  2164. /dev/console w
  2165. /dev/log rw
  2166. /dev/null r
  2167. /etc h
  2168. /etc/NetworkManager/dispatcher.d
  2169. /etc/NetworkManager/dispatcher.d/01ifupdown x
  2170. /etc/ld.so.cache r
  2171. /etc/localtime r
  2172. /lib rx
  2173. /lib/modules h
  2174. /lib64/modules h
  2175. /proc
  2176. /proc/bus h
  2177. /proc/filesystems r
  2178. /proc/kallsyms h
  2179. /proc/kcore h
  2180. /proc/modules h
  2181. /proc/slabinfo h
  2182. /proc/sys h
  2183. /run h
  2184. /run/dbus/system_bus_socket rw
  2185. /sys h
  2186. /usr h
  2187. /usr/lib rx
  2188. /var/backups h
  2189. /var/log h
  2190. -CAP_ALL
  2191. +CAP_SYS_TTY_CONFIG
  2192. bind disabled
  2193. connect disabled
  2194. }
  2195.  
  2196. # Role: root
  2197. subject /usr/lib/accountsservice/accounts-daemon o {
  2198. user_transition_allow lightdm nobody colin
  2199.  
  2200. / h
  2201. /dev h
  2202. /dev/log rw
  2203. /etc r
  2204. /etc/grsec h
  2205. /etc/gshadow h
  2206. /etc/gshadow- h
  2207. /etc/ppp h
  2208. /etc/samba/smbpasswd h
  2209. /etc/shadow- h
  2210. /etc/ssh h
  2211. /lib rx
  2212. /lib/modules h
  2213. /proc h
  2214. /proc/filesystems r
  2215. /run h
  2216. /run/dbus/system_bus_socket rw
  2217. /selinux
  2218. /usr h
  2219. /usr/lib rx
  2220. /usr/share h
  2221. /usr/share/gvfs/remote-volume-monitors r
  2222. /var
  2223. /var/backups h
  2224. /var/lib rwcd
  2225. /var/log h
  2226. -CAP_ALL
  2227. +CAP_SETGID
  2228. +CAP_SETUID
  2229. bind disabled
  2230. connect disabled
  2231. }
  2232.  
  2233. # Role: root
  2234. subject /usr/lib/apt/methods/http o {
  2235. / h
  2236. /bin h
  2237. /bin/bzip2
  2238. /dev h
  2239. /dev/null rw
  2240. /etc r
  2241. /etc/grsec h
  2242. /etc/gshadow h
  2243. /etc/gshadow- h
  2244. /etc/passwd h
  2245. /etc/ppp h
  2246. /etc/samba/smbpasswd h
  2247. /etc/shadow h
  2248. /etc/shadow- h
  2249. /etc/ssh h
  2250. /lib rx
  2251. /lib/modules h
  2252. /run h
  2253. /run/resolvconf/resolv.conf r
  2254. /usr h
  2255. /usr/bin/xz
  2256. /usr/lib
  2257. /usr/lib/apt/methods/http x
  2258. /usr/lib/locale/locale-archive r
  2259. /usr/lib/x86_64-linux-gnu
  2260. /usr/lib/x86_64-linux-gnu/libapt-pkg.so.4.12.0 rx
  2261. /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17 rx
  2262. /var h
  2263. /var/lib/apt/lists/partial/extras.ubuntu.com_ubuntu_dists_raring_Release.gpg rwc
  2264. -CAP_ALL
  2265. bind 0.0.0.0/32:0 dgram ip
  2266. connect 0.0.0.0/0:80 stream dgram tcp udp
  2267. connect 0.0.0.0/0:53 stream dgram tcp udp
  2268. sock_allow_family ipv6 netlink
  2269. }
  2270.  
  2271. # Role: root
  2272. subject /usr/lib/dconf/dconf-service o {
  2273. / h
  2274. /etc h
  2275. /etc/ld.so.cache r
  2276. /lib h
  2277. /lib/x86_64-linux-gnu rx
  2278. /proc h
  2279. /proc/cmdline r
  2280. /proc/filesystems r
  2281. /root rwcd
  2282. /run h
  2283. /run/user/root/dconf/user rwd
  2284. /selinux
  2285. /usr h
  2286. /usr/lib rx
  2287. -CAP_ALL
  2288. bind disabled
  2289. connect disabled
  2290. }
  2291.  
  2292. # Role: root
  2293. subject /usr/lib/pm-utils/power.d/laptop-mode o {
  2294. /
  2295. /bin h
  2296. /bin/cat x
  2297. /bin/dash x
  2298. /boot h
  2299. /dev/grsec h
  2300. /dev/kmem h
  2301. /dev/log h
  2302. /dev/mem h
  2303. /dev/port h
  2304. /etc h
  2305. /etc/ld.so.cache r
  2306. /lib h
  2307. /lib/x86_64-linux-gnu/ld-2.17.so x
  2308. /lib/x86_64-linux-gnu/libc-2.17.so rx
  2309. /lib64/modules h
  2310. /proc w
  2311. /proc/bus h
  2312. /proc/kallsyms h
  2313. /proc/kcore h
  2314. /proc/modules h
  2315. /proc/slabinfo h
  2316. /run h
  2317. /run/pm-utils/pm-powersave/storage/state:laptop_mode_default
  2318. /sys h
  2319. /usr h
  2320. /usr/lib/pm-utils/functions r
  2321. /usr/lib/pm-utils/power.d/laptop-mode r
  2322. /var/backups h
  2323. /var/log h
  2324. -CAP_ALL
  2325. +CAP_SYS_ADMIN
  2326. bind disabled
  2327. connect disabled
  2328. }
  2329.  
  2330. # Role: root
  2331. subject /usr/lib/policykit-1/polkitd o {
  2332. / h
  2333. /dev h
  2334. /dev/log rw
  2335. /etc r
  2336. /etc/grsec h
  2337. /etc/gshadow h
  2338. /etc/gshadow- h
  2339. /etc/polkit-1 h
  2340. /etc/polkit-1/localauthority
  2341. /etc/ppp h
  2342. /etc/samba/smbpasswd h
  2343. /etc/shadow h
  2344. /etc/shadow- h
  2345. /etc/ssh h
  2346. /proc r
  2347. /proc/bus h
  2348. /proc/kallsyms h
  2349. /proc/kcore h
  2350. /proc/modules h
  2351. /proc/slabinfo h
  2352. /proc/sys h
  2353. /run h
  2354. /run/ConsoleKit
  2355. /run/ConsoleKit/database r
  2356. /usr h
  2357. /usr/share/polkit-1/actions r
  2358. /var h
  2359. /var/lib r
  2360. -CAP_ALL
  2361. +CAP_DAC_READ_SEARCH
  2362. bind disabled
  2363. connect disabled
  2364. }
  2365.  
  2366. # Role: root
  2367. subject /usr/lib/rtkit/rtkit-daemon o {
  2368. user_transition_allow rtkit nobody
  2369. group_transition_allow rtkit nogroup
  2370.  
  2371. / h
  2372. /dev h
  2373. /dev/log rw
  2374. /etc h
  2375. /etc/ld.so.cache r
  2376. /etc/nsswitch.conf r
  2377. /etc/passwd r
  2378. /lib rx
  2379. /lib/modules h
  2380. /proc
  2381. /proc/bus h
  2382. /proc/kallsyms h
  2383. /proc/kcore h
  2384. /proc/modules h
  2385. /proc/slabinfo h
  2386. /proc/sys h
  2387. /run h
  2388. /run/dbus/system_bus_socket rw
  2389. /usr h
  2390. /usr/lib/rtkit/rtkit-daemon x
  2391. -CAP_ALL
  2392. +CAP_SETGID
  2393. +CAP_SETUID
  2394. +CAP_SYS_CHROOT
  2395. +CAP_SYS_NICE
  2396. bind disabled
  2397. connect disabled
  2398. }
  2399.  
  2400. # Role: root
  2401. subject /usr/lib/udisks2/udisksd o {
  2402. / h
  2403. /bin h
  2404. /bin/mount x
  2405. /dev h
  2406. /dev/log rw
  2407. /dev/null rw
  2408. /dev/sda r
  2409. /dev/sda5
  2410. /dev/sr0 r
  2411. /etc r
  2412. /etc/grsec h
  2413. /etc/gshadow h
  2414. /etc/gshadow- h
  2415. /etc/ppp h
  2416. /etc/samba/smbpasswd h
  2417. /etc/shadow h
  2418. /etc/shadow- h
  2419. /etc/ssh h
  2420. /etc/udev h
  2421. /etc/udev/udev.conf r
  2422. /lib rx
  2423. /lib/modules h
  2424. /media h
  2425. /media/colin
  2426. /media/colin/56E6F045E6F026C1 wcd
  2427. /proc r
  2428. /proc/bus h
  2429. /proc/kallsyms h
  2430. /proc/kcore h
  2431. /proc/modules h
  2432. /proc/slabinfo h
  2433. /run rwc
  2434. /run/dbus h
  2435. /run/dbus/system_bus_socket rw
  2436. /run/udev h
  2437. /run/udev/data r
  2438. /selinux
  2439. /sys r
  2440. /usr h
  2441. /usr/lib rx
  2442. /usr/share h
  2443. /usr/share/gvfs/remote-volume-monitors r
  2444. /var h
  2445. /var/lib/udisks2
  2446. /var/lib/udisks2/mounted-fs rwcd
  2447. /var/lib/udisks2/mounted-fs.JKRW2W rwcd
  2448. /var/lib/udisks2/mounted-fs.X4O12W rwcd
  2449. -CAP_ALL
  2450. +CAP_SYS_RAWIO
  2451. bind disabled
  2452. connect disabled
  2453. sock_allow_family netlink
  2454. }
  2455.  
  2456. # Role: root
  2457. subject /usr/lib/upower/upowerd o {
  2458. / h
  2459. /dev h
  2460. /dev/bus h
  2461. /dev/bus/usb
  2462. /dev/cpu_dma_latency w
  2463. /dev/input h
  2464. /dev/input/event0 r
  2465. /dev/network_latency w
  2466. /dev/null r
  2467. /etc h
  2468. /etc/UPower/UPower.conf r
  2469. /etc/ld.so.cache r
  2470. /etc/locale.alias r
  2471. /etc/udev/udev.conf r
  2472. /lib rx
  2473. /lib/modules h
  2474. /proc r
  2475. /proc/bus h
  2476. /proc/kallsyms h
  2477. /proc/kcore h
  2478. /proc/modules h
  2479. /proc/slabinfo h
  2480. /proc/sys h
  2481. /run rw
  2482. /selinux
  2483. /sys r
  2484. /usr h
  2485. /usr/bin h
  2486. /usr/bin/pm-is-supported x
  2487. /usr/lib rx
  2488. /usr/sbin h
  2489. /usr/sbin/pm-powersave x
  2490. /var h
  2491. /var/lib rwcd
  2492. -CAP_ALL
  2493. bind disabled
  2494. connect disabled
  2495. sock_allow_family netlink
  2496. }
  2497.  
  2498. # Role: root
  2499. subject /usr/lib/x86_64-linux-gnu/systemd-shim o {
  2500. /
  2501. /boot h
  2502. /dev/grsec h
  2503. /dev/kmem h
  2504. /dev/log h
  2505. /dev/mem h
  2506. /dev/port h
  2507. /etc h
  2508. /etc/ld.so.cache r
  2509. /lib h
  2510. /lib/x86_64-linux-gnu rx
  2511. /lib64/modules h
  2512. /proc r
  2513. /proc/bus h
  2514. /proc/kallsyms h
  2515. /proc/kcore h
  2516. /proc/modules h
  2517. /proc/slabinfo h
  2518. /proc/sys h
  2519. /run h
  2520. /run/dbus/system_bus_socket rw
  2521. /sys h
  2522. /sys/devices/virtual/dmi/id/bios_vendor r
  2523. /sys/devices/virtual/dmi/id/board_vendor r
  2524. /sys/devices/virtual/dmi/id/sys_vendor r
  2525. /usr h
  2526. /usr/lib h
  2527. /usr/lib/x86_64-linux-gnu rx
  2528. /var/backups h
  2529. /var/log h
  2530. -CAP_ALL
  2531. bind disabled
  2532. connect disabled
  2533. }
  2534.  
  2535. # Role: root
  2536. subject /usr/local/sbin/dnscrypt-proxy o {
  2537. user_transition_allow dnscrypt
  2538. group_transition_allow dnscrypt nogroup
  2539.  
  2540. / h
  2541. /dev h
  2542. /dev/log rw
  2543. /dev/null rw
  2544. /dev/urandom r
  2545. /etc h
  2546. /etc/ld.so.cache r
  2547. /etc/localtime r
  2548. /etc/nsswitch.conf r
  2549. /etc/passwd r
  2550. /lib h
  2551. /lib/x86_64-linux-gnu rx
  2552. /run h
  2553. /run/dnscrypt
  2554. /usr h
  2555. /usr/local/lib/libsodium.so.4
  2556. /usr/local/lib/libsodium.so.4.2.0 rx
  2557. /usr/local/sbin/dnscrypt-proxy x
  2558. -CAP_ALL
  2559. +CAP_SETGID
  2560. +CAP_SETUID
  2561. +CAP_NET_BIND_SERVICE
  2562. +CAP_NET_ADMIN
  2563. +CAP_SYS_CHROOT
  2564. bind 0.0.0.0/32:0 dgram ip
  2565. bind 127.0.0.1/32:53 stream dgram tcp udp
  2566. connect 208.67.220.220/32:443 dgram udp
  2567. }
  2568.  
  2569. # Role: root
  2570. subject /usr/sbin/NetworkManager o {
  2571. / h
  2572. /bin h
  2573. /bin/dash x
  2574. /dev h
  2575. /dev/log rw
  2576. /dev/null r
  2577. /etc r
  2578. /etc/NetworkManager h
  2579. /etc/NetworkManager/system-connections/Student rwcd
  2580. /etc/NetworkManager/system-connections/Student.97XW2W rwcd
  2581. /etc/NetworkManager/system-connections/Student.LWNP2W rwcd
  2582. /etc/dhcp h
  2583. /etc/dhcp/dhclient.conf r
  2584. /etc/grsec h
  2585. /etc/gshadow h
  2586. /etc/gshadow- h
  2587. /etc/ppp h
  2588. /etc/samba/smbpasswd h
  2589. /etc/shadow h
  2590. /etc/shadow- h
  2591. /etc/ssh h
  2592. /proc rw
  2593. /proc/bus h
  2594. /proc/kallsyms h
  2595. /proc/kcore h
  2596. /proc/modules h
  2597. /proc/slabinfo h
  2598. /run h
  2599. /run/ConsoleKit
  2600. /run/ConsoleKit/database r
  2601. /run/NetworkManager/NetworkManager.pid wd
  2602. /run/sendsigs.omit.d/network-manager.dhclient-wlan0.pid wd
  2603. /sbin h
  2604. /sbin/dhclient x
  2605. /sbin/resolvconf
  2606. /var h
  2607. /var/lib rwcd
  2608. -CAP_ALL
  2609. +CAP_NET_ADMIN
  2610. +CAP_SYS_ADMIN
  2611. bind 0.0.0.0/32:0 dgram ip
  2612. connect disabled
  2613. }
  2614.  
  2615. # Role: root
  2616. subject /usr/sbin/aa-logprof o {
  2617. / h
  2618. /bin h
  2619. /bin/dash x
  2620. /bin/pwd
  2621. /dev h
  2622. /dev/tty rw
  2623. /dev/urandom r
  2624. /etc rw
  2625. /etc/grsec h
  2626. /etc/gshadow h
  2627. /etc/gshadow- h
  2628. /etc/passwd h
  2629. /etc/ppp h
  2630. /etc/samba/smbpasswd h
  2631. /etc/shadow h
  2632. /etc/shadow- h
  2633. /etc/ssh h
  2634. /lib h
  2635. /lib/x86_64-linux-gnu rx
  2636. /proc r
  2637. /proc/bus h
  2638. /proc/kallsyms h
  2639. /proc/kcore h
  2640. /proc/modules h
  2641. /proc/mounts
  2642. /proc/slabinfo h
  2643. /proc/sys h
  2644. /sbin h
  2645. /sbin/apparmor_parser
  2646. /sys h
  2647. /sys/kernel/security/apparmor
  2648. /usr h
  2649. /usr/bin x
  2650. /usr/lib rx
  2651. /usr/sbin h
  2652. /usr/sbin/aa-logprof r
  2653. /usr/share r
  2654. /var h
  2655. /var/log/syslog r
  2656. -CAP_ALL
  2657. +CAP_DAC_READ_SEARCH
  2658. bind disabled
  2659. connect disabled
  2660. }
  2661.  
  2662. # Role: root
  2663. subject /usr/sbin/acpid o {
  2664. / h
  2665. /bin/dash x
  2666. /dev/console w
  2667. /dev/log rw
  2668. /run/acpid.pid wd
  2669. -CAP_ALL
  2670. +CAP_SYS_TTY_CONFIG
  2671. bind disabled
  2672. connect disabled
  2673. }
  2674.  
  2675. # Role: root
  2676. subject /usr/sbin/alsactl o {
  2677. / h
  2678. /dev h
  2679. /dev/snd/controlC0 r
  2680. /dev/snd/controlC1 r
  2681. /dev/urandom r
  2682. /etc h
  2683. /etc/ld.so.cache r
  2684. /etc/nsswitch.conf r
  2685. /etc/passwd r
  2686. /etc/pulse/client.conf r
  2687. /lib rx
  2688. /lib/modules h
  2689. /proc
  2690. /proc/bus h
  2691. /proc/kallsyms h
  2692. /proc/kcore h
  2693. /proc/modules h
  2694. /proc/slabinfo h
  2695. /proc/sys h
  2696. /root
  2697. /root/.config
  2698. /root/.config/pulse w
  2699. /root/.config/pulse/2a7c9e4458ccbfd5a964c1c0520b0164-runtime
  2700. /root/.config/pulse/cookie r
  2701. /run h
  2702. /run/shm rwcd
  2703. /tmp
  2704. /usr h
  2705. /usr/lib rx
  2706. /usr/sbin h
  2707. /usr/sbin/alsactl x
  2708. /usr/share h
  2709. /usr/share/alsa/alsa.conf r
  2710. /usr/share/alsa/alsa.conf.d
  2711. /usr/share/alsa/alsa.conf.d/50-pulseaudio.conf r
  2712. /usr/share/alsa/alsa.conf.d/bluetooth.conf r
  2713. /usr/share/alsa/alsa.conf.d/pulse.conf r
  2714. /var h
  2715. /var/lib/alsa/asound.state rw
  2716. /var/lib/dbus/machine-id r
  2717. -CAP_ALL
  2718. +CAP_DAC_READ_SEARCH
  2719. +CAP_KILL
  2720. bind disabled
  2721. connect disabled
  2722. }
  2723.  
  2724. # Role: root
  2725. subject /usr/sbin/anacron o {
  2726. /
  2727. /boot h
  2728. /dev h
  2729. /dev/log rw
  2730. /etc h
  2731. /etc/ld.so.cache r
  2732. /etc/localtime r
  2733. /lib h
  2734. /lib/x86_64-linux-gnu/ld-2.17.so x
  2735. /lib/x86_64-linux-gnu/libc-2.17.so rx
  2736. /lib64/modules h
  2737. /proc/bus h
  2738. /proc/kallsyms h
  2739. /proc/kcore h
  2740. /proc/modules h
  2741. /proc/slabinfo h
  2742. /proc/sys h
  2743. /sys h
  2744. /usr h
  2745. /usr/sbin/anacron x
  2746. /var/backups h
  2747. /var/log h
  2748. -CAP_ALL
  2749. bind disabled
  2750. connect disabled
  2751. }
  2752.  
  2753. # Role: root
  2754. subject /usr/sbin/bluetoothd o {
  2755. / h
  2756. /dev/log rw
  2757. -CAP_ALL
  2758. bind disabled
  2759. connect disabled
  2760. }
  2761.  
  2762. # Role: root
  2763. subject /usr/sbin/console-kit-daemon o {
  2764. / h
  2765. /dev h
  2766. /dev/null r
  2767. /dev/pts
  2768. /dev/tty r
  2769. /dev/tty0 r
  2770. /dev/urandom r
  2771. /etc r
  2772. /etc/ConsoleKit h
  2773. /etc/ConsoleKit/run-seat.d
  2774. /etc/ConsoleKit/run-session.d
  2775. /etc/ConsoleKit/seats.d
  2776. /etc/ConsoleKit/seats.d/00-primary.seat r
  2777. /etc/grsec h
  2778. /etc/gshadow h
  2779. /etc/gshadow- h
  2780. /etc/passwd h
  2781. /etc/ppp h
  2782. /etc/samba/smbpasswd h
  2783. /etc/shadow h
  2784. /etc/shadow- h
  2785. /etc/ssh h
  2786. /lib rx
  2787. /lib/modules h
  2788. /proc r
  2789. /proc/bus h
  2790. /proc/kallsyms h
  2791. /proc/kcore h
  2792. /proc/modules h
  2793. /proc/slabinfo h
  2794. /proc/sys h
  2795. /run
  2796. /run/ConsoleKit rwcd
  2797. /run/console-kit-daemon.pid wc
  2798. /run/dbus/system_bus_socket rw
  2799. /selinux
  2800. /sys h
  2801. /sys/devices/system/cpu/online r
  2802. /usr h
  2803. /usr/lib rx
  2804. /usr/sbin h
  2805. /usr/sbin/console-kit-daemon x
  2806. /var
  2807. /var/backups h
  2808. /var/lib/dbus/machine-id r
  2809. /var/log
  2810. /var/log/ConsoleKit
  2811. /var/log/ConsoleKit/history rw
  2812. -CAP_ALL
  2813. +CAP_DAC_READ_SEARCH
  2814. +CAP_SYS_PTRACE
  2815. +CAP_SYS_TTY_CONFIG
  2816. bind disabled
  2817. connect disabled
  2818. }
  2819.  
