abstractions/wayland may be too permissive

[beroal]

I am able to run swaybg with

/dev/shm/swaybg-* rw,

and without

include <abstractions/wayland>

I believe that the shared memory file /dev/shm/swaybg-* is created in swaybg in "pool-buffer.c".

So a shared memory file path should be different for different clients. If we only allow access to the shared memory file created by a client in the client's profile, we isolate clients.

[roddhjav]

You may be right here. Can you ensure we can generalise this by checking other sway programs.

As I don't use sway, I will let you do the PR for this.

[beroal]

The Sway-specific programs that I use are Sway, swaybar, swaybg, swaymsg, swaynag. Except for Sway, they only require /dev/shm/$PROGRAM, base, mesa, and fonts abstractions. But Sway requires /dev/shm/$PROGRAM for every $PROGRAM.

Do you want me to send profiles for Sway programs? Sway is designed to execute any program which a user wishes. I'm not sure how to express this for all users.

[odomingao]

Also, there's a few things in the profile that regular wayland clients don't need to access. How about splitting the profile into wayland-server and wayland-client?

[roddhjav]

I you can determine who needs what, yes, please do.

[odomingao]

I cannot test for compositors other than Hyprland right now, but from my experience writing the profiles:

• only the compositor needs to write to owner /dev/shm/@{uuid} (clients only need read access)
• owner /dev/shm/grim-@{rand6} rw, is needed specifically for some xdg-desktop-portal screensharing functionality

[roddhjav]

This need to be check on all DE...

Also DE dependant shared file will be restricted when apparmor support if statment (next release probably, like the prompt). We can have access depending of the DE. Eg:

apparmor.d/apparmor.d/abstractions/desktop

Line 18 in 03e9745

# if @{DE} == gnome

[beroal]

• only the compositor needs to write to owner /dev/shm/@{uuid} (clients only need read access)

Swaybg needs write access.

As I said, different clients need different files, so a common wayland-client is impossible.

[beroal]

This need to be check on all DE...

Rather, for every client. AFAIK, a client chooses a GUI toolkit (Gnome, KDE, etc).