Allow guest sessions more access to the upstart session socket

[sojka/lightdm.git] / data / apparmor / abstractions / lightdm

diff --git a/data/apparmor/abstractions/lightdm b/data/apparmor/abstractions/lightdm
index f6984bf04387aab22c05d56344c9b98acc95e38e..ffcd195b4648dd890a31ba2ecfa03f747c9d0413 100644 (file)
--- a/data/apparmor/abstractions/lightdm
+++ b/data/apparmor/abstractions/lightdm
@@ -33,14 +33,16 @@
   /etc/ r,
   /etc/** rmk,
   /etc/gdm/Xsession ix,
+  /etc/X11/xdm/** ix, # needed for openSUSE's default session-wrapper
+  /etc/X11/xinit/** ix, # needed for openSUSE's default session-wrapper
   /lib/ r,
   /lib/** rmixk,
   /lib32/ r,
   /lib32/** rmixk,
   /lib64/ r,
   /lib64/** rmixk,
-  owner /media/ r,
-  owner /media/** rmwlixk,  # we want access to USB sticks and the like
+  owner /{,run/}media/ r,
+  owner /{,run/}media/** rmwlixk,  # we want access to USB sticks and the like
   /opt/ r,
   /opt/** rmixk,
   @{PROC}/ r,
@@ -75,6 +77,7 @@
   /{,var/}run/ r,
   # necessary for writing to sockets, etc.
   /{,var/}run/** rmkix,
+  /{,var/}run/screen/** wl,
   /{,var/}run/shm/** wl,
   /{,var/}run/uuidd/request w,
   # libpam-xdg-support/logind
@@ -92,7 +95,7 @@
   unix (receive) peer=(label=unconfined),
   unix (create),
   unix (getattr, getopt, setopt, shutdown),
-  unix (bind, listen) type=stream addr="@/com/ubuntu/upstart-session/**",
+  unix (bind, listen, accept, receive, send) type=stream addr="@/com/ubuntu/upstart-session/**",
   unix (bind, listen) type=stream addr="@/tmp/dbus-*",
   unix (bind, listen) type=stream addr="@/tmp/.ICE-unix/[0-9]*",
   unix (bind, listen) type=stream addr="@/dbus-vfs-daemon/*",