  2820. # Role: root
  2821. subject /usr/sbin/irqbalance o {
  2822. / h
  2823. /proc rw
  2824. /proc/bus h
  2825. /proc/kallsyms h
  2826. /proc/kcore h
  2827. /proc/modules h
  2828. /proc/slabinfo h
  2829. /proc/sys h
  2830. /sys r
  2831. -CAP_ALL
  2832. bind disabled
  2833. connect disabled
  2834. }
  2835.  
  2836. # Role: root
  2837. subject /usr/sbin/lightdm o {
  2838. / h
  2839. /bin h
  2840. /bin/dash x
  2841. /bin/plymouth x
  2842. /dev h
  2843. /dev/console r
  2844. /dev/log rw
  2845. /dev/null rw
  2846. /etc r
  2847. /etc/grsec h
  2848. /etc/gshadow h
  2849. /etc/gshadow- h
  2850. /etc/ppp h
  2851. /etc/samba/smbpasswd h
  2852. /etc/shadow- h
  2853. /etc/ssh h
  2854. /lib rx
  2855. /lib/modules h
  2856. /proc r
  2857. /proc/bus h
  2858. /proc/kallsyms h
  2859. /proc/kcore h
  2860. /proc/modules h
  2861. /proc/slabinfo h
  2862. /run h
  2863. /run/dbus/system_bus_socket rw
  2864. /run/lightdm/root/:0 wd
  2865. /run/user
  2866. /run/user/.colin.lock rwcd
  2867. /run/user/.lightdm.lock rwcd
  2868. /run/user/colin wc
  2869. /run/user/lightdm wc
  2870. /run/utmp rw
  2871. /sbin h
  2872. /sbin/initctl x
  2873. /selinux
  2874. /usr h
  2875. /usr/lib h
  2876. /usr/lib/x86_64-linux-gnu rx
  2877. /usr/sbin h
  2878. /usr/sbin/lightdm x
  2879. /usr/sbin/lightdm-session
  2880. /usr/sbin/unity-greeter
  2881. /usr/share h
  2882. /usr/share/xgreeters/unity-greeter.desktop r
  2883. /usr/share/xsessions/ubuntu.desktop r
  2884. /var
  2885. /var/backups h
  2886. /var/cache
  2887. /var/cache/lightdm
  2888. /var/cache/lightdm/dmrc rwcd
  2889. /var/log/lightdm/x-0-greeter.log rwcd
  2890. /var/log/lightdm/x-0-greeter.log.old rwcd
  2891. -CAP_ALL
  2892. +CAP_CHOWN
  2893. +CAP_KILL
  2894. +CAP_SETGID
  2895. +CAP_SETUID
  2896. +CAP_IPC_LOCK
  2897. +CAP_SYS_TTY_CONFIG
  2898. +CAP_AUDIT_WRITE
  2899. bind disabled
  2900. connect disabled
  2901. sock_allow_family netlink
  2902. }
  2903.  
  2904. # Role: root
  2905. subject /usr/sbin/modem-manager o {
  2906. / h
  2907. /dev/console w
  2908. /dev/log rw
  2909. -CAP_ALL
  2910. +CAP_SYS_TTY_CONFIG
  2911. bind disabled
  2912. connect disabled
  2913. }
  2914.  
  2915. # Role: root
  2916. subject /usr/sbin/ntpdate o {
  2917. / h
  2918. /dev h
  2919. /dev/log rw
  2920. /etc r
  2921. /etc/grsec h
  2922. /etc/gshadow h
  2923. /etc/gshadow- h
  2924. /etc/passwd h
  2925. /etc/ppp h
  2926. /etc/samba/smbpasswd h
  2927. /etc/shadow h
  2928. /etc/shadow- h
  2929. /etc/ssh h
  2930. /lib
  2931. /lib/modules h
  2932. /lib/x86_64-linux-gnu rx
  2933. /run h
  2934. /run/resolvconf/resolv.conf r
  2935. /usr h
  2936. /usr/lib
  2937. /usr/sbin/ntpdate x
  2938. -CAP_ALL
  2939. +CAP_NET_BIND_SERVICE
  2940. +CAP_SYS_NICE
  2941. +CAP_SYS_TIME
  2942. bind 0.0.0.0/32:0 dgram ip udp
  2943. bind 0.0.0.0/32:123 dgram ip udp
  2944. connect 91.189.94.4/32:123 dgram udp
  2945. connect 91.189.89.199/32:123 dgram udp
  2946. connect 149.15.3.1/32:53 dgram udp
  2947. connect 149.15.3.2/32:53 dgram udp
  2948. sock_allow_family ipv6 netlink
  2949. }
  2950.  
  2951. # Role: root
  2952. subject /usr/sbin/pm-powersave o {
  2953. / h
  2954. /bin x
  2955. /dev h
  2956. /dev/null w
  2957. /dev/snapshot
  2958. /etc h
  2959. /etc/ld.so.cache r
  2960. /etc/pm/config.d
  2961. /etc/pm/power.d
  2962. /lib h
  2963. /lib/x86_64-linux-gnu/ld-2.17.so x
  2964. /lib/x86_64-linux-gnu/libc-2.17.so rx
  2965. /run h
  2966. /run/pm-utils/locks/pm-powersave.lock r
  2967. /sys h
  2968. /sys/devices/pnp0/00:05/rtc/rtc0/wakealarm w
  2969. /sys/power/disk
  2970. /usr h
  2971. /usr/bin h
  2972. /usr/bin/flock x
  2973. /usr/bin/sort x
  2974. /usr/bin/uniq x
  2975. /usr/lib rx
  2976. /usr/sbin h
  2977. /usr/sbin/pm-powersave r
  2978. /var h
  2979. /var/log/pm-powersave.log a
  2980. -CAP_ALL
  2981. bind disabled
  2982. connect disabled
  2983. }
  2984.  
  2985. role colin u
  2986. role_allow_ip 0.0.0.0/32
  2987. # Role: colin
  2988. subject / {
  2989. /
  2990. /bin rx
  2991. /boot h
  2992. /dev h
  2993. /dev/fuse rw
  2994. /dev/null rw
  2995. /dev/tty rw
  2996. /dev/urandom r
  2997. /etc r
  2998. /etc/grsec h
  2999. /etc/gshadow h
  3000. /etc/gshadow- h
  3001. /etc/ppp h
  3002. /etc/samba/smbpasswd h
  3003. /etc/shadow h
  3004. /etc/shadow- h
  3005. /etc/ssh h
  3006. /home
  3007. /home/colin rwcd
  3008. /home/colin/.config r
  3009. /home/colin/.config/gtk-3.0 rwcd
  3010. /home/colin/.dbus
  3011. /home/colin/.dbus/session-bus
  3012. /home/colin/.dbus/session-bus/2a7c9e4458ccbfd5a964c1c0520b0164-0 w
  3013. /home/colin/.jdownloader
  3014. /home/colin/.jdownloader/jdownloader.log w
  3015. /lib rx
  3016. /lib/modules h
  3017. /lib64/modules h
  3018. /media h
  3019. /media/colin/56E6F045E6F026C1
  3020. /opt
  3021. /opt/google
  3022. /opt/google/chrome
  3023. /opt/google/chrome/chrome x
  3024. /opt/google/chrome/google-chrome r
  3025. /proc r
  3026. /proc/bus h
  3027. /proc/kallsyms h
  3028. /proc/kcore h
  3029. /proc/modules h
  3030. /proc/slabinfo h
  3031. /run
  3032. /run/user
  3033. /run/user/colin
  3034. /sbin rx
  3035. /sys h
  3036. /tmp rwcd
  3037. /usr
  3038. /usr/bin rx
  3039. /usr/lib rx
  3040. /usr/local h
  3041. /usr/local/bin
  3042. /usr/local/games
  3043. /usr/local/lib h
  3044. /usr/local/lib/python2.7/dist-packages
  3045. /usr/local/lib/python3.3/dist-packages
  3046. /usr/local/sbin
  3047. /usr/sbin rx
  3048. /usr/share rx
  3049. /usr/src h
  3050. /var h
  3051. /var/lib/apt r
  3052. /var/lib/dbus/machine-id r
  3053. /var/lib/dpkg/arch r
  3054. /var/lib/dpkg/status r
  3055. -CAP_ALL
  3056. bind disabled
  3057. connect disabled
  3058. }
  3059.  
  3060. # Role: colin
  3061. subject /bin/fusermount o {
  3062. user_transition_allow nobody colin root
  3063.  
  3064. /
  3065. /bin h
  3066. /bin/fusermount x
  3067. /boot h
  3068. /dev h
  3069. /dev/fuse rw
  3070. /etc rw
  3071. /etc/grsec h
  3072. /etc/gshadow h
  3073. /etc/gshadow- h
  3074. /etc/ppp h
  3075. /etc/samba/smbpasswd h
  3076. /etc/shadow h
  3077. /etc/shadow- h
  3078. /etc/ssh h
  3079. /lib h
  3080. /lib/x86_64-linux-gnu rx
  3081. /lib64/modules h
  3082. /proc/bus h
  3083. /proc/kallsyms h
  3084. /proc/kcore h
  3085. /proc/modules h
  3086. /proc/slabinfo h
  3087. /proc/sys h
  3088. /run
  3089. /run/user
  3090. /run/user/colin
  3091. /run/user/colin/gvfs w
  3092. /sys h
  3093. /usr/src h
  3094. /var/backups h
  3095. /var/log h
  3096. -CAP_ALL
  3097. +CAP_DAC_READ_SEARCH
  3098. +CAP_SETUID
  3099. +CAP_SYS_ADMIN
  3100. bind disabled
  3101. connect disabled
  3102. }
  3103.  
  3104. # Role: colin
  3105. subject /bin/ps o {
  3106. / h
  3107. /bin h
  3108. /bin/ps x
  3109. /dev h
  3110. /dev/tty r
  3111. /etc h
  3112. /etc/ld.so.cache r
  3113. /etc/locale.alias r
  3114. /lib h
  3115. /lib/x86_64-linux-gnu/ld-2.17.so x
  3116. /lib/x86_64-linux-gnu/libc-2.17.so rx
  3117. /lib/x86_64-linux-gnu/libprocps.so.0.0.1 rx
  3118. /proc r
  3119. /proc/bus h
  3120. /proc/kallsyms h
  3121. /proc/kcore h
  3122. /proc/modules h
  3123. /proc/slabinfo h
  3124. /sys h
  3125. /sys/devices/system/cpu/online r
  3126. /usr h
  3127. /usr/lib/locale/locale-archive r
  3128. /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache r
  3129. -CAP_ALL
  3130. bind disabled
  3131. connect disabled
  3132. }
  3133.  
  3134. # Role: colin
  3135. subject /opt/google/chrome/chrome o {
  3136. /
  3137. /boot h
  3138. /dev
  3139. /dev/dri
  3140. /dev/dri/card0 rw
  3141. /dev/kmem h
  3142. /dev/null rw
  3143. /dev/port h
  3144. /dev/urandom r
  3145. /dev/video0 r
  3146. /etc r
  3147. /etc/grsec h
  3148. /etc/gshadow h
  3149. /etc/gshadow- h
  3150. /etc/ppp h
  3151. /etc/samba/smbpasswd h
  3152. /etc/shadow h
  3153. /etc/shadow- h
  3154. /etc/ssh h
  3155. /home
  3156. /home/colin r
  3157. /home/colin/.cache rwcd
  3158. /home/colin/.config r
  3159. /home/colin/.config/autostart
  3160. /home/colin/.config/autostart/google-chrome.desktop w
  3161. /home/colin/.config/dconf h
  3162. /home/colin/.config/dconf/user r
  3163. /home/colin/.config/google-chrome rwcd
  3164. /home/colin/.config/google-chrome/Default rwcd
  3165. /home/colin/.config/google-chrome/Default/Extensions r
  3166. /home/colin/.config/google-chrome/Default/IndexedDB r
  3167. /home/colin/.config/google-chrome/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb rwcd
  3168. "/home/colin/.config/google-chrome/Default/Sync Extension Settings" r
  3169. "/home/colin/.config/google-chrome/Default/Sync Extension Settings/lchjmipalpepigcllfdhodncacnhifon" rwcd
  3170. "/home/colin/.config/google-chrome/Default/Sync Extension Settings/oiigbmnaadbkfbmpbfijlflahbdbdgdf" rwcd
  3171. "/home/colin/.config/google-chrome/Default/User StyleSheets" r
  3172. /home/colin/.config/google-chrome/Default/databases rw
  3173. /home/colin/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0 rwcd
  3174. /home/colin/.config/google-chrome/Dictionaries r
  3175. /home/colin/.config/google-chrome/pnacl
  3176. /home/colin/.config/google-chrome/pnacl/0.1.0.12036 r
  3177. /home/colin/.config/google-chrome/pnacl/0.1.0.12036/_platform_specific
  3178. /home/colin/.config/google-chrome/pnacl/0.1.0.12036/_platform_specific/x86_64 r
  3179. /home/colin/.config/ibus
  3180. /home/colin/.config/ibus/bus w
  3181. /home/colin/.config/pulse h
  3182. /home/colin/.config/pulse/cookie r
  3183. /home/colin/.local r
  3184. /home/colin/.local/share/icons
  3185. /home/colin/.pki
  3186. /home/colin/.pki/nssdb
  3187. /home/colin/.pki/nssdb/cert9.db rw
  3188. /home/colin/.pki/nssdb/key4.db rw
  3189. /home/colin/.pki/nssdb/pkcs11.txt r
  3190. /lib rx
  3191. /lib/modules h
  3192. /lib64/modules h
  3193. /opt
  3194. /opt/google r
  3195. /opt/google/chrome rxwc
  3196. /opt/google/chrome/PepperFlash h
  3197. /opt/google/chrome/PepperFlash/libpepflashplayer.so rx
  3198. /opt/google/chrome/lib
  3199. /opt/google/chrome/lib/libpeerconnection.so rx
  3200. /opt/google/chrome/locales
  3201. /opt/google/chrome/locales/en-US.pak r
  3202. /proc rw
  3203. /proc/bus h
  3204. /proc/kallsyms h
  3205. /proc/kcore h
  3206. /proc/modules h
  3207. /proc/slabinfo h
  3208. /run r
  3209. /run/resolvconf
  3210. /run/resolvconf/resolv.conf r
  3211. /run/shm rwcd
  3212. /run/udev
  3213. /run/udev/data r
  3214. /run/user
  3215. /run/user/colin
  3216. /run/user/colin/dconf
  3217. /run/user/colin/dconf/user rw
  3218. /run/user/colin/pulse/native rw
  3219. /sys r
  3220. /tmp rwcd
  3221. /usr
  3222. /usr/bin h
  3223. /usr/bin/lsb_release x
  3224. /usr/bin/xdg-settings x
  3225. /usr/lib rx
  3226. /usr/local h
  3227. /usr/local/share/fonts
  3228. /usr/share r
  3229. /usr/src h
  3230. /var h
  3231. /var/cache h
  3232. /var/cache/fontconfig r
  3233. /var/lib h
  3234. /var/lib/dbus/machine-id r
  3235. /var/tmp rwcd
  3236. -CAP_ALL
  3237. bind 0.0.0.0/32:1024-65535 dgram ip udp
  3238. bind 0.0.0.0/32:0 dgram ip udp
  3239. connect 0.0.0.0/0:443 stream dgram tcp udp
  3240. connect 0.0.0.0/0:80 stream dgram tcp udp
  3241. connect 0.0.0.0/0:0 stream dgram tcp udp
  3242. connect 0.0.0.0/0:5222 stream dgram tcp udp
  3243. connect 0.0.0.0/0:53 stream dgram tcp udp
  3244. sock_allow_family ipv6 netlink
  3245. }
  3246.  
  3247. # Role: colin
  3248. subject /opt/google/chrome/chrome-sandbox o {
  3249. user_transition_allow colin nobody
  3250. group_transition_allow colin nogroup
  3251.  
  3252. / h
  3253. /etc h
  3254. /etc/ld.so.cache r
  3255. /lib h
  3256. /lib/x86_64-linux-gnu/ld-2.17.so x
  3257. /lib/x86_64-linux-gnu/libc-2.17.so rx
  3258. /lib/x86_64-linux-gnu/libpthread-2.17.so rx
  3259. /opt h
  3260. /opt/google/chrome/chrome x
  3261. /opt/google/chrome/chrome-sandbox x
  3262. /proc w
  3263. /proc/bus h
  3264. /proc/kallsyms h
  3265. /proc/kcore h
  3266. /proc/modules h
  3267. /proc/slabinfo h
  3268. /proc/sys h
  3269. -CAP_ALL
  3270. +CAP_DAC_READ_SEARCH
  3271. +CAP_SETGID
  3272. +CAP_SETUID
  3273. +CAP_SYS_CHROOT
  3274. +CAP_SYS_PTRACE
  3275. +CAP_SYS_ADMIN
  3276. bind disabled
  3277. connect disabled
  3278. }
  3279.  
  3280. # Role: colin
  3281. subject /opt/google/chrome/nacl_helper o {
  3282. / h
  3283. /dev h
  3284. /dev/urandom r
  3285. /etc h
  3286. /etc/ld.so.cache r
  3287. /lib rx
  3288. /lib/modules h
  3289. /opt h
  3290. /opt/google/chrome/nacl_helper rx
  3291. /proc
  3292. /proc/bus h
  3293. /proc/cpuinfo r
  3294. /proc/filesystems r
  3295. /proc/kallsyms h
  3296. /proc/kcore h
  3297. /proc/modules h
  3298. /proc/slabinfo h
  3299. /proc/sys h
  3300. /selinux
  3301. /sys h
  3302. /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq r
  3303. /sys/devices/system/cpu/online r
  3304. /usr h
  3305. /usr/lib rx
  3306. -CAP_ALL
  3307. bind disabled
  3308. connect disabled
  3309. }
  3310.  
  3311. # Role: colin
  3312. subject /usr/bin/compiz o {
  3313. / h
  3314. /bin h
  3315. /bin/dash x
  3316. /dev h
  3317. /dev/dri/card0 rw
  3318. /dev/null r
  3319. /etc r
  3320. /etc/grsec h
  3321. /etc/gshadow h
  3322. /etc/gshadow- h
  3323. /etc/ppp h
  3324. /etc/samba/smbpasswd h
  3325. /etc/shadow h
  3326. /etc/shadow- h
  3327. /etc/ssh h
  3328. /home
  3329. /home/colin r
  3330. /home/colin/.cache rwcd
  3331. /home/colin/.config
  3332. /home/colin/.config/compiz-1/compizconfig
  3333. /home/colin/.config/compiz-1/compizconfig/config ra
  3334. /home/colin/.config/compiz-1/compizconfig/done_upgrades ra
  3335. /home/colin/.config/dconf/user r
  3336. /home/colin/.config/ibus
  3337. /home/colin/.config/ibus/bus w
  3338. /home/colin/.local r
  3339. /home/colin/.local/share/icons
  3340. /lib rx
  3341. /lib/modules h
  3342. /opt h
  3343. /opt/google/chrome/google-chrome x
  3344. /proc
  3345. /proc/bus h
  3346. /proc/filesystems r
  3347. /proc/kallsyms h
  3348. /proc/kcore h
  3349. /proc/meminfo r
  3350. /proc/modules h
  3351. /proc/slabinfo h
  3352. /proc/sys/vm/overcommit_memory r
  3353. /run
  3354. /run/dbus/system_bus_socket rw
  3355. /run/user
  3356. /run/user/colin
  3357. /run/user/colin/dconf
  3358. /run/user/colin/dconf/user rwc
  3359. /selinux
  3360. /sys h
  3361. /sys/devices/system/cpu/online r
  3362. /tmp rwcd
  3363. /usr h
  3364. /usr/bin x
  3365. /usr/lib rx
  3366. /usr/local h
  3367. /usr/local/share/fonts
  3368. /usr/share r
  3369. /var h
  3370. /var/cache h
  3371. /var/cache/fontconfig r
  3372. /var/lib h
  3373. /var/lib/dbus/machine-id r
  3374. -CAP_ALL
  3375. bind disabled
  3376. connect disabled
  3377. }
  3378.  
  3379. # Role: colin
  3380. subject /usr/bin/eog o {
  3381. / h
  3382. /dev h
  3383. /dev/urandom r
  3384. /etc r
  3385. /etc/grsec h
  3386. /etc/gshadow h
  3387. /etc/gshadow- h
  3388. /etc/passwd h
  3389. /etc/ppp h
  3390. /etc/samba/smbpasswd h
  3391. /etc/shadow h
  3392. /etc/shadow- h
  3393. /etc/ssh h
  3394. /home
  3395. /home/colin rwcd
  3396. /lib rx
  3397. /lib/modules h
  3398. /proc h
  3399. /proc/filesystems r
  3400. /run
  3401. /run/user
  3402. /run/user/colin
  3403. /run/user/colin/dconf
  3404. /run/user/colin/dconf/user rwc
  3405. /selinux
  3406. /usr h
  3407. /usr/bin h
  3408. /usr/bin/env
  3409. /usr/bin/eog x
  3410. /usr/bin/shotwell
  3411. /usr/lib rx
  3412. /usr/local h
  3413. /usr/local/share/fonts
  3414. /usr/share r
  3415. /var h
  3416. /var/cache h
  3417. /var/cache/fontconfig r
  3418. -CAP_ALL
  3419. bind disabled
  3420. connect disabled
  3421. }
  3422.  
