qTox/security/apparmor/2.12.1/usr.bin.qtox

#include <tunables/global>
#include <tunables/usr.bin.qtox>

# using variables in profile name is not yet recommended due to issues with
# AppArmor tools
# TODO: use this alternative in the future when available
#profile qtox @{qtox_prefix}/bin/qtox {
profile qtox /usr{,/local}/bin/qtox {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/dbus-session-strict>
  #include <abstractions/dri-enumerate>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/video>

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.qtox>

  # Main executable

  @{qtox_prefix}/bin mr,

  # Other executables

  #TODO: use xdg-open abstraction when it's available
  /usr/bin/xdg-open PUx,

  # Additional libraries

  # Allow /usr/local/lib/libtoxcore.so...
  @{qtox_prefix}/lib/*.so* mr,

  # Networking

  network tcp,
  network udp,

  # System files

  @{qtox_additional_rw_dirs}/ r,
  @{qtox_additional_rw_dirs}/** rw,

  # Sensitive directory access!!!
  # Allow navigating directories with file dialog, to access directory you
  # can write (read) file to, for most convenience (though against maximum
  # security). Note: this allows reading only directory contents (list),
  # not the files itself.
  /{,**/} r,

  /dev/ r,
  /dev/dri/ r,
  /dev/video[0-9]* rw, # webcam
  /etc/fstab r, # file dialog
  /etc/xdg/menus/ r, # file dialog
  /proc/sys/kernel/core_pattern r, # for  KCrash::initialize()
  /proc/sys/kernel/random/boot_id r, # for QSysInfo::bootUniqueId(), mvoe to qt5 abstraction?
  /run/udev/data/*:* r, # libKF5KIOFileWidgets.so -> libudev.so (KDE file dialog)
  /sys/bus/ r, # file dialog
  /sys/bus/usb/devices/ r, # file dialog
  /sys/class/ r, # file dialog
  /sys/devices/system/node/ r,  # for ld-linux-x86-64.so -> libnuma1.so
  /sys/devices/system/node/node[0-9]*/meminfo r, # for ld-linux-x86-64.so -> libnuma1.so
  /usr/share/emoticons/{,**} r,
  /usr/share/kservices5/{,**} r, # file dialog
  /usr/share/mime/ r, # file dialog
  /usr/share/plasma/look-and-feel/*/contents/defaults r, # TODO: move to kde abstraction?
  /usr/share/sounds/ r, # file dialog (alert)

  # User files

  # Sensitive file access!!!
  # Allow reading & writing into $HOME, EXCEPT for dot files and directories,
  # for most convenience (though against maximum security).
  owner @{HOME}/ r,
  owner @{HOME}/[^.]* rw,
  owner @{HOME}/[^.]*/{,**} rw,
  # QSaveFile security measures? While saving log file
  owner @{HOME}/[^.]* l -> @{HOME}/#[0-9]*[0-9],
  owner @{HOME}/[^.]*/** l -> @{HOME}/#[0-9]*[0-9],

  owner /{,var/}run/user/[0-9]*[0-9]/#[0-9]*[0-9] rw, # file dialog
  owner /{,var/}run/user/[0-9]*[0-9]/qTox*.slave-socket rwl -> /{,var/}run/user/[0-9]*[0-9]/#[0-9]*[0-9], # file dialog
  owner @{HOME}/.cache/Tox/ w,
  owner @{HOME}/.cache/Tox/qTox/{,**} rw,
  owner @{HOME}/.cache/thumbnails/** rw, # receiving image file produces thumbnail?
  owner @{HOME}/.config/menus/ r, # file dialog
  owner @{HOME}/.config/menus/applications-merged/ r, # file dialog
  owner @{HOME}/.config/qToxrc rw,
  owner @{HOME}/.config/qToxrc.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], # QSaveFile?
  owner @{HOME}/.config/qToxrc.lock rwk,
  owner @{HOME}/.config/tox/** l -> @{HOME}/.config/tox/**, # QSaveFile?
  owner @{HOME}/.config/tox/{,**} rwk,
  owner @{HOME}/.local/share/user-places.xbel r, # file dialog
  owner @{PROC}/@{pid}/cmdline r,

  # Backport from more recent qt5-compose-cache-write abstraction
  # commit 1250402471d9d83134b0faa90239a733a37f23f0
  owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9],
  owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory)

  # Backport kde-globals-write abstraction
  # commit fae93f1b6c7a28bb77ad186ab1de41372630272b
  owner @{HOME}/.config/#[0-9]* rw,
  owner @{HOME}/.config/kdeglobals rw,
  owner @{HOME}/.config/kdeglobals.?????? rwl -> @{HOME}/.config/#[0-9]*,
  owner @{HOME}/.config/kdeglobals.lock rwk,

  # Backport kde-icon-cache-write abstraction
  # commit 94014c09f09fc63229bb10fea3f0727113fe5bae
  owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader

  # Backport mesa abstraction
  # commit b5be5964609b4e0927af7c9e4f0276e50ccdc3e3

  # System files
  /dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2()
  /usr/share/drirc.d/{,*.conf} r,

  # User files
  owner @{HOME}/.cache/ w, # if user clears all caches
  owner @{HOME}/.cache/mesa_shader_cache/ w,
  owner @{HOME}/.cache/mesa_shader_cache/index rw,
  owner @{HOME}/.cache/mesa_shader_cache/??/ w,
  owner @{HOME}/.cache/mesa_shader_cache/??/* rwk,
  # End of backported mesa abstraction

  # Backport qt5-compose-cache-write abstraction
  # commit 1250402471d9d83134b0faa90239a733a37f23f0
  owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9],
  owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory)

  # Backport qt5-settings-write abstraction
  # commit 8f6a8fb1942122705af4c45168922c4afd696c8a
  owner @{HOME}/.config/#[0-9]*[0-9] rw,
  owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9],
  # for temporary files like QtProject.conf.Aqrgeb
  owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9],
  owner @{HOME}/.config/QtProject.conf.lock rwk,

  # Backport recent-documents-write
  # commit 4fe8ae97c43d72d7f5a948c7149f5ea35339832a
  owner @{HOME}/.local/share/RecentDocuments/ rw,
  owner @{HOME}/.local/share/RecentDocuments/#[0-9]* rw,
  owner @{HOME}/.local/share/RecentDocuments/*.desktop rwl -> @{HOME}/.local/share/RecentDocuments/#[0-9]*,
  owner @{HOME}/.local/share/RecentDocuments/*.lock rwk,

}