  3423. # Role: colin
  3424. subject /usr/bin/gedit o {
  3425. /
  3426. /boot h
  3427. /dev h
  3428. /dev/urandom r
  3429. /etc r
  3430. /etc/grsec h
  3431. /etc/gshadow h
  3432. /etc/gshadow- h
  3433. /etc/ppp h
  3434. /etc/samba/smbpasswd h
  3435. /etc/shadow h
  3436. /etc/shadow- h
  3437. /etc/ssh h
  3438. /home
  3439. /home/colin r
  3440. /home/colin/.config r
  3441. /home/colin/.config/dconf h
  3442. /home/colin/.config/dconf/user r
  3443. /home/colin/.config/enchant
  3444. /home/colin/.config/enchant/en_US.dic ra
  3445. /home/colin/.config/enchant/en_US.exc ra
  3446. /home/colin/.config/gedit
  3447. /home/colin/.config/gedit/accels rw
  3448. /home/colin/.config/gtk-3.0
  3449. /home/colin/.config/gtk-3.0/bookmarks r
  3450. /home/colin/.config/ibus
  3451. /home/colin/.config/ibus/bus w
  3452. /home/colin/.local rwcd
  3453. /home/colin/Documents rw
  3454. /lib rx
  3455. /lib/modules h
  3456. /lib64/modules h
  3457. /proc h
  3458. /proc/filesystems r
  3459. /run
  3460. /run/user
  3461. /run/user/colin
  3462. /run/user/colin/dconf
  3463. /run/user/colin/dconf/user rwc
  3464. /sys h
  3465. /usr h
  3466. /usr/bin h
  3467. /usr/bin/gedit x
  3468. /usr/lib rx
  3469. /usr/local h
  3470. /usr/local/share/fonts
  3471. /usr/share r
  3472. /var h
  3473. /var/cache h
  3474. /var/cache/fontconfig r
  3475. /var/lib h
  3476. /var/lib/dbus/machine-id r
  3477. -CAP_ALL
  3478. bind disabled
  3479. connect disabled
  3480. }
  3481.  
  3482. # Role: colin
  3483. subject /usr/bin/gnome-control-center o {
  3484. / h
  3485. /dev h
  3486. /dev/urandom r
  3487. /etc r
  3488. /etc/grsec h
  3489. /etc/gshadow h
  3490. /etc/gshadow- h
  3491. /etc/passwd h
  3492. /etc/ppp h
  3493. /etc/samba/smbpasswd h
  3494. /etc/shadow h
  3495. /etc/shadow- h
  3496. /etc/ssh h
  3497. /home
  3498. /home/colin r
  3499. /home/colin/.config
  3500. /home/colin/.config/dconf/user r
  3501. /home/colin/.config/ibus
  3502. /home/colin/.config/ibus/bus w
  3503. /home/colin/.config/pulse/cookie r
  3504. /lib rx
  3505. /lib/modules h
  3506. /opt h
  3507. /opt/google/chrome/google-chrome
  3508. /proc
  3509. /proc/bus h
  3510. /proc/filesystems r
  3511. /proc/kallsyms h
  3512. /proc/kcore h
  3513. /proc/modules h
  3514. /proc/slabinfo h
  3515. /proc/sys h
  3516. /run rwcd
  3517. /selinux
  3518. /usr
  3519. /usr/bin x
  3520. /usr/games h
  3521. /usr/games/gnome-mahjongg
  3522. /usr/games/gnome-mines
  3523. /usr/games/gnome-sudoku
  3524. /usr/games/sol
  3525. /usr/lib rx
  3526. /usr/local
  3527. /usr/local/share
  3528. /usr/share r
  3529. /usr/src h
  3530. /var h
  3531. /var/cache h
  3532. /var/cache/fontconfig r
  3533. /var/lib h
  3534. /var/lib/dbus/machine-id r
  3535. -CAP_ALL
  3536. bind disabled
  3537. connect disabled
  3538. }
  3539.  
  3540. # Role: colin
  3541. subject /usr/bin/gnome-keyring-daemon o {
  3542. / h
  3543. /dev h
  3544. /dev/log rw
  3545. /dev/null r
  3546. /dev/random
  3547. /dev/urandom r
  3548. /etc h
  3549. /etc/ld.so.cache r
  3550. /etc/locale.alias r
  3551. /etc/localtime r
  3552. /home
  3553. /home/colin
  3554. /home/colin/.config/dconf/user r
  3555. /home/colin/.local r
  3556. /home/colin/.local/share
  3557. /home/colin/.local/share/keyrings rwcdl
  3558. /lib rx
  3559. /lib/modules h
  3560. /proc r
  3561. /proc/bus h
  3562. /proc/kallsyms h
  3563. /proc/kcore h
  3564. /proc/modules h
  3565. /proc/slabinfo h
  3566. /proc/sys h
  3567. /run rwc
  3568. /selinux
  3569. /usr h
  3570. /usr/bin h
  3571. /usr/bin/gnome-keyring-daemon x
  3572. /usr/lib rx
  3573. /usr/share r
  3574. -CAP_ALL
  3575. +CAP_IPC_LOCK
  3576. bind disabled
  3577. connect disabled
  3578. }
  3579.  
  3580. # Role: colin
  3581. subject /usr/bin/gnome-screensaver o {
  3582. / h
  3583. /etc h
  3584. /etc/gtk-3.0/settings.ini r
  3585. /etc/ld.so.cache r
  3586. /etc/locale.alias r
  3587. /home h
  3588. /home/colin
  3589. /home/colin/.Xauthority r
  3590. /home/colin/.config/dconf/user r
  3591. /home/colin/.local/share/mime/mime.cache r
  3592. /home/colin/Pictures/Wallpapers
  3593. /lib rx
  3594. /lib/modules h
  3595. /proc h
  3596. /proc/filesystems r
  3597. /run
  3598. /run/dbus/system_bus_socket rw
  3599. /run/user
  3600. /run/user/colin
  3601. /run/user/colin/dconf
  3602. /run/user/colin/dconf/user rw
  3603. /selinux
  3604. /usr h
  3605. /usr/bin h
  3606. /usr/bin/gnome-screensaver x
  3607. /usr/lib rx
  3608. /usr/share r
  3609. -CAP_ALL
  3610. bind disabled
  3611. connect disabled
  3612. }
  3613.  
  3614. # Role: colin
  3615. subject /usr/bin/gnome-screenshot o {
  3616. /
  3617. /boot h
  3618. /dev h
  3619. /dev/urandom r
  3620. /etc r
  3621. /etc/grsec h
  3622. /etc/gshadow h
  3623. /etc/gshadow- h
  3624. /etc/passwd h
  3625. /etc/ppp h
  3626. /etc/samba/smbpasswd h
  3627. /etc/shadow h
  3628. /etc/shadow- h
  3629. /etc/ssh h
  3630. /home
  3631. /home/colin r
  3632. /home/colin/.cache
  3633. /home/colin/.cache/event-sound-cache.tdb.2a7c9e4458ccbfd5a964c1c0520b0164.x86_64-pc-linux-gnu rw
  3634. /home/colin/.config r
  3635. /home/colin/.config/dconf h
  3636. /home/colin/.config/dconf/user r
  3637. /home/colin/.config/gtk-3.0
  3638. /home/colin/.config/gtk-3.0/bookmarks r
  3639. /home/colin/.config/ibus
  3640. /home/colin/.config/ibus/bus w
  3641. /home/colin/.config/pulse h
  3642. /home/colin/.config/pulse/cookie r
  3643. /home/colin/.local
  3644. /home/colin/.local/share rwcd
  3645. /home/colin/.local/share/icons
  3646. /home/colin/Pictures
  3647. "/home/colin/Pictures/Screenshot from 2013-08-28 23:13:42.png" r
  3648. /home/colin/Pictures/oooo.png r
  3649. /lib rx
  3650. /lib/modules h
  3651. /lib64/modules h
  3652. /proc
  3653. /proc/bus h
  3654. /proc/filesystems r
  3655. /proc/kallsyms h
  3656. /proc/kcore h
  3657. /proc/meminfo r
  3658. /proc/modules h
  3659. /proc/slabinfo h
  3660. /proc/sys/vm/overcommit_memory r
  3661. /run rwc
  3662. /sys h
  3663. /sys/devices/system/cpu/online r
  3664. /usr h
  3665. /usr/bin h
  3666. /usr/bin/gnome-screenshot x
  3667. /usr/lib rx
  3668. /usr/local h
  3669. /usr/local/share/fonts
  3670. /usr/share r
  3671. /var h
  3672. /var/cache h
  3673. /var/cache/fontconfig r
  3674. /var/lib h
  3675. /var/lib/dbus/machine-id r
  3676. -CAP_ALL
  3677. bind disabled
  3678. connect disabled
  3679. }
  3680.  
  3681. # Role: colin
  3682. subject /usr/bin/gnome-session o {
  3683. / h
  3684. /bin h
  3685. /bin/dash x
  3686. /dev h
  3687. /dev/null r
  3688. /dev/urandom r
  3689. /etc r
  3690. /etc/grsec h
  3691. /etc/gshadow h
  3692. /etc/gshadow- h
  3693. /etc/passwd h
  3694. /etc/ppp h
  3695. /etc/samba/smbpasswd h
  3696. /etc/shadow h
  3697. /etc/shadow- h
  3698. /etc/ssh h
  3699. /home h
  3700. /home/colin h
  3701. /home/colin/.ICEauthority rw
  3702. /home/colin/.ICEauthority-c wcdl
  3703. /home/colin/.ICEauthority-l wd
  3704. /home/colin/.Xauthority r
  3705. /home/colin/.config h
  3706. /home/colin/.config/autostart
  3707. /home/colin/.config/autostart/google-chrome.desktop r
  3708. /home/colin/.config/dconf/user r
  3709. /home/colin/.config/gnome-session/saved-session
  3710. /lib rx
  3711. /lib/modules h
  3712. /opt h
  3713. /opt/google/chrome/google-chrome x
  3714. /proc
  3715. /proc/bus h
  3716. /proc/filesystems r
  3717. /proc/kallsyms h
  3718. /proc/kcore h
  3719. /proc/modules h
  3720. /proc/slabinfo h
  3721. /proc/sys h
  3722. /run
  3723. /run/dbus/system_bus_socket rw
  3724. /run/user
  3725. /run/user/colin
  3726. /run/user/colin/dconf
  3727. /run/user/colin/dconf/user rwc
  3728. /selinux
  3729. /tmp wc
  3730. /usr h
  3731. /usr/bin x
  3732. /usr/lib rx
  3733. /usr/share r
  3734. -CAP_ALL
  3735. bind disabled
  3736. connect disabled
  3737. }
  3738.  
  3739. # Role: colin
  3740. subject /usr/bin/gnome-terminal o {
  3741. / h
  3742. /bin h
  3743. /bin/bash x
  3744. /dev h
  3745. /dev/null r
  3746. /dev/pts rw
  3747. /dev/urandom r
  3748. /etc r
  3749. /etc/grsec h
  3750. /etc/gshadow h
  3751. /etc/gshadow- h
  3752. /etc/ppp h
  3753. /etc/samba/smbpasswd h
  3754. /etc/shadow h
  3755. /etc/shadow- h
  3756. /etc/ssh h
  3757. /home
  3758. /home/colin r
  3759. /home/colin/.config
  3760. /home/colin/.config/dconf/user r
  3761. /home/colin/.config/ibus
  3762. /home/colin/.config/ibus/bus w
  3763. /home/colin/.local r
  3764. /home/colin/.local/share/icons
  3765. /lib rx
  3766. /lib/modules h
  3767. /proc
  3768. /proc/bus h
  3769. /proc/filesystems r
  3770. /proc/kallsyms h
  3771. /proc/kcore h
  3772. /proc/modules h
  3773. /proc/slabinfo h
  3774. /proc/sys h
  3775. /run
  3776. /run/user
  3777. /run/user/colin
  3778. /run/user/colin/dconf
  3779. /run/user/colin/dconf/user rw
  3780. /selinux
  3781. /tmp rwcd
  3782. /usr h
  3783. /usr/bin h
  3784. /usr/bin/gnome-terminal x
  3785. /usr/lib rx
  3786. /usr/local h
  3787. /usr/local/share/fonts
  3788. /usr/share r
  3789. /var h
  3790. /var/cache h
  3791. /var/cache/fontconfig r
  3792. /var/lib h
  3793. /var/lib/dbus/machine-id r
  3794. -CAP_ALL
  3795. bind disabled
  3796. connect disabled
  3797. }
  3798.  
  3799. # Role: colin
  3800. subject /usr/bin/gsettings o {
  3801. / h
  3802. /etc h
  3803. /etc/ld.so.cache r
  3804. /etc/locale.alias r
  3805. /home h
  3806. /home/colin/.config/dconf/user r
  3807. /lib rx
  3808. /lib/modules h
  3809. /proc h
  3810. /proc/filesystems r
  3811. /run
  3812. /run/user
  3813. /run/user/colin
  3814. /run/user/colin/dconf rwc
  3815. /selinux
  3816. /usr h
  3817. /usr/bin h
  3818. /usr/bin/gsettings x
  3819. /usr/lib rx
  3820. /usr/share r
  3821. /var h
  3822. /var/lib/dbus/machine-id r
  3823. -CAP_ALL
  3824. bind disabled
  3825. connect disabled
  3826. }
  3827.  
  3828. # Role: colin
  3829. subject /usr/bin/gtk-window-decorator o {
  3830. / h
  3831. /etc r
  3832. /etc/grsec h
  3833. /etc/gshadow h
  3834. /etc/gshadow- h
  3835. /etc/passwd h
  3836. /etc/ppp h
  3837. /etc/samba/smbpasswd h
  3838. /etc/shadow h
  3839. /etc/shadow- h
  3840. /etc/ssh h
  3841. /home h
  3842. /home/colin/.Xauthority r
  3843. /home/colin/.config/dconf/user r
  3844. /home/colin/.local/share/mime/mime.cache r
  3845. /lib rx
  3846. /lib/modules h
  3847. /proc h
  3848. /proc/filesystems r
  3849. /run
  3850. /run/user
  3851. /run/user/colin
  3852. /run/user/colin/dconf
  3853. /run/user/colin/dconf/user rw
  3854. /selinux
  3855. /usr h
  3856. /usr/bin h
  3857. /usr/bin/gtk-window-decorator x
  3858. /usr/lib rx
  3859. /usr/local h
  3860. /usr/local/share/fonts
  3861. /usr/share r
  3862. /var h
  3863. /var/cache h
  3864. /var/cache/fontconfig r
  3865. -CAP_ALL
  3866. bind disabled
  3867. connect disabled
  3868. }
  3869.  
  3870. # Role: colin
  3871. subject /usr/bin/indicator-cpufreq o {
  3872. / h
  3873. /dev h
  3874. /dev/null rw
  3875. /dev/urandom r
  3876. /etc r
  3877. /etc/grsec h
  3878. /etc/gshadow h
  3879. /etc/gshadow- h
  3880. /etc/gtk-3.0 h
  3881. /etc/gtk-3.0/settings.ini r
  3882. /etc/passwd h
  3883. /etc/ppp h
  3884. /etc/python3.3 h
  3885. /etc/python3.3/sitecustomize.py
  3886. /etc/samba/smbpasswd h
  3887. /etc/shadow h
  3888. /etc/shadow- h
  3889. /etc/ssh h
  3890. /home h
  3891. /home/colin rxwcd
  3892. /lib rx
  3893. /lib/modules h
  3894. /proc r
  3895. /proc/bus h
  3896. /proc/kallsyms h
  3897. /proc/kcore h
  3898. /proc/modules h
  3899. /proc/mounts
  3900. /proc/slabinfo h
  3901. /proc/sys h
  3902. /run rxwcd
  3903. /sbin h
  3904. /sbin/ldconfig x
  3905. /selinux
  3906. /sys r
  3907. /tmp rxwcd
  3908. /usr
  3909. /usr/bin rx
  3910. /usr/lib rx
  3911. /usr/local h
  3912. /usr/local/lib/python3.3/dist-packages
  3913. /usr/share r
  3914. /usr/src h
  3915. /var h
  3916. /var/tmp rxwcd
  3917. -CAP_ALL
  3918. bind disabled
  3919. connect disabled
  3920. }
  3921.  
  3922. # Role: colin
  3923. subject /usr/bin/keepassx o {
  3924. / h
  3925. /dev h
  3926. /dev/urandom r
  3927. /etc r
  3928. /etc/grsec h
  3929. /etc/gshadow h
  3930. /etc/gshadow- h
  3931. /etc/ppp h
  3932. /etc/samba/smbpasswd h
  3933. /etc/shadow h
  3934. /etc/shadow- h
  3935. /etc/ssh h
  3936. /home
  3937. /home/colin
  3938. /home/colin/.ICEauthority r
  3939. /home/colin/.Xauthority r
  3940. /home/colin/.config
  3941. /home/colin/.config/Trolltech.conf r
  3942. /home/colin/.config/ibus
  3943. /home/colin/.config/ibus/bus w
  3944. /home/colin/.config/keepassx
  3945. /home/colin/.config/keepassx/config.ini rw
  3946. /lib rx
  3947. /lib/modules h
  3948. /media
  3949. /proc r
  3950. /proc/bus h
  3951. /proc/kallsyms h
  3952. /proc/kcore h
  3953. /proc/modules h
  3954. /proc/slabinfo h
  3955. /proc/sys h
  3956. /selinux
  3957. /sys h
  3958. /sys/devices/system/cpu/online r
  3959. /tmp wcd
  3960. /usr
  3961. /usr/bin
  3962. /usr/bin/keepassx x
  3963. /usr/lib rx
  3964. /usr/local h
  3965. /usr/local/share/fonts
  3966. /usr/share r
  3967. /usr/src h
  3968. /var h
  3969. /var/cache h
  3970. /var/cache/fontconfig r
  3971. /var/lib h
  3972. /var/lib/dbus/machine-id r
  3973. -CAP_ALL
  3974. bind disabled
  3975. connect disabled
  3976. }
  3977.  
  3978. # Role: colin
  3979. subject /usr/bin/nautilus o {
  3980. /
  3981. /boot h
  3982. /dev h
  3983. /dev/null r
  3984. /dev/urandom r
  3985. /etc r
  3986. /etc/grsec h
  3987. /etc/gshadow h
  3988. /etc/gshadow- h
  3989. /etc/ppp h
  3990. /etc/samba/smbpasswd h
  3991. /etc/shadow h
  3992. /etc/shadow- h
  3993. /etc/ssh h
  3994. /home
  3995. /home/colin rwcd
  3996. /lib rx
  3997. /lib/modules h
  3998. /lib64/modules h
  3999. /media rwc
  4000. /proc r
  4001. /proc/bus h
  4002. /proc/kallsyms h
  4003. /proc/kcore h
  4004. /proc/modules h
  4005. /proc/slabinfo h
  4006. /run rw
  4007. /run/user
  4008. /run/user/colin
  4009. /run/user/colin/dconf
  4010. /run/user/colin/dconf/user rwc
  4011. /sys h
  4012. /sys/dev/block/8:2
  4013. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2/subsystem
  4014. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2/uevent r
  4015. /usr h
  4016. /usr/bin x
  4017. /usr/lib rx
  4018. /usr/local h
  4019. /usr/local/share/fonts
  4020. /usr/share r
  4021. /var h
  4022. /var/cache h
  4023. /var/cache/fontconfig r
  4024. /var/lib h
  4025. /var/lib/dbus/machine-id r
  4026. -CAP_ALL
  4027. bind disabled
  4028. connect disabled
  4029. }
  4030.  
  4031. # Role: colin
  4032. subject /usr/bin/nm-applet o {
  4033. / h
  4034. /dev h
  4035. /dev/null r
  4036. /dev/urandom r
  4037. /etc r
  4038. /etc/grsec h
  4039. /etc/gshadow h
  4040. /etc/gshadow- h
  4041. /etc/ppp h
  4042. /etc/samba/smbpasswd h
  4043. /etc/shadow h
  4044. /etc/shadow- h
  4045. /etc/ssh h
  4046. /home
  4047. /home/colin r
  4048. /home/colin/.config
  4049. /home/colin/.config/dconf/user r
  4050. /home/colin/.config/gtk-3.0
  4051. /home/colin/.config/gtk-3.0/bookmarks r
  4052. /home/colin/.config/ibus
  4053. /home/colin/.config/ibus/bus w
  4054. /home/colin/.config/user-dirs.dirs r
  4055. /home/colin/.local
  4056. /home/colin/.local/share r
  4057. /home/colin/.local/share/icons
  4058. /lib rx
  4059. /lib/modules h
  4060. /proc
  4061. /proc/bus h
  4062. /proc/filesystems r
  4063. /proc/kallsyms h
  4064. /proc/kcore h
  4065. /proc/modules h
  4066. /proc/slabinfo h
  4067. /proc/sys/vm/overcommit_memory r
  4068. /run rw
  4069. /run/user
  4070. /run/user/colin
  4071. /run/user/colin/dconf
  4072. /run/user/colin/dconf/user rw
  4073. /selinux
  4074. /sys r
  4075. /tmp
  4076. /usr h
  4077. /usr/bin h
  4078. /usr/bin/nm-applet x
  4079. /usr/lib rx
  4080. /usr/local h
  4081. /usr/local/share/fonts
  4082. /usr/share r
  4083. /var h
  4084. /var/cache h
  4085. /var/cache/fontconfig r
  4086. /var/lib h
  4087. /var/lib/dbus/machine-id r
  4088. /var/tmp
  4089. -CAP_ALL
  4090. bind disabled
  4091. connect disabled
  4092. sock_allow_family netlink
  4093. }
  4094.  
  4095. # Role: colin
  4096. subject /usr/bin/pactl o {
  4097. / h
  4098. /dev h
  4099. /dev/urandom r
  4100. /etc h
  4101. /etc/ld.so.cache r
  4102. /etc/locale.alias r
  4103. /etc/pulse/client.conf r
  4104. /home h
  4105. /home/colin/.Xauthority r
  4106. /home/colin/.config/pulse/cookie r
  4107. /lib rx
  4108. /lib/modules h
  4109. /proc
  4110. /proc/bus h
  4111. /proc/kallsyms h
  4112. /proc/kcore h
  4113. /proc/modules h
  4114. /proc/slabinfo h
  4115. /proc/sys h
  4116. /run r
  4117. /run/shm rwcd
  4118. /run/user
  4119. /run/user/colin
  4120. /run/user/colin/pulse rwc
  4121. /usr h
  4122. /usr/bin h
  4123. /usr/bin/pactl x
  4124. /usr/bin/pulseaudio x
  4125. /usr/lib rx
  4126. /var h
  4127. /var/lib/dbus/machine-id r
  4128. -CAP_ALL
  4129. bind disabled
  4130. connect disabled
  4131. }
  4132.  
  4133. # Role: colin
  4134. subject /usr/bin/pidgin o {
  4135. / h
  4136. /dev h
  4137. /dev/urandom r
  4138. /etc r
  4139. /etc/grsec h
  4140. /etc/gshadow h
  4141. /etc/gshadow- h
  4142. /etc/ppp h
  4143. /etc/samba/smbpasswd h
  4144. /etc/shadow h
  4145. /etc/shadow- h
  4146. /etc/ssh h
  4147. /home
  4148. /home/colin r
  4149. /home/colin/.config
  4150. /home/colin/.config/dconf/user r
  4151. /home/colin/.config/enchant
  4152. /home/colin/.config/enchant/en_US.dic ra
  4153. /home/colin/.config/enchant/en_US.exc ra
  4154. /home/colin/.config/ibus
  4155. /home/colin/.config/ibus/bus w
  4156. /home/colin/.config/indicators/messages/applications-blacklist
  4157. /home/colin/.config/indicators/messages/applications-blacklist/pidgin-libnotify rwcd
  4158. /home/colin/.config/indicators/messages/applications-blacklist/pidgin-libnotify.THP22W rwcd
  4159. /home/colin/.gstreamer-0.10 h
  4160. /home/colin/.gstreamer-0.10/registry.x86_64.bin r
  4161. /home/colin/.local r
  4162. /home/colin/.local/share/icons
  4163. /home/colin/.purple rwcd
  4164. /lib rx
  4165. /lib/modules h
  4166. /proc h
  4167. /proc/filesystems r
  4168. /proc/meminfo r
  4169. /run rw
  4170. /run/user
  4171. /run/user/colin
  4172. /run/user/colin/dconf
  4173. /run/user/colin/dconf/user rw
  4174. /selinux
  4175. /tmp
  4176. /usr h
  4177. /usr/bin h
  4178. /usr/bin/pidgin x
  4179. /usr/lib rx
  4180. /usr/local h
  4181. /usr/local/share/fonts
  4182. /usr/share r
  4183. /var h
  4184. /var/cache h
  4185. /var/cache/fontconfig r
  4186. /var/lib h
  4187. /var/lib/dbus/machine-id r
  4188. /var/tmp
  4189. -CAP_ALL
  4190. bind 0.0.0.0/32:0 dgram ip
  4191. connect 205.188.6.15/32:443 stream tcp
  4192. connect 205.188.93.135/32:443 stream dgram tcp udp
  4193. connect 205.188.1.125/32:443 stream tcp
  4194. connect 205.188.101.136/32:443 stream dgram tcp udp
  4195. connect 205.188.100.136/32:443 stream dgram tcp udp
  4196. connect 64.12.173.137/32:443 stream dgram tcp udp
  4197. connect 64.12.27.68/32:443 stream tcp
  4198. connect 64.12.165.104/32:443 stream tcp
  4199. connect 64.12.104.63/32:443 stream tcp
  4200. connect 64.12.236.15/32:443 stream dgram tcp udp
  4201. connect 64.12.235.15/32:443 stream dgram tcp udp
  4202. connect 74.125.192.125/32:5222 stream dgram tcp udp
  4203. connect 74.125.142.125/32:5222 stream dgram tcp udp
  4204. connect 207.200.74.251/32:443 stream tcp
  4205. connect 149.15.3.1/32:53 dgram udp
  4206. connect 149.15.3.2/32:53 dgram udp
  4207. connect 239.255.255.250/32:1900 dgram udp
  4208. sock_allow_family ipv6 netlink
  4209. }
  4210.  
  4211. # Role: colin
  4212. subject /usr/bin/pulseaudio o {
  4213. /
  4214. /boot h
  4215. /dev h
  4216. /dev/null rw
  4217. /dev/snd rw
  4218. /dev/urandom r
  4219. /etc r
  4220. /etc/grsec h
  4221. /etc/gshadow h
  4222. /etc/gshadow- h
  4223. /etc/passwd h
  4224. /etc/ppp h
  4225. /etc/pulse h
  4226. /etc/pulse/client.conf r
  4227. /etc/pulse/daemon.conf r
  4228. /etc/pulse/default.pa r
  4229. /etc/samba/smbpasswd h
  4230. /etc/shadow h
  4231. /etc/shadow- h
  4232. /etc/ssh h
  4233. /etc/udev h
  4234. /etc/udev/udev.conf r
  4235. /home
  4236. /home/colin rxwcd
  4237. /home/colin/.config
  4238. /home/colin/.config/pulse rw
  4239. /lib rx
  4240. /lib/modules h
  4241. /lib64/modules h
  4242. /proc r
  4243. /proc/bus h
  4244. /proc/kallsyms h
  4245. /proc/kcore h
  4246. /proc/modules h
  4247. /proc/slabinfo h
  4248. /proc/sys h
  4249. /run rwcd
  4250. /sys r
  4251. /tmp rxwcd
  4252. /usr
  4253. /usr/bin
  4254. /usr/bin/pulseaudio x
  4255. /usr/lib rx
  4256. /usr/share r
  4257. /usr/src h
  4258. /var h
  4259. /var/lib/dbus/machine-id r
  4260. -CAP_ALL
  4261. bind disabled
  4262. connect disabled
  4263. sock_allow_family netlink
  4264. }
  4265.  
  4266. # Role: colin
  4267. subject /usr/bin/signon-ui o {
  4268. / h
  4269. /etc r
  4270. /etc/grsec h
  4271. /etc/gshadow h
  4272. /etc/gshadow- h
  4273. /etc/ppp h
  4274. /etc/samba/smbpasswd h
  4275. /etc/shadow h
  4276. /etc/shadow- h
  4277. /etc/ssh h
  4278. /home
  4279. /home/colin
  4280. /home/colin/.ICEauthority r
  4281. /home/colin/.Xauthority r
  4282. /home/colin/.config
  4283. /home/colin/.config/Trolltech.conf r
  4284. /home/colin/.config/ibus
  4285. /home/colin/.config/ibus/bus w
  4286. /lib rx
  4287. /lib/modules h
  4288. /proc r
  4289. /proc/bus h
  4290. /proc/kallsyms h
  4291. /proc/kcore h
  4292. /proc/modules h
  4293. /proc/slabinfo h
  4294. /proc/sys h
  4295. /selinux
  4296. /sys h
  4297. /sys/devices/system/cpu/online r
  4298. /usr
  4299. /usr/bin
  4300. /usr/bin/signon-ui x
  4301. /usr/lib rx
  4302. /usr/local h
  4303. /usr/local/share/fonts
  4304. /usr/share r
  4305. /usr/src h
  4306. /var h
  4307. /var/cache h
  4308. /var/cache/fontconfig r
  4309. /var/lib h
  4310. /var/lib/dbus/machine-id r
  4311. -CAP_ALL
  4312. bind disabled
  4313. connect disabled
  4314. }
  4315.  
  4316. # Role: colin
  4317. subject /usr/bin/sudo o {
  4318. user_transition_allow root nobody
  4319. group_transition_allow nogroup root colin
  4320.  
  4321. / h
  4322. /bin h
  4323. /bin/su
  4324. /dev h
  4325. /dev/console
  4326. /dev/log rw
  4327. /dev/pts
  4328. /dev/tty rw
  4329. /etc r
  4330. /etc/grsec h
  4331. /etc/gshadow h
  4332. /etc/gshadow- h
  4333. /etc/ppp h
  4334. /etc/samba/smbpasswd h
  4335. /etc/shadow- h
  4336. /etc/ssh h
  4337. /lib rx
  4338. /lib/modules h
  4339. /proc r
  4340. /proc/bus h
  4341. /proc/kallsyms h
  4342. /proc/kcore h
  4343. /proc/modules h
  4344. /proc/slabinfo h
  4345. /selinux
  4346. /usr h
  4347. /usr/bin/sudo x
  4348. /usr/lib/locale/locale-archive r
  4349. /usr/lib/sudo/sudoers.so rx
  4350. /usr/lib/x86_64-linux-gnu/libck-connector.so.0.0.0 rx
  4351. /var h
  4352. /var/lib/sudo
  4353. /var/lib/sudo/colin
  4354. /var/lib/sudo/colin/1 rw
  4355. /var/lib/sudo/colin/2 rw
  4356. -CAP_ALL
  4357. +CAP_SETGID
  4358. +CAP_SETUID
  4359. +CAP_SYS_RESOURCE
  4360. +CAP_AUDIT_WRITE
  4361. bind disabled
  4362. connect disabled
  4363. sock_allow_family netlink
  4364. }
  4365.  
  4366. # Role: colin
  4367. subject /usr/bin/telepathy-indicator o {
  4368. / h
  4369. /etc h
  4370. /etc/gtk-3.0/settings.ini r
  4371. /etc/ld.so.cache r
  4372. /etc/locale.alias r
  4373. /home h
  4374. /home/colin/.Xauthority r
  4375. /home/colin/.config/dconf/user r
  4376. /lib rx
  4377. /lib/modules h
  4378. /proc h
  4379. /proc/filesystems r
  4380. /proc/sys/vm/overcommit_memory r
  4381. /run
  4382. /run/user
  4383. /run/user/colin
  4384. /run/user/colin/dconf
  4385. /run/user/colin/dconf/user rw
  4386. /selinux
  4387. /usr h
  4388. /usr/bin h
  4389. /usr/bin/empathy
  4390. /usr/bin/telepathy-indicator x
  4391. /usr/lib rx
  4392. /usr/share r
  4393. -CAP_ALL
  4394. bind disabled
  4395. connect disabled
  4396. }
  4397.  
  4398. # Role: colin
  4399. subject /usr/bin/update-notifier o {
  4400. /
  4401. /boot h
  4402. /dev h
  4403. /dev/null rw
  4404. /etc r
  4405. /etc/grsec h
  4406. /etc/gshadow h
  4407. /etc/gshadow- h
  4408. /etc/passwd h
  4409. /etc/ppp h
  4410. /etc/samba/smbpasswd h
  4411. /etc/shadow h
  4412. /etc/shadow- h
  4413. /etc/ssh h
  4414. /home h
  4415. /home/colin r
  4416. /lib rx
  4417. /lib/modules h
  4418. /lib64/modules h
  4419. /proc
  4420. /proc/bus h
  4421. /proc/filesystems r
  4422. /proc/kallsyms h
  4423. /proc/kcore h
  4424. /proc/modules h
  4425. /proc/slabinfo h
  4426. /proc/sys h
  4427. /run rw
  4428. /sys r
  4429. /usr h
  4430. /usr/bin h
  4431. /usr/bin/nice x
  4432. /usr/bin/software-properties-gtk
  4433. /usr/bin/update-notifier x
  4434. /usr/lib rx
  4435. /usr/local h
  4436. /usr/local/share/fonts
  4437. /usr/share rx
  4438. /var h
  4439. /var/cache r
  4440. /var/crash
  4441. /var/lib
  4442. -CAP_ALL
  4443. bind disabled
  4444. connect disabled
  4445. sock_allow_family netlink
  4446. }
  4447.  
  4448. # Role: colin
  4449. subject /usr/bin/vlc o {
  4450. / h
  4451. /bin h
  4452. /bin/dash x
  4453. /dev h
  4454. /dev/dri/card0 rw
  4455. /dev/random
  4456. /dev/urandom r
  4457. /etc r
  4458. /etc/grsec h
  4459. /etc/gshadow h
  4460. /etc/gshadow- h
  4461. /etc/ppp h
  4462. /etc/samba/smbpasswd h
  4463. /etc/shadow h
  4464. /etc/shadow- h
  4465. /etc/ssh h
  4466. /home
  4467. /home/colin r
  4468. /home/colin/.config r
  4469. /home/colin/.config/dconf h
  4470. /home/colin/.config/dconf/user r
  4471. /home/colin/.config/ibus
  4472. /home/colin/.config/ibus/bus w
  4473. /home/colin/.config/pulse h
  4474. /home/colin/.config/pulse/cookie r
  4475. /home/colin/.config/vlc rwcd
  4476. /home/colin/.jdownloader h
  4477. /home/colin/.jdownloader/downloads/breaking.bad.s05e12.hdtv.x264-evolve
  4478. /home/colin/.jdownloader/downloads/breaking.bad.s05e12.hdtv.x264-evolve/Breaking.Bad.S05E12.HDTV.x264-EVOLVE.mp4 rw
  4479. /home/colin/.local h
  4480. /home/colin/.local/share/vlc
  4481. /home/colin/.local/share/vlc/ml.xspf rw
  4482. /home/colin/.local/share/vlc/ssl wc
  4483. /lib rx
  4484. /lib/modules h
  4485. /proc r
  4486. /proc/bus h
  4487. /proc/kallsyms h
  4488. /proc/kcore h
  4489. /proc/modules h
  4490. /proc/slabinfo h
  4491. /run rwcd
  4492. /selinux
  4493. /sys h
  4494. /sys/devices/system/cpu/online r
  4495. /tmp wcd
  4496. /usr
  4497. /usr/bin
  4498. /usr/bin/vlc x
  4499. /usr/bin/xdg-screensaver x
  4500. /usr/lib rx
  4501. /usr/lib/locale h
  4502. /usr/lib/locale/locale-archive r
  4503. /usr/lib/vlc rxwc
  4504. /usr/local h
  4505. /usr/local/share/fonts
  4506. /usr/share r
  4507. /usr/src h
  4508. /var h
  4509. /var/cache h
  4510. /var/cache/fontconfig r
  4511. /var/lib h
  4512. /var/lib/dbus/machine-id r
  4513. -CAP_ALL
  4514. bind 0.0.0.0/32:0 dgram ip
  4515. connect 208.100.47.160/32:443 stream tcp
  4516. connect 149.15.3.2/32:53 dgram udp
  4517. }
  4518.  
  4519. # Role: colin
  4520. subject /usr/lib/NetworkManager/nm-applet-migration-tool o {
  4521. / h
  4522. /etc h
  4523. /etc/ld.so.cache r
  4524. /lib rx
  4525. /lib/modules h
  4526. /proc h
  4527. /proc/filesystems r
  4528. /run h
  4529. /run/dbus/system_bus_socket rw
  4530. /selinux
  4531. /usr h
  4532. /usr/lib rx
  4533. -CAP_ALL
  4534. bind disabled
  4535. connect disabled
  4536. }
  4537.  
  4538. # Role: colin
  4539. subject /usr/lib/at-spi2-core/at-spi-bus-launcher o {
  4540. / h
  4541. /bin h
  4542. /bin/dbus-daemon x
  4543. /dev h
  4544. /dev/null r
  4545. /etc h
  4546. /etc/ld.so.cache r
  4547. /etc/locale.alias r
  4548. /home h
  4549. /home/colin/.Xauthority r
  4550. /home/colin/.config/dconf/user r
  4551. /lib rx
  4552. /lib/modules h
  4553. /proc
  4554. /proc/bus h
  4555. /proc/filesystems r
  4556. /proc/kallsyms h
  4557. /proc/kcore h
  4558. /proc/modules h
  4559. /proc/slabinfo h
  4560. /proc/sys h
  4561. /run
  4562. /run/user
  4563. /run/user/colin
  4564. /run/user/colin/dconf
  4565. /run/user/colin/dconf/user rw
  4566. /selinux
  4567. /usr h
  4568. /usr/lib rx
  4569. /usr/share r
  4570. -CAP_ALL
  4571. bind disabled
  4572. connect disabled
  4573. }
  4574.  
  4575. # Role: colin
  4576. subject /usr/lib/dconf/dconf-service o {
  4577. / h
  4578. /etc h
  4579. /etc/ld.so.cache r
  4580. /home h
  4581. /home/colin rwcd
  4582. /lib h
  4583. /lib/x86_64-linux-gnu rx
  4584. /proc h
  4585. /proc/cmdline
  4586. /proc/filesystems r
  4587. /run h
  4588. /run/user/colin/dconf/user rwd
  4589. /selinux
  4590. /usr h
  4591. /usr/lib rx
  4592. -CAP_ALL
  4593. bind disabled
  4594. connect disabled
  4595. }
  4596.  
  4597. # Role: colin
  4598. subject /usr/lib/evolution/evolution-calendar-factory o {
  4599. / h
  4600. /etc h
  4601. /etc/ld.so.cache r
  4602. /etc/locale.alias r
  4603. /etc/localtime r
  4604. /etc/nsswitch.conf r
  4605. /etc/passwd r
  4606. /home
  4607. /home/colin r
  4608. /home/colin/.cache
  4609. /home/colin/.local
  4610. /home/colin/.local/share
  4611. /lib rx
  4612. /lib/modules h
  4613. /proc h
  4614. /proc/filesystems r
  4615. /run
  4616. /run/user
  4617. /run/user/colin
  4618. /run/user/colin/dconf
  4619. /run/user/colin/dconf/user rw
  4620. /selinux
  4621. /usr h
  4622. /usr/lib rx
  4623. /usr/share r
  4624. -CAP_ALL
  4625. bind disabled
  4626. connect disabled
  4627. sock_allow_family netlink
  4628. }
  4629.  
  4630. # Role: colin
  4631. subject /usr/lib/evolution/evolution-source-registry o {
  4632. / h
  4633. /etc h
  4634. /etc/ld.so.cache r
  4635. /etc/locale.alias r
  4636. /etc/nsswitch.conf r
  4637. /etc/passwd r
  4638. /home
  4639. /lib rx
  4640. /lib/modules h
  4641. /proc h
  4642. /proc/filesystems r
  4643. /proc/sys/vm/overcommit_memory r
  4644. /selinux
  4645. /sys h
  4646. /sys/devices/system/cpu/online r
  4647. /usr h
  4648. /usr/lib rx
  4649. /usr/share r
  4650. -CAP_ALL
  4651. bind disabled
  4652. connect disabled
  4653. }
  4654.  
  4655. # Role: colin
  4656. subject /usr/lib/geoclue/geoclue-master o {
  4657. / h
  4658. /dev h
  4659. /dev/urandom r
  4660. /etc h
  4661. /etc/ld.so.cache r
  4662. /etc/locale.alias r
  4663. /etc/passwd r
  4664. /home h
  4665. /home/colin/.config/dconf/user r
  4666. /lib rx
  4667. /lib/modules h
  4668. /proc h
  4669. /proc/filesystems r
  4670. /run
  4671. /run/dbus/system_bus_socket rw
  4672. /run/user
  4673. /run/user/colin
  4674. /run/user/colin/dconf
  4675. /run/user/colin/dconf/user rw
  4676. /selinux
  4677. /tmp
  4678. /usr h
  4679. /usr/lib rx
  4680. /usr/share r
  4681. /var h
  4682. /var/tmp
  4683. -CAP_ALL
  4684. bind disabled
  4685. connect disabled
  4686. }
  4687.  
  4688. # Role: colin
  4689. subject /usr/lib/gnome-settings-daemon/gnome-fallback-mount-helper o {
  4690. / h
  4691. /etc h
  4692. /etc/gtk-3.0/settings.ini r
  4693. /etc/ld.so.cache r
  4694. /etc/locale.alias r
  4695. /home h
  4696. /home/colin/.Xauthority r
  4697. /home/colin/.config/dconf/user r
  4698. /lib rx
  4699. /lib/modules h
  4700. /proc h
  4701. /proc/filesystems r
  4702. /run
  4703. /run/dbus/system_bus_socket rw
  4704. /run/user
  4705. /run/user/colin
  4706. /run/user/colin/dconf
  4707. /run/user/colin/dconf/user rw
  4708. /selinux
  4709. /usr h
  4710. /usr/lib rx
  4711. /usr/share r
  4712. -CAP_ALL
  4713. bind disabled
  4714. connect disabled
  4715. }
  4716.  
  4717. # Role: colin
  4718. subject /usr/lib/gnome-settings-daemon/gnome-settings-daemon o {
  4719. /
  4720. /boot h
  4721. /dev h
  4722. /dev/input/event2
  4723. /dev/null r
  4724. /dev/urandom r
  4725. /etc r
  4726. /etc/grsec h
  4727. /etc/gshadow h
  4728. /etc/gshadow- h
  4729. /etc/ppp h
  4730. /etc/samba/smbpasswd h
  4731. /etc/shadow h
  4732. /etc/shadow- h
  4733. /etc/ssh h
  4734. /home
  4735. /home/colin rw
  4736. /lib rx
  4737. /lib/modules h
  4738. /lib64/modules h
  4739. /proc r
  4740. /proc/bus h
  4741. /proc/kallsyms h
  4742. /proc/kcore h
  4743. /proc/modules h
  4744. /proc/slabinfo h
  4745. /run rwcd
  4746. /sys r
  4747. /usr h
  4748. /usr/bin/syndaemon x
  4749. /usr/lib rx
  4750. /usr/local/share
  4751. /usr/share r
  4752. /var h
  4753. /var/cache h
  4754. /var/cache/fontconfig r
  4755. /var/lib h
  4756. /var/lib/dbus/machine-id r
  4757. -CAP_ALL
  4758. bind disabled
  4759. connect disabled
  4760. sock_allow_family netlink
  4761. }
  4762.  
  4763. # Role: colin
  4764. subject /usr/lib/gnome-user-share/gnome-user-share o {
  4765. / h
  4766. /etc r
  4767. /etc/grsec h
  4768. /etc/gshadow h
  4769. /etc/gshadow- h
  4770. /etc/gtk-3.0 h
  4771. /etc/gtk-3.0/settings.ini r
  4772. /etc/ppp h
  4773. /etc/samba/smbpasswd h
  4774. /etc/shadow h
  4775. /etc/shadow- h
  4776. /etc/ssh h
  4777. /home h
  4778. /home/colin/.Xauthority r
  4779. /home/colin/.config/dconf/user r
  4780. /lib rx
  4781. /lib/modules h
  4782. /proc h
  4783. /proc/filesystems r
  4784. /run
  4785. /run/user
  4786. /run/user/colin
  4787. /run/user/colin/dconf
  4788. /run/user/colin/dconf/user rw
  4789. /selinux
  4790. /usr h
  4791. /usr/lib rx
  4792. /usr/share r
  4793. -CAP_ALL
  4794. bind disabled
  4795. connect disabled
  4796. }
  4797.  
  4798. # Role: colin
  4799. subject /usr/lib/gvfs/gvfs-gphoto2-volume-monitor o {
  4800. / h
  4801. /etc h
  4802. /etc/ld.so.cache r
  4803. /etc/locale.alias r
  4804. /etc/udev/udev.conf r
  4805. /lib rx
  4806. /lib/modules h
  4807. /proc h
  4808. /proc/filesystems r
  4809. /run h
  4810. /run/udev h
  4811. /run/udev/data r
  4812. /selinux
  4813. /sys r
  4814. /usr h
  4815. /usr/lib rx
  4816. -CAP_ALL
  4817. bind disabled
  4818. connect disabled
  4819. sock_allow_family netlink
  4820. }
  4821.  
  4822. # Role: colin
  4823. subject /usr/lib/gvfs/gvfs-mtp-volume-monitor o {
  4824. / h
  4825. /etc h
  4826. /etc/ld.so.cache r
  4827. /etc/locale.alias r
  4828. /etc/udev/udev.conf r
  4829. /lib rx
  4830. /lib/modules h
  4831. /proc h
  4832. /proc/filesystems r
  4833. /run h
  4834. /run/udev h
  4835. /run/udev/data r
  4836. /selinux
  4837. /sys r
  4838. /usr h
  4839. /usr/lib rx
  4840. -CAP_ALL
  4841. bind disabled
  4842. connect disabled
  4843. sock_allow_family netlink
  4844. }
  4845.  
  4846. # Role: colin
  4847. subject /usr/lib/gvfs/gvfs-udisks2-volume-monitor o {
  4848. / h
  4849. /dev h
  4850. /dev/sda2
  4851. /etc r
  4852. /etc/grsec h
  4853. /etc/gshadow h
  4854. /etc/gshadow- h
  4855. /etc/ppp h
  4856. /etc/samba/smbpasswd h
  4857. /etc/shadow h
  4858. /etc/shadow- h
  4859. /etc/ssh h
  4860. /etc/udev h
  4861. /etc/udev/udev.conf r
  4862. /home h
  4863. /home/colin/.local/share/mime/treemagic r
  4864. /lib rx
  4865. /lib/modules h
  4866. /media h
  4867. /media/colin/56E6F045E6F026C1
  4868. /proc r
  4869. /proc/bus h
  4870. /proc/kallsyms h
  4871. /proc/kcore h
  4872. /proc/modules h
  4873. /proc/mounts
  4874. /proc/slabinfo h
  4875. /proc/sys h
  4876. /run h
  4877. /run/dbus/system_bus_socket rw
  4878. /run/udev/data/b8:2 r
  4879. /selinux
  4880. /sys h
  4881. /sys/dev/block/8:2
  4882. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2/subsystem
  4883. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2/uevent r
  4884. /usr h
  4885. /usr/lib rx
  4886. /usr/share h
  4887. /usr/share/mime/treemagic r
  4888. -CAP_ALL
  4889. bind disabled
  4890. connect disabled
  4891. sock_allow_family netlink
  4892. }
  4893.  
  4894. # Role: colin
  4895. subject /usr/lib/gvfs/gvfsd o {
  4896. / h
  4897. /dev h
  4898. /dev/null rw
  4899. /etc h
  4900. /etc/ld.so.cache r
  4901. /etc/locale.alias r
  4902. /lib rx
  4903. /lib/modules h
  4904. /proc
  4905. /proc/bus h
  4906. /proc/filesystems r
  4907. /proc/kallsyms h
  4908. /proc/kcore h
  4909. /proc/modules h
  4910. /proc/slabinfo h
  4911. /proc/sys h
  4912. /run h
  4913. /run/user/colin/gvfs wc
  4914. /selinux
  4915. /usr h
  4916. /usr/lib rx
  4917. /usr/share r
  4918. -CAP_ALL
  4919. bind disabled
  4920. connect disabled
  4921. }
  4922.  
  4923. # Role: colin
  4924. subject /usr/lib/indicator-messages/indicator-messages-service o {
  4925. / h
  4926. /etc h
  4927. /etc/ld.so.cache r
  4928. /etc/locale.alias r
  4929. /home h
  4930. /home/colin/.Xauthority r
  4931. /home/colin/.config/dconf/user r
  4932. /lib rx
  4933. /lib/modules h
  4934. /proc h
  4935. /proc/filesystems r
  4936. /run
  4937. /run/user
  4938. /run/user/colin
  4939. /run/user/colin/dconf
  4940. /run/user/colin/dconf/user rw
  4941. /selinux
  4942. /usr h
  4943. /usr/bin h
  4944. /usr/bin/empathy
  4945. /usr/bin/pidgin
  4946. /usr/lib rx
  4947. /usr/share r
  4948. -CAP_ALL
  4949. bind disabled
  4950. connect disabled
  4951. }
  4952.  
  4953. # Role: colin
  4954. subject /usr/lib/indicator-session/indicator-session-service o {
  4955. / h
  4956. /etc h
  4957. /etc/ld.so.cache r
  4958. /etc/locale.alias r
  4959. /etc/nsswitch.conf r
  4960. /etc/passwd r
  4961. /home h
  4962. /home/colin/.config/dconf/user r
  4963. /lib rx
  4964. /lib/modules h
  4965. /proc h
  4966. /proc/filesystems r
  4967. /run
  4968. /run/dbus/system_bus_socket rw
  4969. /run/user
  4970. /run/user/colin
  4971. /run/user/colin/dconf rwc
  4972. /selinux
  4973. /usr h
  4974. /usr/lib rx
  4975. /usr/share r
  4976. -CAP_ALL
  4977. bind disabled
  4978. connect disabled
  4979. }
  4980.  
  4981. # Role: colin
  4982. subject /usr/lib/jvm/java-7-oracle/jre/bin/java o {
  4983. / h
  4984. /bin h
  4985. /bin/which x
  4986. /dev h
  4987. /dev/random r
  4988. /dev/urandom r
  4989. /etc r
  4990. /etc/grsec h
  4991. /etc/gshadow h
  4992. /etc/gshadow- h
  4993. /etc/ppp h
  4994. /etc/samba/smbpasswd h
  4995. /etc/shadow h
  4996. /etc/shadow- h
  4997. /etc/ssh h
  4998. /home
  4999. /home/colin r
  5000. /home/colin/.jdownloader r
  5001. /home/colin/.jdownloader/.junique
  5002. /home/colin/.jdownloader/.junique/115654c07.lock rwcd
  5003. /home/colin/.jdownloader/.junique/115654c07.port wcd
  5004. /home/colin/.jdownloader/.junique/global.lock rw
  5005. /home/colin/.jdownloader/config rwcd
  5006. /home/colin/.jdownloader/downloads
  5007. /home/colin/.jdownloader/downloads/4Epmqm5GQX.rar.part rw
  5008. /home/colin/.jdownloader/downloads/x9fXXm5iLe.rar.part rw
  5009. /home/colin/.jdownloader/java
  5010. /home/colin/.jdownloader/java/donotdelete.me r
  5011. /home/colin/.jdownloader/licenses
  5012. /home/colin/.jdownloader/licenses/licenses.extract r
  5013. /home/colin/.jdownloader/tmp
  5014. /home/colin/.jdownloader/tmp/hashlist.lst rwcd
  5015. /home/colin/.jdownloader/tmp/update.zip r
  5016. /lib rx
  5017. /lib/modules h
  5018. /proc rw
  5019. /proc/bus h
  5020. /proc/filesystems r
  5021. /proc/kallsyms h
  5022. /proc/kcore h
  5023. /proc/meminfo r
  5024. /proc/modules h
  5025. /proc/slabinfo h
  5026. /proc/sys/vm/overcommit_memory r
  5027. /run h
  5028. /run/resolvconf/resolv.conf r
  5029. /selinux
  5030. /sys h
  5031. /sys/devices/system/cpu
  5032. /sys/devices/system/cpu/online r
  5033. /tmp rwcd
  5034. /usr
  5035. /usr/bin/rar r
  5036. /usr/lib rx
  5037. /usr/share r
  5038. /usr/src h
  5039. /var h
  5040. /var/cache/fontconfig r
  5041. -CAP_ALL
  5042. bind 0.0.0.0/32:0 dgram ip
  5043. bind 127.0.0.1/32:9666 stream tcp
  5044. bind 127.0.1.1/32:0 stream tcp
  5045. bind 127.0.1.1/32:36366 stream tcp
  5046. bind 127.0.1.1/32:36556 stream tcp
  5047. bind 127.0.1.1/32:48274 stream tcp
  5048. connect 78.46.69.237/32:80 stream tcp
  5049. connect 154.53.225.18/32:80 stream tcp
  5050. connect 154.53.224.10/32:443 stream tcp
  5051. connect 154.53.224.246/32:80 stream tcp
  5052. connect 154.53.224.14/32:443 stream tcp
  5053. connect 212.117.163.146/32:80 stream tcp
  5054. connect 178.63.91.110/32:80 stream tcp
  5055. connect 94.23.204.158/32:80 stream tcp
  5056. connect 87.98.243.45/32:80 stream tcp
  5057. connect 173.194.24.198/32:80 stream tcp
  5058. connect 173.194.24.211/32:80 stream tcp
  5059. connect 74.125.212.80/32:80 stream tcp
  5060. connect 74.125.225.69/32:80 stream tcp
  5061. connect 74.125.225.68/32:80 stream tcp
  5062. connect 149.15.3.2/32:53 dgram udp
  5063. sock_allow_family ipv6
  5064. }
  5065.  
  5066. # Role: colin
  5067. subject /usr/lib/libvte-2.90-9/gnome-pty-helper o {
  5068. /
  5069. /boot h
  5070. /dev h
  5071. /dev/null r
  5072. /dev/ptmx rw
  5073. /dev/pts rw
  5074. /etc h
  5075. /etc/group r
  5076. /etc/ld.so.cache r
  5077. /etc/nsswitch.conf r
  5078. /etc/passwd r
  5079. /lib h
  5080. /lib/x86_64-linux-gnu rx
  5081. /lib64/modules h
  5082. /proc
  5083. /proc/bus h
  5084. /proc/kallsyms h
  5085. /proc/kcore h
  5086. /proc/modules h
  5087. /proc/slabinfo h
  5088. /proc/sys h
  5089. /run h
  5090. /run/utmp rw
  5091. /sys h
  5092. /usr h
  5093. /usr/lib/libvte-2.90-9/gnome-pty-helper x
  5094. /var/backups h
  5095. /var/log h
  5096. -CAP_ALL
  5097. bind disabled
  5098. connect disabled
  5099. }
  5100.  
  5101. # Role: colin
  5102. subject /usr/lib/nux/unity_support_test o {
  5103. / h
  5104. /dev h
  5105. /dev/dri/card0 rw
  5106. /etc h
  5107. /etc/drirc r
  5108. /etc/ld.so.cache r
  5109. /home h
  5110. /home/colin/.Xauthority r
  5111. /lib rx
  5112. /lib/modules h
  5113. /sys r
  5114. /tmp wc
  5115. /usr h
  5116. /usr/lib rx
  5117. -CAP_ALL
  5118. bind disabled
  5119. connect disabled
  5120. }
  5121.  
  5122. # Role: colin
  5123. subject /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1 o {
  5124. / h
  5125. /etc h
  5126. /etc/gtk-3.0/settings.ini r
  5127. /etc/ld.so.cache r
  5128. /etc/locale.alias r
  5129. /home h
  5130. /home/colin/.Xauthority r
  5131. /home/colin/.config/dconf/user r
  5132. /lib rx
  5133. /lib/modules h
  5134. /proc h
  5135. /proc/filesystems r
  5136. /run
  5137. /run/dbus/system_bus_socket rw
  5138. /run/user
  5139. /run/user/colin
  5140. /run/user/colin/dconf
  5141. /run/user/colin/dconf/user rw
  5142. /selinux
  5143. /usr h
  5144. /usr/lib rx
  5145. /usr/share r
  5146. -CAP_ALL
  5147. bind disabled
  5148. connect disabled
  5149. }
  5150.  
  5151. # Role: colin
  5152. subject /usr/lib/telepathy/mission-control-5 o {
  5153. / h
  5154. /dev h
  5155. /dev/urandom r
  5156. /etc h
  5157. /etc/ld.so.cache r
  5158. /etc/locale.alias r
  5159. /etc/passwd r
  5160. /home
  5161. /home/colin r
  5162. /home/colin/.config
  5163. /home/colin/.config/dconf/user r
  5164. /home/colin/.config/libaccounts-glib
  5165. /home/colin/.config/libaccounts-glib/accounts.db rw
  5166. /home/colin/.config/libaccounts-glib/accounts.db-shm rw
  5167. /home/colin/.config/libaccounts-glib/accounts.db-wal rw
  5168. /lib rx
  5169. /lib/modules h
  5170. /proc h
  5171. /proc/filesystems r
  5172. /run
  5173. /run/dbus/system_bus_socket rw
  5174. /run/user
  5175. /run/user/colin
  5176. /run/user/colin/dconf
  5177. /run/user/colin/dconf/user rw
  5178. /selinux
  5179. /tmp
  5180. /usr h
  5181. /usr/lib rx
  5182. /usr/share r
  5183. /var h
  5184. /var/tmp
  5185. -CAP_ALL
  5186. bind disabled
  5187. connect disabled
  5188. }
  5189.  
  5190. # Role: colin
  5191. subject /usr/lib/ubuntu-geoip/ubuntu-geoip-provider o {
  5192. / h
  5193. /bin h
  5194. /bin/dash x
  5195. /dev h
  5196. /dev/urandom r
  5197. /etc r
  5198. /etc/grsec h
  5199. /etc/gshadow h
  5200. /etc/gshadow- h
  5201. /etc/ppp h
  5202. /etc/samba/smbpasswd h
  5203. /etc/shadow h
  5204. /etc/shadow- h
  5205. /etc/ssh h
  5206. /home h
  5207. /home/colin/.config/dconf/user r
  5208. /lib rx
  5209. /lib/modules h
  5210. /proc h
  5211. /proc/filesystems r
  5212. /run rw
  5213. /run/user
  5214. /run/user/colin
  5215. /run/user/colin/dconf
  5216. /run/user/colin/dconf/user rw
  5217. /selinux
  5218. /tmp
  5219. /usr h
  5220. /usr/lib rx
  5221. /usr/share/glib-2.0/schemas/gschemas.compiled r
  5222. /usr/share/gvfs/remote-volume-monitors
  5223. /usr/share/gvfs/remote-volume-monitors/afc.monitor r
  5224. /usr/share/gvfs/remote-volume-monitors/gphoto2.monitor r
  5225. /usr/share/gvfs/remote-volume-monitors/mtp.monitor r
  5226. /usr/share/gvfs/remote-volume-monitors/udisks2.monitor r
  5227. /var h
  5228. /var/tmp
  5229. -CAP_ALL
  5230. bind 0.0.0.0/32:0 dgram ip
  5231. connect 91.189.94.25/32:0 dgram udp
  5232. connect 91.189.89.144/32:0 stream dgram tcp udp
  5233. connect 91.189.89.144/32:80 stream dgram tcp udp
  5234. connect 149.15.3.2/32:53 dgram udp
  5235. sock_allow_family netlink
  5236. }
  5237.  
  5238. # Role: colin
  5239. subject /usr/lib/ubuntu-sso-client/ubuntu-sso-login o {
  5240. / h
  5241. /dev h
  5242. /dev/urandom r
  5243. /etc h
  5244. /etc/ld.so.cache r
  5245. /etc/locale.alias r
  5246. /etc/localtime r
  5247. /etc/python2.7/sitecustomize.py r
  5248. /home h
  5249. /home/colin/.cache/sso
  5250. /home/colin/.cache/sso/sso-client-gui.log a
  5251. /home/colin/.cache/sso/sso-client.log a
  5252. /lib rx
  5253. /lib/modules h
  5254. /proc
  5255. /proc/bus h
  5256. /proc/kallsyms h
  5257. /proc/kcore h
  5258. /proc/meminfo r
  5259. /proc/modules h
  5260. /proc/slabinfo h
  5261. /proc/sys h
  5262. /sys h
  5263. /sys/devices/system/cpu/online r
  5264. /usr
  5265. /usr/bin
  5266. /usr/bin/python2.7 x
  5267. /usr/lib r
  5268. /usr/lib/python2.7 r
  5269. /usr/lib/python2.7/argparse.pyc wc
  5270. /usr/lib/python2.7/decimal.pyc wc
  5271. /usr/lib/python2.7/dist-packages rx
  5272. /usr/lib/python2.7/distutils rwc
  5273. /usr/lib/python2.7/email
  5274. /usr/lib/python2.7/email/__init__.py r
  5275. /usr/lib/python2.7/email/__init__.pyc r
  5276. /usr/lib/python2.7/email/mime r
  5277. /usr/lib/python2.7/lib-dynload rx
  5278. /usr/lib/python2.7/logging
  5279. /usr/lib/python2.7/logging/__init__.py r
  5280. /usr/lib/python2.7/logging/__init__.pyc r
  5281. /usr/lib/python2.7/logging/handlers.py r
  5282. /usr/lib/python2.7/logging/handlers.pyc wc
  5283. /usr/lib/python2.7/numbers.pyc wc
  5284. /usr/lib/python2.7/plat-x86_64-linux-gnu
  5285. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.py r
  5286. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.pyc r
  5287. /usr/lib/python2.7/xml r
  5288. /usr/lib/ubuntu-sso-client
  5289. /usr/lib/ubuntu-sso-client/ubuntu-sso-login r
  5290. /usr/lib/x86_64-linux-gnu rx
  5291. /usr/local
  5292. /usr/local/lib
  5293. /usr/local/lib/python2.7
  5294. /usr/share r
  5295. /usr/src h
  5296. -CAP_ALL
  5297. bind disabled
  5298. connect disabled
  5299. }
  5300.  
  5301. # Role: colin
  5302. subject /usr/lib/unity-lens-files/unity-scope-gdrive o {
  5303. / h
  5304. /dev h
  5305. /dev/urandom r
  5306. /etc h
  5307. /etc/ld.so.cache r
  5308. /etc/locale.alias r
  5309. /etc/localtime r
  5310. /etc/python3.3/sitecustomize.py
  5311. /home
  5312. /home/colin rxwcd
  5313. /home/colin/.config
  5314. /home/colin/.config/dconf/user r
  5315. /home/colin/.config/libaccounts-glib
  5316. /home/colin/.config/libaccounts-glib/accounts.db rw
  5317. /home/colin/.config/libaccounts-glib/accounts.db-shm rw
  5318. /home/colin/.config/libaccounts-glib/accounts.db-wal rw
  5319. /lib rx
  5320. /lib/modules h
  5321. /proc r
  5322. /proc/bus h
  5323. /proc/kallsyms h
  5324. /proc/kcore h
  5325. /proc/modules h
  5326. /proc/slabinfo h
  5327. /run
  5328. /run/shm h
  5329. /run/shm/ffiBOjCjw rxwcd
  5330. /run/shm/ffiait2DI rxwcd
  5331. /run/shm/ffidRHnhA rxwcd
  5332. /run/shm/ffikxNnIV rxwcd
  5333. /run/user
  5334. /run/user/colin
  5335. /run/user/colin/dconf
  5336. /run/user/colin/dconf/user rw
  5337. /selinux
  5338. /tmp rxwcd
  5339. /usr
  5340. /usr/bin
  5341. /usr/bin/python3.3 x
  5342. /usr/lib rx
  5343. /usr/local h
  5344. /usr/local/lib/python3.3/dist-packages
  5345. /usr/share r
  5346. /usr/src h
  5347. /var h
  5348. /var/tmp rxwcd
  5349. -CAP_ALL
  5350. bind disabled
  5351. connect disabled
  5352. }
  5353.  
  5354. # Role: colin
  5355. subject /usr/lib/unity-lens-photos/unity-lens-photos o {
  5356. / h
  5357. /bin h
  5358. /bin/dash x
  5359. /dev h
  5360. /dev/urandom r
  5361. /etc h
  5362. /etc/ld.so.cache r
  5363. /etc/locale.alias r
  5364. /etc/localtime r
  5365. /etc/python3.3/sitecustomize.py
  5366. /home
  5367. /home/colin rxwcd
  5368. /lib rx
  5369. /lib/modules h
  5370. /proc r
  5371. /proc/bus h
  5372. /proc/kallsyms h
  5373. /proc/kcore h
  5374. /proc/modules h
  5375. /proc/mounts
  5376. /proc/slabinfo h
  5377. /proc/sys h
  5378. /run rxwcd
  5379. /selinux
  5380. /sys h
  5381. /sys/devices/system/cpu/online r
  5382. /tmp rxwcd
  5383. /usr
  5384. /usr/bin
  5385. /usr/bin/python3.3 x
  5386. /usr/lib rx
  5387. /usr/lib/girepository-1.0 r
  5388. /usr/lib/locale h
  5389. /usr/lib/locale/locale-archive r
  5390. /usr/lib/python3.3 r
  5391. /usr/lib/python3.3/__pycache__ rwc
  5392. /usr/lib/python3.3/encodings
  5393. /usr/lib/python3.3/encodings/__pycache__ r
  5394. /usr/lib/python3.3/json
  5395. /usr/lib/python3.3/json/__pycache__ r
  5396. /usr/lib/python3.3/lib-dynload rx
  5397. /usr/lib/python3.3/logging
  5398. /usr/lib/python3.3/logging/__pycache__/__init__.cpython-33.pyc r
  5399. /usr/lib/python3.3/plat-x86_64-linux-gnu
  5400. /usr/lib/python3.3/plat-x86_64-linux-gnu/__pycache__/_sysconfigdata_m.cpython-33.pyc r
  5401. /usr/lib/python3.3/sqlite3
  5402. /usr/lib/python3.3/sqlite3/__init__.py r
  5403. /usr/lib/python3.3/sqlite3/__pycache__ wc
  5404. /usr/lib/python3.3/sqlite3/dbapi2.py r
  5405. /usr/lib/python3.3/xml r
  5406. /usr/lib/python3.3/xml/etree
  5407. /usr/lib/python3.3/xml/etree/__pycache__ r
  5408. /usr/lib/unity-lens-photos r
  5409. /usr/local h
  5410. /usr/local/lib/python3.3/dist-packages
  5411. /usr/share r
  5412. /usr/src h
  5413. /var h
  5414. /var/tmp rxwcd
  5415. -CAP_ALL
  5416. bind disabled
  5417. connect disabled
  5418. }
  5419.  
  5420. # Role: colin
  5421. subject /usr/lib/unity/unity-panel-service o {
  5422. / h
  5423. /etc r
  5424. /etc/grsec h
  5425. /etc/gshadow h
  5426. /etc/gshadow- h
  5427. /etc/passwd h
  5428. /etc/ppp h
  5429. /etc/samba/smbpasswd h
  5430. /etc/shadow h
  5431. /etc/shadow- h
  5432. /etc/ssh h
  5433. /home h
  5434. /home/colin/.Xauthority r
  5435. /home/colin/.config/dconf/user r
  5436. /home/colin/.local/share/icons
  5437. /home/colin/.local/share/mime/mime.cache r
  5438. /lib rx
  5439. /lib/modules h
  5440. /proc h
  5441. /proc/filesystems r
  5442. /proc/sys/vm/overcommit_memory r
  5443. /run
  5444. /run/user
  5445. /run/user/colin
  5446. /run/user/colin/dconf
  5447. /run/user/colin/dconf/user rw
  5448. /selinux
  5449. /tmp r
  5450. /usr h
  5451. /usr/bin h
  5452. /usr/bin/eog
  5453. /usr/bin/gnome-control-center
  5454. /usr/bin/nautilus
  5455. /usr/lib rx
  5456. /usr/local h
  5457. /usr/local/share/fonts
  5458. /usr/share r
  5459. /var h
  5460. /var/cache h
  5461. /var/cache/fontconfig r
  5462. -CAP_ALL
  5463. bind disabled
  5464. connect disabled
  5465. }
  5466.  
  5467. # Role: colin
  5468. subject /usr/lib/x86_64-linux-gnu/bamf/bamfdaemon o {
  5469. /
  5470. /boot h
  5471. /dev/grsec h
  5472. /dev/kmem h
  5473. /dev/log h
  5474. /dev/mem h
  5475. /dev/port h
  5476. /etc h
  5477. /etc/gtk-3.0/settings.ini r
  5478. /etc/ld.so.cache r
  5479. /etc/locale.alias r
  5480. /etc/udev/udev.conf r
  5481. /home
  5482. /home/colin r
  5483. /lib rx
  5484. /lib/modules h
  5485. /lib64/modules h
  5486. /opt h
  5487. /opt/google/chrome/google-chrome
  5488. /proc r
  5489. /proc/bus h
  5490. /proc/kallsyms h
  5491. /proc/kcore h
  5492. /proc/modules h
  5493. /proc/slabinfo h
  5494. /proc/sys h
  5495. /run
  5496. /run/udev/data/b8:5 r
  5497. /run/user
  5498. /run/user/colin
  5499. /run/user/colin/dconf
  5500. /run/user/colin/dconf/user rw
  5501. /sys
  5502. /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda5/uevent r
  5503. /tmp rwcd
  5504. /usr h
  5505. /usr/bin
  5506. /usr/lib rx
  5507. /usr/share r
  5508. /var/backups h
  5509. /var/log h
  5510. -CAP_ALL
  5511. bind disabled
  5512. connect disabled
  5513. }
  5514.  
  5515. # Role: colin
  5516. subject /usr/lib/x86_64-linux-gnu/gconf/gconfd-2 o {
  5517. /
  5518. /boot h
  5519. /dev h
  5520. /dev/null rw
  5521. /etc r
  5522. /etc/gconf h
  5523. /etc/gconf/2/path r
  5524. /etc/gconf/gconf.xml.defaults
  5525. /etc/gconf/gconf.xml.defaults/%gconf-tree.xml r
  5526. /etc/gconf/gconf.xml.mandatory
  5527. /etc/gconf/gconf.xml.mandatory/%gconf-tree.xml r
  5528. /etc/grsec h
  5529. /etc/gshadow h
  5530. /etc/gshadow- h
  5531. /etc/ppp h
  5532. /etc/samba/smbpasswd h
  5533. /etc/shadow h
  5534. /etc/shadow- h
  5535. /etc/ssh h
  5536. /home h
  5537. /home/colin/.gconf wcd
  5538. /home/colin/.gconf/apps r
  5539. /home/colin/.gconf/apps/gnome-terminal
  5540. /home/colin/.gconf/apps/gnome-terminal/profiles
  5541. /home/colin/.gconf/apps/gnome-terminal/profiles/Default rwcd
  5542. /home/colin/.gconf/desktop
  5543. /home/colin/.gconf/desktop/gnome
  5544. /lib rx
  5545. /lib/modules h
  5546. /lib64/modules h
  5547. /proc h
  5548. /proc/filesystems r
  5549. /run h
  5550. /run/dbus/system_bus_socket rw
  5551. /sys h
  5552. /usr h
  5553. /usr/lib rx
  5554. /var h
  5555. /var/lib/gconf/debian.defaults
  5556. /var/lib/gconf/debian.defaults/%gconf-tree.xml r
  5557. /var/lib/gconf/debian.mandatory
  5558. /var/lib/gconf/defaults
  5559. /var/lib/gconf/defaults/%gconf-tree.xml r
  5560. -CAP_ALL
  5561. bind disabled
  5562. connect disabled
  5563. }
  5564.  
  5565. # Role: colin
  5566. subject /usr/lib/x86_64-linux-gnu/hud/hud-service o {
  5567. / h
  5568. /etc h
  5569. /etc/ld.so.cache r
  5570. /etc/locale.alias r
  5571. /home h
  5572. /home/colin/.cache/indicator-appmenu
  5573. /home/colin/.cache/indicator-appmenu/hud-usage-log.sqlite rw
  5574. /home/colin/.config/dconf/user r
  5575. /lib rx
  5576. /lib/modules h
  5577. /proc h
  5578. /proc/filesystems r
  5579. /proc/sys/vm/overcommit_memory r
  5580. /run
  5581. /run/user
  5582. /run/user/colin
  5583. /run/user/colin/dconf
  5584. /run/user/colin/dconf/user rw
  5585. /selinux
  5586. /usr h
  5587. /usr/lib rx
  5588. /usr/share r
  5589. -CAP_ALL
  5590. bind disabled
  5591. connect disabled
  5592. }
  5593.  
  5594. # Role: colin
  5595. subject /usr/lib/x86_64-linux-gnu/indicator-bluetooth/indicator-bluetooth-service o {
  5596. / h
  5597. /dev h
  5598. /dev/rfkill rw
  5599. /dev/urandom r
  5600. /etc h
  5601. /etc/ld.so.cache r
  5602. /etc/locale.alias r
  5603. /home h
  5604. /home/colin/.config/dconf/user r
  5605. /lib rx
  5606. /lib/modules h
  5607. /proc h
  5608. /proc/filesystems r
  5609. /proc/sys/vm/overcommit_memory r
  5610. /run
  5611. /run/dbus/system_bus_socket rw
  5612. /run/user
  5613. /run/user/colin
  5614. /run/user/colin/dconf
  5615. /run/user/colin/dconf/user rw
  5616. /selinux
  5617. /usr h
  5618. /usr/lib rx
  5619. /usr/share r
  5620. -CAP_ALL
  5621. bind disabled
  5622. connect disabled
  5623. }
  5624.  
  5625. # Role: colin
  5626. subject /usr/lib/x86_64-linux-gnu/indicator-datetime-service o {
  5627. / h
  5628. /etc r
  5629. /etc/grsec h
  5630. /etc/gshadow h
  5631. /etc/gshadow- h
  5632. /etc/ppp h
  5633. /etc/samba/smbpasswd h
  5634. /etc/shadow h
  5635. /etc/shadow- h
  5636. /etc/ssh h
  5637. /home h
  5638. /home/colin/.config/dconf/user r
  5639. /lib rx
  5640. /lib/modules h
  5641. /proc h
  5642. /proc/filesystems r
  5643. /run
  5644. /run/dbus/system_bus_socket rw
  5645. /run/user
  5646. /run/user/colin
  5647. /run/user/colin/dconf
  5648. /run/user/colin/dconf/user rw
  5649. /selinux
  5650. /usr h
  5651. /usr/bin h
  5652. /usr/bin/gnome-control-center
  5653. /usr/lib rx
  5654. /usr/share r
  5655. -CAP_ALL
  5656. bind disabled
  5657. connect disabled
  5658. }
  5659.  
  5660. # Role: colin
  5661. subject /usr/lib/x86_64-linux-gnu/indicator-sound-service o {
  5662. / h
  5663. /dev h
  5664. /dev/urandom r
  5665. /etc h
  5666. /etc/ld.so.cache r
  5667. /etc/locale.alias r
  5668. /etc/pulse/client.conf r
  5669. /home
  5670. /home/colin r
  5671. /home/colin/.cache
  5672. /home/colin/.cache/indicator
  5673. /lib rx
  5674. /lib/modules h
  5675. /proc
  5676. /proc/bus h
  5677. /proc/filesystems r
  5678. /proc/kallsyms h
  5679. /proc/kcore h
  5680. /proc/modules h
  5681. /proc/slabinfo h
  5682. /proc/sys h
  5683. /run rwc
  5684. /selinux
  5685. /usr h
  5686. /usr/bin h
  5687. /usr/bin/vlc
  5688. /usr/lib rx
  5689. /usr/share r
  5690. /var h
  5691. /var/lib/dbus/machine-id r
  5692. -CAP_ALL
  5693. bind disabled
  5694. connect disabled
  5695. }
  5696.  
  5697. # Role: colin
  5698. subject /usr/lib/x86_64-linux-gnu/libproxy/0.4.7/pxgsettings o {
  5699. / h
  5700. /etc h
  5701. /etc/ld.so.cache r
  5702. /etc/locale.alias r
  5703. /home h
  5704. /home/colin/.config/dconf/user r
  5705. /lib rx
  5706. /lib/modules h
  5707. /proc h
  5708. /proc/filesystems r
  5709. /run
  5710. /run/user
  5711. /run/user/colin
  5712. /run/user/colin/dconf
  5713. /run/user/colin/dconf/user rw
  5714. /selinux
  5715. /usr h
  5716. /usr/lib rx
  5717. /usr/share r
  5718. -CAP_ALL
  5719. bind disabled
  5720. connect disabled
  5721. }
  5722.  
  5723. # Role: colin
  5724. subject /usr/lib/x86_64-linux-gnu/notify-osd o {
  5725. / h
  5726. /etc r
  5727. /etc/grsec h
  5728. /etc/gshadow h
  5729. /etc/gshadow- h
  5730. /etc/passwd h
  5731. /etc/ppp h
  5732. /etc/samba/smbpasswd h
  5733. /etc/shadow h
  5734. /etc/shadow- h
  5735. /etc/ssh h
  5736. /home h
  5737. /home/colin/.Xauthority r
  5738. /home/colin/.config/dconf/user r
  5739. /home/colin/.local/share/icons
  5740. /home/colin/.local/share/mime/mime.cache r
  5741. /lib rx
  5742. /lib/modules h
  5743. /proc h
  5744. /proc/filesystems r
  5745. /run
  5746. /run/user
  5747. /run/user/colin
  5748. /run/user/colin/dconf
  5749. /run/user/colin/dconf/user rw
  5750. /selinux
  5751. /usr h
  5752. /usr/lib rx
  5753. /usr/local h
  5754. /usr/local/share/fonts
  5755. /usr/share r
  5756. /var h
  5757. /var/cache h
  5758. /var/cache/fontconfig r
  5759. -CAP_ALL
  5760. bind disabled
  5761. connect disabled
  5762. }
  5763.  
  5764. # Role: colin
  5765. subject /usr/lib/x86_64-linux-gnu/unity-lens-applications/unity-applications-daemon o {
  5766. / h
  5767. /etc r
  5768. /etc/gnome h
  5769. /etc/gnome/defaults.list
  5770. /etc/grsec h
  5771. /etc/gshadow h
  5772. /etc/gshadow- h
  5773. /etc/passwd h
  5774. /etc/ppp h
  5775. /etc/samba/smbpasswd h
  5776. /etc/shadow h
  5777. /etc/shadow- h
  5778. /etc/ssh h
  5779. /etc/xdg
  5780. /etc/xdg/menus
  5781. /etc/xdg/menus/unity-lens-applications.menu r
  5782. /home
  5783. /home/colin r
  5784. /lib rx
  5785. /lib/modules h
  5786. /opt h
  5787. /opt/google/chrome/google-chrome
  5788. /proc h
  5789. /proc/filesystems r
  5790. /proc/sys/vm/overcommit_memory r
  5791. /run
  5792. /run/user
  5793. /run/user/colin
  5794. /run/user/colin/dconf
  5795. /run/user/colin/dconf/user rw
  5796. /selinux
  5797. /sys h
  5798. /sys/devices/system/cpu/online r
  5799. /tmp rwcd
  5800. /usr
  5801. /usr/games h
  5802. /usr/games/gnome-mahjongg
  5803. /usr/games/gnome-mines
  5804. /usr/games/gnome-sudoku
  5805. /usr/games/sol
  5806. /usr/lib rx
  5807. /usr/local
  5808. /usr/share r
  5809. /usr/src h
  5810. /var h
  5811. /var/cache/software-center/xapian r
  5812. -CAP_ALL
  5813. bind disabled
  5814. connect disabled
  5815. }
  5816.  
  5817. # Role: colin
  5818. subject /usr/lib/x86_64-linux-gnu/unity-lens-files/unity-files-daemon o {
  5819. / h
  5820. /etc h
  5821. /etc/ld.so.cache r
  5822. /etc/locale.alias r
  5823. /home h
  5824. /home/colin
  5825. /home/colin/.config/dconf/user r
  5826. /home/colin/.config/user-dirs.dirs r
  5827. /lib rx
  5828. /lib/modules h
  5829. /proc h
  5830. /proc/filesystems r
  5831. /proc/sys/vm/overcommit_memory r
  5832. /run
  5833. /run/user
  5834. /run/user/colin
  5835. /run/user/colin/dconf
  5836. /run/user/colin/dconf/user rw
  5837. /selinux
  5838. /usr h
  5839. /usr/lib rx
  5840. /usr/share r
  5841. -CAP_ALL
  5842. bind disabled
  5843. connect disabled
  5844. }
  5845.  
  5846. # Role: colin
  5847. subject /usr/lib/x86_64-linux-gnu/unity-lens-friends o {
  5848. / h
  5849. /etc h
  5850. /etc/ld.so.cache r
  5851. /etc/locale.alias r
  5852. /home
  5853. /home/colin
  5854. /home/colin/.config
  5855. /home/colin/.config/dconf/user r
  5856. /home/colin/.config/libaccounts-glib
  5857. /home/colin/.config/libaccounts-glib/accounts.db rw
  5858. /home/colin/.config/libaccounts-glib/accounts.db-shm rw
  5859. /home/colin/.config/libaccounts-glib/accounts.db-wal rw
  5860. /lib rx
  5861. /lib/modules h
  5862. /proc h
  5863. /proc/filesystems r
  5864. /proc/sys/vm/overcommit_memory r
  5865. /run
  5866. /run/user
  5867. /run/user/colin
  5868. /run/user/colin/dconf
  5869. /run/user/colin/dconf/user rw
  5870. /selinux
  5871. /sys h
  5872. /sys/devices/system/cpu/online r
  5873. /usr h
  5874. /usr/lib rx
  5875. /usr/share r
  5876. -CAP_ALL
  5877. bind disabled
  5878. connect disabled
  5879. }
  5880.  
  5881. # Role: colin
  5882. subject /usr/lib/x86_64-linux-gnu/unity-lens-music/unity-music-daemon o {
  5883. / h
  5884. /etc h
  5885. /etc/ld.so.cache r
  5886. /etc/locale.alias r
  5887. /lib rx
  5888. /lib/modules h
  5889. /proc h
  5890. /proc/filesystems r
  5891. /proc/sys/vm/overcommit_memory r
  5892. /selinux
  5893. /sys h
  5894. /sys/devices/system/cpu/online r
  5895. /usr h
  5896. /usr/lib rx
  5897. /usr/share
  5898. /usr/share/gvfs/remote-volume-monitors r
  5899. -CAP_ALL
  5900. bind disabled
  5901. connect disabled
  5902. }
  5903.  
  5904. # Role: colin
  5905. subject /usr/lib/x86_64-linux-gnu/unity-lens-shopping/unity-shopping-daemon o {
  5906. / h
  5907. /bin h
  5908. /bin/dash x
  5909. /dev h
  5910. /dev/random
  5911. /dev/urandom r
  5912. /etc h
  5913. /etc/ld.so.cache r
  5914. /etc/locale.alias r
  5915. /etc/pkcs11/modules
  5916. /etc/pkcs11/modules/gnome-keyring.module r
  5917. /etc/ssl/certs/ca-certificates.crt r
  5918. /home h
  5919. /home/colin/.config/dconf/user r
  5920. /lib rx
  5921. /lib/modules h
  5922. /proc h
  5923. /proc/filesystems r
  5924. /proc/sys/vm/overcommit_memory r
  5925. /run rw
  5926. /selinux
  5927. /sys h
  5928. /sys/devices/system/cpu/online r
  5929. /usr h
  5930. /usr/lib rx
  5931. /usr/share r
  5932. -CAP_ALL
  5933. bind disabled
  5934. connect disabled
  5935. }
  5936.  
  5937. # Role: colin
  5938. subject /usr/lib/x86_64-linux-gnu/unity-lens-video/unity-scope-video-remote o {
  5939. / h
  5940. /bin h
  5941. /bin/dash x
  5942. /dev h
  5943. /dev/random
  5944. /dev/urandom r
  5945. /etc r
  5946. /etc/grsec h
  5947. /etc/gshadow h
  5948. /etc/gshadow- h
  5949. /etc/passwd h
  5950. /etc/ppp h
  5951. /etc/samba/smbpasswd h
  5952. /etc/shadow h
  5953. /etc/shadow- h
  5954. /etc/ssh h
  5955. /home h
  5956. /home/colin/.config/dconf/user r
  5957. /lib rx
  5958. /lib/modules h
  5959. /proc h
  5960. /proc/filesystems r
  5961. /proc/sys/vm/overcommit_memory r
  5962. /run rw
  5963. /selinux
  5964. /usr h
  5965. /usr/lib rx
  5966. /usr/share/glib-2.0/schemas/gschemas.compiled r
  5967. /usr/share/gvfs/remote-volume-monitors
  5968. /usr/share/gvfs/remote-volume-monitors/afc.monitor r
  5969. /usr/share/gvfs/remote-volume-monitors/gphoto2.monitor r
  5970. /usr/share/gvfs/remote-volume-monitors/mtp.monitor r
  5971. /usr/share/gvfs/remote-volume-monitors/udisks2.monitor r
  5972. -CAP_ALL
  5973. bind 0.0.0.0/32:0 dgram ip
  5974. connect 91.189.89.22/32:0 stream dgram tcp udp
  5975. connect 91.189.89.22/32:80 stream dgram tcp udp
  5976. connect 91.189.89.134/32:0 stream dgram tcp udp
  5977. connect 91.189.89.134/32:80 stream dgram tcp udp
  5978. connect 149.15.3.2/32:53 dgram udp
  5979. sock_allow_family netlink
  5980. }
  5981.  
  5982. # Role: colin
  5983. subject /usr/lib/x86_64-linux-gnu/unity-lens-video/unity-video-lens-daemon o {
  5984. / h
  5985. /dev h
  5986. /dev/null r
  5987. /etc h
  5988. /etc/alternatives/locate
  5989. /etc/alternatives/updatedb
  5990. /etc/ld.so.cache r
  5991. /etc/locale.alias r
  5992. /home h
  5993. /home/colin/.cache/unity-lens-video
  5994. /home/colin/.config/user-dirs.dirs r
  5995. /lib rx
  5996. /lib/modules h
  5997. /proc
  5998. /proc/bus h
  5999. /proc/filesystems r
  6000. /proc/kallsyms h
  6001. /proc/kcore h
  6002. /proc/modules h
  6003. /proc/slabinfo h
  6004. /proc/sys/vm/overcommit_memory r
  6005. /selinux
  6006. /sys h
  6007. /sys/devices/system/cpu/online r
  6008. /usr h
  6009. /usr/bin x
  6010. /usr/lib rx
  6011. /usr/share r
  6012. -CAP_ALL
  6013. bind disabled
  6014. connect disabled
  6015. }
  6016.  
  6017. # Role: colin
  6018. subject /usr/share/apport/apport-checkreports o {
  6019. / h
  6020. /dev h
  6021. /dev/urandom r
  6022. /etc r
  6023. /etc/grsec h
  6024. /etc/gshadow h
  6025. /etc/gshadow- h
  6026. /etc/passwd h
  6027. /etc/ppp h
  6028. /etc/samba/smbpasswd h
  6029. /etc/shadow h
  6030. /etc/shadow- h
  6031. /etc/ssh h
  6032. /lib rx
  6033. /lib/modules h
  6034. /proc h
  6035. /proc/meminfo r
  6036. /usr
  6037. /usr/bin
  6038. /usr/bin/python3.3 x
  6039. /usr/lib rxwc
  6040. /usr/share
  6041. /usr/share/apport
  6042. /usr/share/apport/apport-checkreports r
  6043. /usr/src h
  6044. /var h
  6045. /var/crash
  6046. /var/lib/apt
  6047. /var/lib/dpkg/status
  6048. -CAP_ALL
  6049. bind disabled
  6050. connect disabled
  6051. }
  6052.  
  6053. # Role: colin
  6054. subject /usr/share/apport/apport-gtk o {
  6055. / h
  6056. /dev h
  6057. /dev/urandom r
  6058. /etc r
  6059. /etc/grsec h
  6060. /etc/gshadow h
  6061. /etc/gshadow- h
  6062. /etc/passwd h
  6063. /etc/ppp h
  6064. /etc/samba/smbpasswd h
  6065. /etc/shadow h
  6066. /etc/shadow- h
  6067. /etc/ssh h
  6068. /home h
  6069. /home/colin rxwcd
  6070. /home/colin/.config h
  6071. /home/colin/.config/dconf/user r
  6072. /home/colin/.local h
  6073. /home/colin/.local/share/mime/mime.cache r
  6074. /lib rx
  6075. /lib/modules h
  6076. /opt h
  6077. /opt/google/chrome/google-chrome
  6078. /proc r
  6079. /proc/bus h
  6080. /proc/kallsyms h
  6081. /proc/kcore h
  6082. /proc/modules h
  6083. /proc/mounts
  6084. /proc/slabinfo h
  6085. /proc/sys h
  6086. /run
  6087. /run/shm h
  6088. /run/shm/ffiLIRFm8 rxwcd
  6089. /run/shm/ffiPFgpX0 rxwcd
  6090. /run/shm/ffiZ5bNi8 rxwcd
  6091. /run/shm/ffijYKZB0 rxwcd
  6092. /run/user
  6093. /run/user/colin
  6094. /run/user/colin/dconf
  6095. /run/user/colin/dconf/user rw
  6096. /selinux
  6097. /tmp rxwcd
  6098. /usr
  6099. /usr/bin x
  6100. /usr/lib rx
  6101. /usr/lib/firefox h
  6102. /usr/lib/firefox/firefox.sh
  6103. /usr/lib/girepository-1.0 r
  6104. /usr/lib/locale h
  6105. /usr/lib/locale/locale-archive r
  6106. /usr/lib/python3.3 r
  6107. /usr/lib/python3.3/__pycache__ rwc
  6108. /usr/lib/python3.3/email r
  6109. /usr/lib/python3.3/email/mime r
  6110. /usr/lib/python3.3/email/mime/__pycache__ wc
  6111. /usr/lib/python3.3/encodings
  6112. /usr/lib/python3.3/encodings/__pycache__ r
  6113. /usr/lib/python3.3/lib-dynload
  6114. /usr/lib/python3.3/lib-dynload/_bz2.cpython-33m-x86_64-linux-gnu.so rx
  6115. /usr/lib/python3.3/lib-dynload/_hashlib.cpython-33m-x86_64-linux-gnu.so rx
  6116. /usr/lib/python3.3/lib-dynload/_ssl.cpython-33m-x86_64-linux-gnu.so rx
  6117. /usr/lib/python3.3/logging
  6118. /usr/lib/python3.3/logging/__pycache__/__init__.cpython-33.pyc r
  6119. /usr/lib/python3.3/plat-x86_64-linux-gnu
  6120. /usr/lib/python3.3/plat-x86_64-linux-gnu/__pycache__/_sysconfigdata_m.cpython-33.pyc r
  6121. /usr/lib/python3.3/xml r
  6122. /usr/lib/python3.3/xml/dom r
  6123. /usr/lib/python3.3/xml/dom/__pycache__ wc
  6124. /usr/share r
  6125. /usr/src h
  6126. /var h
  6127. /var/crash
  6128. /var/lib/apt
  6129. /var/lib/dpkg/status
  6130. /var/tmp rxwcd
  6131. -CAP_ALL
  6132. bind disabled
  6133. connect disabled
  6134. }
  6135.  
  6136. # Role: colin
  6137. subject /usr/share/oneconf/oneconf-service o {
  6138. / h
  6139. /bin h
  6140. /bin/bzip2
  6141. /bin/dash x
  6142. /dev h
  6143. /dev/null r
  6144. /dev/urandom r
  6145. /etc r
  6146. /etc/grsec h
  6147. /etc/gshadow h
  6148. /etc/gshadow- h
  6149. /etc/passwd h
  6150. /etc/ppp h
  6151. /etc/samba/smbpasswd h
  6152. /etc/shadow h
  6153. /etc/shadow- h
  6154. /etc/ssh h
  6155. /home h
  6156. /home/colin rxwcd
  6157. /lib rx
  6158. /lib/modules h
  6159. /proc r
  6160. /proc/bus h
  6161. /proc/kallsyms h
  6162. /proc/kcore h
  6163. /proc/modules h
  6164. /proc/mounts
  6165. /proc/slabinfo h
  6166. /proc/sys h
  6167. /run
  6168. /run/dbus h
  6169. /run/dbus/system_bus_socket rw
  6170. /run/shm h
  6171. /run/shm/ffiKTk2Dh rxwcd
  6172. /run/shm/ffiMysWtU rxwcd
  6173. /run/shm/ffio8n9t8 rxwcd
  6174. /run/user
  6175. /run/user/colin
  6176. /run/user/colin/dconf
  6177. /run/user/colin/dconf/user rw
  6178. /selinux
  6179. /tmp rxwcd
  6180. /usr
  6181. /usr/bin x
  6182. /usr/lib rx
  6183. /usr/lib/girepository-1.0
  6184. /usr/lib/girepository-1.0/GLib-2.0.typelib r
  6185. /usr/lib/girepository-1.0/GObject-2.0.typelib r
  6186. /usr/lib/girepository-1.0/Gio-2.0.typelib r
  6187. /usr/lib/locale h
  6188. /usr/lib/locale/locale-archive r
  6189. /usr/lib/python3.3 r
  6190. /usr/lib/python3.3/__pycache__ rwc
  6191. /usr/lib/python3.3/encodings
  6192. /usr/lib/python3.3/encodings/__pycache__ r
  6193. /usr/lib/python3.3/json
  6194. /usr/lib/python3.3/json/__pycache__ r
  6195. /usr/lib/python3.3/lib-dynload
  6196. /usr/lib/python3.3/lib-dynload/_hashlib.cpython-33m-x86_64-linux-gnu.so rx
  6197. /usr/lib/python3.3/lib-dynload/_json.cpython-33m-x86_64-linux-gnu.so rx
  6198. /usr/lib/python3.3/lib-dynload/_ssl.cpython-33m-x86_64-linux-gnu.so rx
  6199. /usr/lib/python3.3/logging
  6200. /usr/lib/python3.3/logging/__pycache__/__init__.cpython-33.pyc r
  6201. /usr/lib/python3.3/plat-x86_64-linux-gnu
  6202. /usr/lib/python3.3/plat-x86_64-linux-gnu/__pycache__/_sysconfigdata_m.cpython-33.pyc r
  6203. /usr/lib/python3.3/xml r
  6204. /usr/share r
  6205. /usr/src h
  6206. /var h
  6207. /var/cache h
  6208. /var/cache/apt
  6209. /var/cache/apt/pkgcache.bin r
  6210. /var/lib r
  6211. /var/tmp rxwcd
  6212. -CAP_ALL
  6213. bind disabled
  6214. connect disabled
  6215. }
  6216.  
  6217. # Role: colin
  6218. subject /usr/share/software-center/piston_generic_helper.py o {
  6219. / h
  6220. /dev h
  6221. /dev/urandom r
  6222. /etc r
  6223. /etc/grsec h
  6224. /etc/gshadow h
  6225. /etc/gshadow- h
  6226. /etc/passwd h
  6227. /etc/ppp h
  6228. /etc/samba/smbpasswd h
  6229. /etc/shadow h
  6230. /etc/shadow- h
  6231. /etc/ssh h
  6232. /home h
  6233. /home/colin/.cache/software-center w
  6234. /home/colin/.cache/software-center/piston-helper
  6235. /home/colin/.cache/software-center/piston-helper/reviews.ubuntu.com,reviews,api,1.0,review-stats,any,any,updates-last-3-days,,1ea08a227a615b5966270464124e4ee4 wc
  6236. /home/colin/.cache/software-center/piston-helper/software-center.ubuntu.com,api,2.0,applications,en,ubuntu,raring,amd64,,f9522ce76056a21e0a17af22f850128e rw
  6237. /lib rx
  6238. /lib/modules h
  6239. /proc h
  6240. /proc/filesystems r
  6241. /proc/meminfo r
  6242. /run h
  6243. /run/resolvconf/resolv.conf r
  6244. /selinux
  6245. /usr
  6246. /usr/bin
  6247. /usr/bin/python2.7 x
  6248. /usr/lib rx
  6249. /usr/lib/girepository-1.0
  6250. /usr/lib/girepository-1.0/GLib-2.0.typelib r
  6251. /usr/lib/girepository-1.0/GObject-2.0.typelib r
  6252. /usr/lib/girepository-1.0/Gio-2.0.typelib r
  6253. /usr/lib/locale h
  6254. /usr/lib/locale/locale-archive r
  6255. /usr/lib/python2.7 r
  6256. /usr/lib/python2.7/argparse.pyc wc
  6257. /usr/lib/python2.7/dist-packages rx
  6258. /usr/lib/python2.7/email rwc
  6259. /usr/lib/python2.7/email/mime r
  6260. /usr/lib/python2.7/encodings rwc
  6261. /usr/lib/python2.7/lib-dynload rx
  6262. /usr/lib/python2.7/logging
  6263. /usr/lib/python2.7/logging/__init__.py r
  6264. /usr/lib/python2.7/logging/__init__.pyc r
  6265. /usr/lib/python2.7/plat-x86_64-linux-gnu
  6266. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.py r
  6267. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.pyc r
  6268. /usr/lib/python2.7/quopri.pyc wc
  6269. /usr/lib/python2.7/stringprep.pyc wc
  6270. /usr/lib/python2.7/uu.pyc wc
  6271. /usr/local h
  6272. /usr/local/lib/python2.7/dist-packages
  6273. /usr/share r
  6274. /usr/src h
  6275. /var h
  6276. /var/lib/apt
  6277. /var/lib/dpkg/status
  6278. -CAP_ALL
  6279. bind 0.0.0.0/32:0 dgram ip
  6280. connect 91.189.89.106/32:80 stream dgram tcp udp
  6281. connect 91.189.89.106/32:0 stream dgram tcp udp
  6282. connect 91.189.89.105/32:80 stream dgram tcp udp
  6283. connect 91.189.89.105/32:0 stream dgram tcp udp
  6284. connect 149.15.3.2/32:53 dgram udp
  6285. sock_allow_family netlink
  6286. }
  6287.  
  6288. # Role: colin
  6289. subject /usr/share/software-center/software-center-dbus o {
  6290. / h
  6291. /bin h
  6292. /bin/bzip2
  6293. /dev h
  6294. /dev/null r
  6295. /dev/urandom r
  6296. /etc r
  6297. /etc/grsec h
  6298. /etc/gshadow h
  6299. /etc/gshadow- h
  6300. /etc/passwd h
  6301. /etc/ppp h
  6302. /etc/samba/smbpasswd h
  6303. /etc/shadow h
  6304. /etc/shadow- h
  6305. /etc/ssh h
  6306. /home h
  6307. /home/colin/.cache/software-center rw
  6308. /lib rx
  6309. /lib/modules h
  6310. /proc r
  6311. /proc/bus h
  6312. /proc/kallsyms h
  6313. /proc/kcore h
  6314. /proc/modules h
  6315. /proc/mounts
  6316. /proc/slabinfo h
  6317. /proc/sys h
  6318. /run h
  6319. /run/dbus/system_bus_socket rw
  6320. /selinux
  6321. /sys h
  6322. /sys/devices/system/cpu/online r
  6323. /usr
  6324. /usr/bin x
  6325. /usr/lib rx
  6326. /usr/lib/girepository-1.0
  6327. /usr/lib/girepository-1.0/GLib-2.0.typelib r
  6328. /usr/lib/girepository-1.0/GObject-2.0.typelib r
  6329. /usr/lib/girepository-1.0/Gio-2.0.typelib r
  6330. /usr/lib/locale h
  6331. /usr/lib/locale/locale-archive r
  6332. /usr/lib/python2.7 r
  6333. /usr/lib/python2.7/bsddb
  6334. /usr/lib/python2.7/bsddb/__init__.py r
  6335. /usr/lib/python2.7/bsddb/__init__.pyc wc
  6336. /usr/lib/python2.7/bsddb/db.py r
  6337. /usr/lib/python2.7/bsddb/db.pyc wc
  6338. /usr/lib/python2.7/bsddb/dbutils.py r
  6339. /usr/lib/python2.7/bsddb/dbutils.pyc wc
  6340. /usr/lib/python2.7/dist-packages rx
  6341. /usr/lib/python2.7/email
  6342. /usr/lib/python2.7/email/__init__.py r
  6343. /usr/lib/python2.7/email/__init__.pyc r
  6344. /usr/lib/python2.7/email/mime r
  6345. /usr/lib/python2.7/lib-dynload rx
  6346. /usr/lib/python2.7/logging
  6347. /usr/lib/python2.7/logging/__init__.py r
  6348. /usr/lib/python2.7/logging/__init__.pyc r
  6349. /usr/lib/python2.7/plat-x86_64-linux-gnu
  6350. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.py r
  6351. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.pyc r
  6352. /usr/share rx
  6353. /usr/src h
  6354. /var h
  6355. /var/cache r
  6356. /var/lib r
  6357. /var/tmp
  6358. -CAP_ALL
  6359. bind disabled
  6360. connect disabled
  6361. }
  6362.  
  6363. # Role: colin
  6364. subject /usr/share/software-center/update-software-center-agent o {
  6365. /
  6366. /bin h
  6367. /bin/bzip2
  6368. /bin/cat x
  6369. /boot h
  6370. /dev h
  6371. /dev/null r
  6372. /dev/urandom r
  6373. /etc r
  6374. /etc/grsec h
  6375. /etc/gshadow h
  6376. /etc/gshadow- h
  6377. /etc/passwd h
  6378. /etc/ppp h
  6379. /etc/samba/smbpasswd h
  6380. /etc/shadow h
  6381. /etc/shadow- h
  6382. /etc/ssh h
  6383. /home h
  6384. /home/colin/.cache/software-center rwcd
  6385. /lib rx
  6386. /lib/modules h
  6387. /lib64/modules h
  6388. /proc r
  6389. /proc/bus h
  6390. /proc/kallsyms h
  6391. /proc/kcore h
  6392. /proc/modules h
  6393. /proc/mounts
  6394. /proc/slabinfo h
  6395. /proc/sys h
  6396. /sys h
  6397. /usr
  6398. /usr/bin x
  6399. /usr/lib rx
  6400. /usr/lib/girepository-1.0
  6401. /usr/lib/girepository-1.0/GLib-2.0.typelib r
  6402. /usr/lib/girepository-1.0/GObject-2.0.typelib r
  6403. /usr/lib/girepository-1.0/Gio-2.0.typelib r
  6404. /usr/lib/locale h
  6405. /usr/lib/locale/locale-archive
  6406. /usr/lib/python2.7 r
  6407. /usr/lib/python2.7/_strptime.pyc wc
  6408. /usr/lib/python2.7/dist-packages rx
  6409. /usr/lib/python2.7/email
  6410. /usr/lib/python2.7/email/__init__.py r
  6411. /usr/lib/python2.7/email/__init__.pyc r
  6412. /usr/lib/python2.7/email/mime r
  6413. /usr/lib/python2.7/lib-dynload rx
  6414. /usr/lib/python2.7/logging
  6415. /usr/lib/python2.7/logging/__init__.py r
  6416. /usr/lib/python2.7/logging/__init__.pyc r
  6417. /usr/lib/python2.7/logging/handlers.py r
  6418. /usr/lib/python2.7/logging/handlers.pyc wc
  6419. /usr/lib/python2.7/plat-x86_64-linux-gnu
  6420. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.py r
  6421. /usr/lib/python2.7/plat-x86_64-linux-gnu/_sysconfigdata_nd.pyc r
  6422. /usr/local h
  6423. /usr/local/lib/python2.7/dist-packages
  6424. /usr/share rx
  6425. /usr/src h
  6426. /var h
  6427. /var/cache h
  6428. /var/cache/apt
  6429. /var/cache/apt/srcpkgcache.bin r
  6430. /var/lib r
  6431. -CAP_ALL
  6432. bind disabled
  6433. connect disabled
  6434. }
  6435.  
  6436. role dnscrypt u
  6437. role_allow_ip 0.0.0.0/32
  6438. # Role: dnscrypt
  6439. subject / {
  6440. / h
  6441. -CAP_ALL
  6442. bind disabled
  6443. connect disabled
  6444. }
  6445.  
  6446. # Role: dnscrypt
  6447. subject /usr/local/sbin/dnscrypt-proxy o {
  6448. / h
  6449. -CAP_ALL
  6450. bind 0.0.0.0/32:0 dgram ip
  6451. connect 113.20.8.17/32:443 dgram udp
  6452. connect 113.20.6.2/32:443 dgram udp
  6453. }
  6454.  
  6455. role syslog u
  6456. role_allow_ip 0.0.0.0/32
  6457. # Role: syslog
  6458. subject / {
  6459. / h
  6460. -CAP_ALL
  6461. bind disabled
  6462. connect disabled
  6463. }
  6464.  
  6465. # Role: syslog
  6466. subject /usr/sbin/rsyslogd o {
  6467. / h
  6468. /dev h
  6469. /dev/log wd
  6470. /etc h
  6471. /etc/ld.so.cache r
  6472. /lib h
  6473. /lib/x86_64-linux-gnu/libgcc_s.so.1 rx
  6474. /run h
  6475. /run/rsyslogd.pid wd
  6476. /var h
  6477. /var/log/auth.log a
  6478. -CAP_ALL
  6479. bind disabled
  6480. connect disabled
  6481. }
  6482.  
  6483. role lightdm u
  6484. role_allow_ip 0.0.0.0/32
  6485. # Role: lightdm
  6486. subject / {
  6487. /
  6488. /bin x
  6489. /boot h
  6490. /dev h
  6491. /dev/fuse rw
  6492. /dev/null rw
  6493. /dev/urandom r
  6494. /etc r
  6495. /etc/at-spi2 h
  6496. /etc/at-spi2/accessibility.conf r
  6497. /etc/dbus-1 h
  6498. /etc/dbus-1/session.conf r
  6499. /etc/dbus-1/session.d
  6500. /etc/grsec h
  6501. /etc/gshadow h
  6502. /etc/gshadow- h
  6503. /etc/ppp h
  6504. /etc/samba/smbpasswd h
  6505. /etc/shadow h
  6506. /etc/shadow- h
  6507. /etc/ssh h
  6508. /lib rx
  6509. /lib/modules h
  6510. /lib64/modules h
  6511. /proc r
  6512. /proc/bus h
  6513. /proc/kallsyms h
  6514. /proc/kcore h
  6515. /proc/modules h
  6516. /proc/slabinfo h
  6517. /proc/sys h
  6518. /run
  6519. /run/user
  6520. /run/user/lightdm
  6521. /sys h
  6522. /tmp rwc
  6523. /usr h
  6524. /usr/bin x
  6525. /usr/lib rx
  6526. /usr/sbin h
  6527. /usr/sbin/unity-greeter x
  6528. /usr/share rx
  6529. /var
  6530. /var/backups h
  6531. /var/lib r
  6532. /var/log h
  6533. -CAP_ALL
  6534. bind disabled
  6535. connect disabled
  6536. }
  6537.  
  6538. # Role: lightdm
  6539. subject /bin/fusermount o {
  6540. user_transition_allow nobody lightdm root
  6541.  
  6542. /
  6543. /bin h
  6544. /bin/fusermount x
  6545. /boot h
  6546. /dev h
  6547. /dev/fuse rw
  6548. /etc rw
  6549. /etc/grsec h
  6550. /etc/gshadow h
  6551. /etc/gshadow- h
  6552. /etc/ppp h
  6553. /etc/samba/smbpasswd h
  6554. /etc/shadow h
  6555. /etc/shadow- h
  6556. /etc/ssh h
  6557. /lib h
  6558. /lib/x86_64-linux-gnu rx
  6559. /lib64/modules h
  6560. /proc/bus h
  6561. /proc/kallsyms h
  6562. /proc/kcore h
  6563. /proc/modules h
  6564. /proc/slabinfo h
  6565. /proc/sys h
  6566. /run
  6567. /run/user
  6568. /run/user/lightdm
  6569. /run/user/lightdm/gvfs w
  6570. /sys h
  6571. /usr/src h
  6572. /var/backups h
  6573. /var/log h
  6574. -CAP_ALL
  6575. +CAP_DAC_READ_SEARCH
  6576. +CAP_SETUID
  6577. +CAP_SYS_ADMIN
  6578. bind disabled
  6579. connect disabled
  6580. }
  6581.  
  6582. # Role: lightdm
  6583. subject /usr/bin/dbus-launch o {
  6584. /
  6585. /bin h
  6586. /bin/dbus-daemon x
  6587. /boot h
  6588. /dev h
  6589. /dev/null rw
  6590. /etc h
  6591. /etc/ld.so.cache r
  6592. /etc/nsswitch.conf r
  6593. /etc/passwd r
  6594. /lib h
  6595. /lib/x86_64-linux-gnu rx
  6596. /lib64/modules h
  6597. /proc/bus h
  6598. /proc/kallsyms h
  6599. /proc/kcore h
  6600. /proc/modules h
  6601. /proc/slabinfo h
  6602. /proc/sys h
  6603. /sys h
  6604. /usr h
  6605. /usr/bin h
  6606. /usr/bin/dbus-launch x
  6607. /usr/lib rx
  6608. /var h
  6609. /var/lib/dbus/machine-id r
  6610. /var/lib/lightdm/.Xauthority r
  6611. /var/lib/lightdm/.dbus
  6612. /var/lib/lightdm/.dbus/session-bus
  6613. /var/lib/lightdm/.dbus/session-bus/2a7c9e4458ccbfd5a964c1c0520b0164-0 w
  6614. -CAP_ALL
  6615. bind disabled
  6616. connect disabled
  6617. }
  6618.  
  6619. # Role: lightdm
  6620. subject /usr/bin/gnome-keyring-daemon o {
  6621. / h
  6622. /dev h
  6623. /dev/null r
  6624. /dev/random
  6625. /dev/urandom r
  6626. /etc h
  6627. /etc/ld.so.cache r
  6628. /lib rx
  6629. /lib/modules h
  6630. /proc r
  6631. /proc/bus h
  6632. /proc/kallsyms h
  6633. /proc/kcore h
  6634. /proc/modules h
  6635. /proc/slabinfo h
  6636. /proc/sys h
  6637. /run wc
  6638. /selinux
  6639. /usr h
  6640. /usr/bin h
  6641. /usr/bin/gnome-keyring-daemon x
  6642. /usr/lib rx
  6643. -CAP_ALL
  6644. +CAP_IPC_LOCK
  6645. bind disabled
  6646. connect disabled
  6647. }
  6648.  
  6649. # Role: lightdm
  6650. subject /usr/bin/nm-applet o {
  6651. / h
  6652. /dev h
  6653. /dev/null r
  6654. /dev/urandom r
  6655. /etc r
  6656. /etc/grsec h
  6657. /etc/gshadow h
  6658. /etc/gshadow- h
  6659. /etc/ppp h
  6660. /etc/samba/smbpasswd h
  6661. /etc/shadow h
  6662. /etc/shadow- h
  6663. /etc/ssh h
  6664. /lib rx
  6665. /lib/modules h
  6666. /proc
  6667. /proc/bus h
  6668. /proc/filesystems r
  6669. /proc/kallsyms h
  6670. /proc/kcore h
  6671. /proc/modules h
  6672. /proc/slabinfo h
  6673. /proc/sys h
  6674. /run
  6675. /run/dbus/system_bus_socket rw
  6676. /run/user
  6677. /run/user/lightdm
  6678. /run/user/lightdm/dconf
  6679. /run/user/lightdm/dconf/user rw
  6680. /selinux
  6681. /tmp
  6682. /usr h
  6683. /usr/bin h
  6684. /usr/bin/nm-applet x
  6685. /usr/lib rx
  6686. /usr/local h
  6687. /usr/local/share/fonts
  6688. /usr/share r
  6689. /var h
  6690. /var/cache h
  6691. /var/cache/fontconfig r
  6692. /var/lib h
  6693. /var/lib/lightdm/.Xauthority r
  6694. /var/lib/lightdm/.config/dconf/user r
  6695. /var/tmp
  6696. -CAP_ALL
  6697. bind disabled
  6698. connect disabled
  6699. }
  6700.  
  6701. # Role: lightdm
  6702. subject /usr/bin/pulseaudio o {
  6703. /
  6704. /boot h
  6705. /dev h
  6706. /dev/log rw
  6707. /dev/null rw
  6708. /dev/snd rw
  6709. /dev/urandom r
  6710. /etc r
  6711. /etc/grsec h
  6712. /etc/gshadow h
  6713. /etc/gshadow- h
  6714. /etc/passwd h
  6715. /etc/ppp h
  6716. /etc/pulse h
  6717. /etc/pulse/client.conf r
  6718. /etc/pulse/daemon.conf r
  6719. /etc/pulse/default.pa r
  6720. /etc/samba/smbpasswd h
  6721. /etc/shadow h
  6722. /etc/shadow- h
  6723. /etc/ssh h
  6724. /etc/udev h
  6725. /etc/udev/udev.conf r
  6726. /lib rx
  6727. /lib/modules h
  6728. /lib64/modules h
  6729. /proc r
  6730. /proc/bus h
  6731. /proc/kallsyms h
  6732. /proc/kcore h
  6733. /proc/modules h
  6734. /proc/slabinfo h
  6735. /proc/sys h
  6736. /run r
  6737. /run/dbus h
  6738. /run/dbus/system_bus_socket rw
  6739. /run/shm rwcd
  6740. /run/udev h
  6741. /run/udev/data/+sound:card0 r
  6742. /run/udev/data/+sound:card1 r
  6743. /run/user
  6744. /run/user/lightdm
  6745. /run/user/lightdm/pulse w
  6746. /run/user/lightdm/pulse/autospawn.lock rwcd
  6747. /run/user/lightdm/pulse/native wc
  6748. /run/user/lightdm/pulse/pid rwc
  6749. /sys r
  6750. /usr
  6751. /usr/bin
  6752. /usr/bin/pulseaudio x
  6753. /usr/lib rx
  6754. /usr/share r
  6755. /usr/src h
  6756. /var
  6757. /var/backups h
  6758. /var/lib r
  6759. /var/lib/lightdm
  6760. /var/lib/lightdm/.Xauthority r
  6761. /var/lib/lightdm/.config
  6762. /var/lib/lightdm/.config/pulse rw
  6763. /var/log h
  6764. -CAP_ALL
  6765. bind disabled
  6766. connect disabled
  6767. sock_allow_family netlink
  6768. }
  6769.  
  6770. # Role: lightdm
  6771. subject /usr/lib/NetworkManager/nm-applet-migration-tool o {
  6772. / h
  6773. /etc h
  6774. /etc/ld.so.cache r
  6775. /lib rx
  6776. /lib/modules h
  6777. /proc h
  6778. /proc/filesystems r
  6779. /run h
  6780. /run/dbus/system_bus_socket rw
  6781. /selinux
  6782. /usr h
  6783. /usr/lib rx
  6784. -CAP_ALL
  6785. bind disabled
  6786. connect disabled
  6787. }
  6788.  
  6789. # Role: lightdm
  6790. subject /usr/lib/at-spi2-core/at-spi-bus-launcher o {
  6791. / h
  6792. /bin h
  6793. /bin/dbus-daemon x
  6794. /dev h
  6795. /dev/null r
  6796. /etc h
  6797. /etc/ld.so.cache r
  6798. /etc/locale.alias r
  6799. /lib rx
  6800. /lib/modules h
  6801. /proc
  6802. /proc/bus h
  6803. /proc/filesystems r
  6804. /proc/kallsyms h
  6805. /proc/kcore h
  6806. /proc/modules h
  6807. /proc/slabinfo h
  6808. /proc/sys h
  6809. /run
  6810. /run/user
  6811. /run/user/lightdm
  6812. /run/user/lightdm/dconf rwc
  6813. /selinux
  6814. /usr h
  6815. /usr/lib rx
  6816. /usr/share r
  6817. /var h
  6818. /var/lib/lightdm/.Xauthority r
  6819. /var/lib/lightdm/.config/dconf/user r
  6820. -CAP_ALL
  6821. bind disabled
  6822. connect disabled
  6823. }
  6824.  
  6825. # Role: lightdm
  6826. subject /usr/lib/dconf/dconf-service o {
  6827. / h
  6828. /etc h
  6829. /etc/ld.so.cache r
  6830. /lib h
  6831. /lib/x86_64-linux-gnu rx
  6832. /proc h
  6833. /proc/cmdline
  6834. /proc/filesystems r
  6835. /run h
  6836. /run/user/lightdm/dconf/user rwd
  6837. /selinux
  6838. /usr h
  6839. /usr/lib rx
  6840. /var h
  6841. /var/lib rwcd
  6842. -CAP_ALL
  6843. bind disabled
  6844. connect disabled
  6845. }
  6846.  
  6847. # Role: lightdm
  6848. subject /usr/lib/evolution/evolution-calendar-factory o {
  6849. / h
  6850. /etc h
  6851. /etc/ld.so.cache r
  6852. /etc/locale.alias r
  6853. /etc/localtime r
  6854. /etc/nsswitch.conf r
  6855. /etc/passwd r
  6856. /lib rx
  6857. /lib/modules h
  6858. /proc h
  6859. /proc/filesystems r
  6860. /run
  6861. /run/user
  6862. /run/user/lightdm
  6863. /run/user/lightdm/dconf
  6864. /run/user/lightdm/dconf/user rw
  6865. /selinux
  6866. /usr h
  6867. /usr/lib rx
  6868. /usr/share r
  6869. /var
  6870. /var/backups h
  6871. /var/lib r
  6872. /var/log h
  6873. -CAP_ALL
  6874. bind disabled
  6875. connect disabled
  6876. sock_allow_family netlink
  6877. }
  6878.  
  6879. # Role: lightdm
  6880. subject /usr/lib/gnome-settings-daemon/gnome-settings-daemon o {
  6881. / h
  6882. /etc r
  6883. /etc/grsec h
  6884. /etc/gshadow h
  6885. /etc/gshadow- h
  6886. /etc/passwd h
  6887. /etc/ppp h
  6888. /etc/samba/smbpasswd h
  6889. /etc/shadow h
  6890. /etc/shadow- h
  6891. /etc/ssh h
  6892. /lib rx
  6893. /lib/modules h
  6894. /proc h
  6895. /proc/filesystems r
  6896. /proc/sys/vm/overcommit_memory r
  6897. /run rwc
  6898. /selinux
  6899. /sys r
  6900. /usr h
  6901. /usr/lib rx
  6902. /usr/local h
  6903. /usr/local/share/fonts
  6904. /usr/share r
  6905. /var
  6906. /var/backups h
  6907. /var/cache h
  6908. /var/cache/fontconfig r
  6909. /var/lib r
  6910. /var/log h
  6911. -CAP_ALL
  6912. bind disabled
  6913. connect disabled
  6914. sock_allow_family netlink
  6915. }
  6916.  
  6917. # Role: lightdm
  6918. subject /usr/lib/gvfs/gvfsd o {
  6919. / h
  6920. /dev h
  6921. /dev/null rw
  6922. /etc h
  6923. /etc/ld.so.cache r
  6924. /etc/locale.alias r
  6925. /lib rx
  6926. /lib/modules h
  6927. /proc
  6928. /proc/bus h
  6929. /proc/filesystems r
  6930. /proc/kallsyms h
  6931. /proc/kcore h
  6932. /proc/modules h
  6933. /proc/slabinfo h
  6934. /proc/sys h
  6935. /run h
  6936. /run/user/lightdm/gvfs wc
  6937. /selinux
  6938. /usr h
  6939. /usr/lib rx
  6940. /usr/share r
  6941. -CAP_ALL
  6942. bind disabled
  6943. connect disabled
  6944. }
  6945.  
  6946. # Role: lightdm
  6947. subject /usr/lib/indicator-session/indicator-session-service o {
  6948. / h
  6949. /etc h
  6950. /etc/ld.so.cache r
  6951. /etc/locale.alias r
  6952. /etc/nsswitch.conf r
  6953. /etc/passwd r
  6954. /lib rx
  6955. /lib/modules h
  6956. /proc h
  6957. /proc/filesystems r
  6958. /run
  6959. /run/dbus/system_bus_socket rw
  6960. /run/user
  6961. /run/user/lightdm
  6962. /run/user/lightdm/dconf
  6963. /run/user/lightdm/dconf/user rw
  6964. /selinux
  6965. /usr h
  6966. /usr/lib rx
  6967. /usr/share r
  6968. /var h
  6969. /var/lib/lightdm/.config/dconf/user r
  6970. -CAP_ALL
  6971. bind disabled
  6972. connect disabled
  6973. }
  6974.  
  6975. # Role: lightdm
  6976. subject /usr/lib/x86_64-linux-gnu/gconf/gconfd-2 o {
  6977. /
  6978. /boot h
  6979. /dev h
  6980. /dev/null rw
  6981. /etc r
  6982. /etc/gconf h
  6983. /etc/gconf/2/path r
  6984. /etc/gconf/gconf.xml.defaults
  6985. /etc/gconf/gconf.xml.defaults/%gconf-tree.xml r
  6986. /etc/gconf/gconf.xml.mandatory
  6987. /etc/gconf/gconf.xml.mandatory/%gconf-tree.xml r
  6988. /etc/grsec h
  6989. /etc/gshadow h
  6990. /etc/gshadow- h
  6991. /etc/ppp h
  6992. /etc/samba/smbpasswd h
  6993. /etc/shadow h
  6994. /etc/shadow- h
  6995. /etc/ssh h
  6996. /lib rx
  6997. /lib/modules h
  6998. /lib64/modules h
  6999. /proc h
  7000. /proc/filesystems r
  7001. /run h
  7002. /run/dbus/system_bus_socket rw
  7003. /sys h
  7004. /usr h
  7005. /usr/lib rx
  7006. /var h
  7007. /var/lib/gconf/debian.defaults
  7008. /var/lib/gconf/debian.defaults/%gconf-tree.xml r
  7009. /var/lib/gconf/debian.mandatory
  7010. /var/lib/gconf/defaults
  7011. /var/lib/gconf/defaults/%gconf-tree.xml r
  7012. /var/lib/lightdm/.gconf
  7013. /var/lib/lightdm/.gconf/.testing.writeability wcd
  7014. /var/lib/lightdm/.gconf/apps
  7015. /var/lib/lightdm/.gconf/apps/nm-applet/%gconf.xml r
  7016. -CAP_ALL
  7017. bind disabled
  7018. connect disabled
  7019. }
  7020.  
  7021. # Role: lightdm
  7022. subject /usr/lib/x86_64-linux-gnu/indicator-datetime-service o {
  7023. / h
  7024. /etc r
  7025. /etc/grsec h
  7026. /etc/gshadow h
  7027. /etc/gshadow- h
  7028. /etc/ppp h
  7029. /etc/samba/smbpasswd h
  7030. /etc/shadow h
  7031. /etc/shadow- h
  7032. /etc/ssh h
  7033. /lib rx
  7034. /lib/modules h
  7035. /proc h
  7036. /proc/filesystems r
  7037. /run
  7038. /run/dbus/system_bus_socket rw
  7039. /run/user
  7040. /run/user/lightdm
  7041. /run/user/lightdm/dconf
  7042. /run/user/lightdm/dconf/user rw
  7043. /selinux
  7044. /usr h
  7045. /usr/lib rx
  7046. /usr/share r
  7047. /var h
  7048. /var/lib/lightdm/.config/dconf/user r
  7049. -CAP_ALL
  7050. bind disabled
  7051. connect disabled
  7052. }
  7053.  
  7054. # Role: lightdm
  7055. subject /usr/lib/x86_64-linux-gnu/indicator-sound-service o {
  7056. / h
  7057. /dev h
  7058. /dev/urandom r
  7059. /etc h
  7060. /etc/ld.so.cache r
  7061. /etc/locale.alias r
  7062. /etc/pulse/client.conf r
  7063. /lib rx
  7064. /lib/modules h
  7065. /proc
  7066. /proc/bus h
  7067. /proc/filesystems r
  7068. /proc/kallsyms h
  7069. /proc/kcore h
  7070. /proc/modules h
  7071. /proc/slabinfo h
  7072. /proc/sys/vm/overcommit_memory r
  7073. /run r
  7074. /run/shm rwc
  7075. /run/user
  7076. /run/user/lightdm
  7077. /run/user/lightdm/pulse rwc
  7078. /selinux
  7079. /usr h
  7080. /usr/bin h
  7081. /usr/bin/pulseaudio x
  7082. /usr/lib rx
  7083. /var h
  7084. /var/lib/dbus/machine-id r
  7085. /var/lib/lightdm/.Xauthority r
  7086. /var/lib/lightdm/.config/pulse/cookie r
  7087. -CAP_ALL
  7088. bind disabled
  7089. connect disabled
  7090. }
  7091.  
  7092. # Role: lightdm
  7093. subject /usr/lib/x86_64-linux-gnu/notify-osd o {
  7094. / h
  7095. /etc r
  7096. /etc/grsec h
  7097. /etc/gshadow h
  7098. /etc/gshadow- h
  7099. /etc/passwd h
  7100. /etc/ppp h
  7101. /etc/samba/smbpasswd h
  7102. /etc/shadow h
  7103. /etc/shadow- h
  7104. /etc/ssh h
  7105. /lib rx
  7106. /lib/modules h
  7107. /proc h
  7108. /proc/filesystems r
  7109. /run
  7110. /run/user
  7111. /run/user/lightdm
  7112. /run/user/lightdm/dconf
  7113. /run/user/lightdm/dconf/user rw
  7114. /selinux
  7115. /usr h
  7116. /usr/lib rx
  7117. /usr/local h
  7118. /usr/local/share/fonts
  7119. /usr/share r
  7120. /var h
  7121. /var/cache h
  7122. /var/cache/fontconfig r
  7123. /var/lib h
  7124. /var/lib/lightdm/.Xauthority r
  7125. /var/lib/lightdm/.config/dconf/user r
  7126. -CAP_ALL
  7127. bind disabled
  7128. connect disabled
  7129. }
  7130.  
  7131. # Role: lightdm
  7132. subject /usr/lib/x86_64-linux-gnu/remote-login-service/remote-login-service o {
  7133. / h
  7134. /dev h
  7135. /dev/random
  7136. /dev/urandom r
  7137. /etc r
  7138. /etc/grsec h
  7139. /etc/gshadow h
  7140. /etc/gshadow- h
  7141. /etc/ppp h
  7142. /etc/samba/smbpasswd h
  7143. /etc/shadow h
  7144. /etc/shadow- h
  7145. /etc/ssh h
  7146. /lib rx
  7147. /lib/modules h
  7148. /proc h
  7149. /proc/filesystems r
  7150. /run h
  7151. /run/dbus/system_bus_socket rw
  7152. /run/resolvconf/resolv.conf r
  7153. /selinux
  7154. /tmp
  7155. /usr h
  7156. /usr/bin h
  7157. /usr/bin/thin-client-config-agent
  7158. /usr/lib rx
  7159. /usr/share h
  7160. /usr/share/gvfs/remote-volume-monitors r
  7161. /var h
  7162. /var/tmp
  7163. -CAP_ALL
  7164. bind 0.0.0.0/32:0 dgram ip
  7165. connect 91.189.95.73/32:443 stream tcp
  7166. connect 149.15.3.2/32:53 dgram udp
  7167. sock_allow_family netlink
  7168. }
  7169.  
  7170. # Role: lightdm
  7171. subject /usr/sbin/lightdm o {
  7172. / h
  7173. /usr/bin/gnome-keyring-daemon x
  7174. /usr/lib/lightdm/lightdm-greeter-session x
  7175. /var/lib/lightdm rwcd
  7176. -CAP_ALL
  7177. bind disabled
  7178. connect disabled
  7179. }
  7180.  
  7181. # Role: lightdm
  7182. subject /usr/sbin/unity-greeter o {
  7183. / h
  7184. /dev h
  7185. /dev/null r
  7186. /dev/urandom r
  7187. /etc r
  7188. /etc/grsec h
  7189. /etc/gshadow h
  7190. /etc/gshadow- h
  7191. /etc/passwd h
  7192. /etc/ppp h
  7193. /etc/samba/smbpasswd h
  7194. /etc/shadow h
  7195. /etc/shadow- h
  7196. /etc/ssh h
  7197. /home h
  7198. /home/colin/.dmrc r
  7199. /home/colin/Pictures/Wallpapers/wallpaper-709364.jpg
  7200. /lib rx
  7201. /lib/modules h
  7202. /proc
  7203. /proc/bus h
  7204. /proc/filesystems r
  7205. /proc/kallsyms h
  7206. /proc/kcore h
  7207. /proc/meminfo r
  7208. /proc/modules h
  7209. /proc/slabinfo h
  7210. /proc/sys/vm/overcommit_memory r
  7211. /run rw
  7212. /run/shm rwc
  7213. /run/user
  7214. /run/user/lightdm
  7215. /run/user/lightdm/dconf
  7216. /run/user/lightdm/dconf/user rwc
  7217. /run/user/lightdm/pulse rwc
  7218. /selinux
  7219. /tmp rwcd
  7220. /usr h
  7221. /usr/bin x
  7222. /usr/lib rx
  7223. /usr/local h
  7224. /usr/local/share/fonts
  7225. /usr/sbin h
  7226. /usr/sbin/unity-greeter x
  7227. /usr/share r
  7228. /var
  7229. /var/backups h
  7230. /var/cache h
  7231. /var/cache/fontconfig r
  7232. /var/lib r
  7233. /var/lib/lightdm r
  7234. /var/lib/lightdm/.cache rw
  7235. /var/lib/lightdm/.cache/unity-greeter rwcd
  7236. /var/lib/lightdm/.config
  7237. /var/lib/lightdm/.config/dconf/user r
  7238. /var/lib/lightdm/.config/ibus w
  7239. /var/lib/lightdm/.config/pulse/cookie r
  7240. /var/log h
  7241. -CAP_ALL
  7242. bind disabled
  7243. connect disabled
  7244. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!