# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path}  = @{bin}/libreoffice @{bin}/soffice
@{exec_path} += @{lib}/libreoffice/program/soffice
profile libreoffice @{exec_path} {
  include <abstractions/base>
  include <abstractions/audio-client>
  include <abstractions/bus-session>
  include <abstractions/cups-client>
  include <abstractions/dconf-write>
  include <abstractions/desktop>
  include <abstractions/enchant>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/graphics>
  include <abstractions/nameservice-strict>
  include <abstractions/qt5-settings-write>
  include <abstractions/ssl_certs>
  include <abstractions/user-read-strict>
  include <abstractions/user-write-strict>

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink raw,

  #aa:dbus own bus=session name=org.libreoffice.LibreOfficeIpc0

  @{exec_path} mr,

  @{sh_path}        rix,
  @{bin}/basename   rix,
  @{bin}/dirname    rix,
  @{bin}/grep       rix,
  @{bin}/ls         rix,
  @{bin}/paperconf  rix,
  @{bin}/sed        rix,
  @{bin}/uname      rix,

  @{open_path}      rPx -> child-open-browsers,

  @{bin}/gpg        rPx,
  @{bin}/gpgconf    rPx,
  @{bin}/gpgsm      rPx,

  @{lib}/libreoffice/program/javaldx      rix,
  @{lib}/libreoffice/program/oosplash     rix,
  @{lib}/libreoffice/program/soffice.bin  rix,
  @{lib}/jvm/java*/bin/java               rix,
  @{lib}/jvm/java*/lib/** rm,

  @{lib}/libreoffice/{,**} rm,
  @{lib}/libreoffice/share/uno_packages/cache/stamp.sys w,
  @{lib}/libreoffice/program/{,**/}__pycache__/ w,
  @{lib}/libreoffice/share/extensions/{,**/}__pycache__/ w,

  /usr/share/hyphen/{,**} r,
  /usr/share/libexttextcat/{,**} r,
  /usr/share/liblangtag/{,**} r,
  /usr/share/libreoffice/{,**} r,
  /usr/share/mythes/{,**} r,
  /usr/share/thumbnailers/{,**} r,

  /etc/java{,@{version}}-openjdk/{,**} r,
  /etc/libreoffice/{,**} r,
  /etc/paperspecs r,
  /etc/xdg/* r,

  owner @{user_cache_dirs}/libreoffice/{,**} rw,
  owner @{user_config_dirs}/libreoffice/ rw,
  owner @{user_config_dirs}/libreoffice/** rwk,
  owner @{user_config_dirs}/soffice.*.lock rwk,
  owner @{user_config_dirs}/plasma_workspace.notifyrc r,
  owner @{user_config_dirs}/kservicemenurc r,

  owner @{user_share_dirs}/#@{int} rw,
  owner @{user_share_dirs}/user-places.xbel r,

  owner @{tmp}/ r,
  owner @{tmp}/@{rand6} rwk,
  owner @{tmp}/*.tmp/{,**} rwk,
  owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} w,
  owner @{tmp}/.java_pid@{int}{,.tmp} rw,
  owner @{tmp}/hsperfdata_@{user}/  rw,
  owner @{tmp}/hsperfdata_@{user}/@{int} rwk,

  owner @{run}/user/@{uid}/#@{int} rw,

        @{sys}/devices/system/cpu/cpu@{int}/microcode/version r,
        @{sys}/devices/virtual/block/**/queue/rotational r,
        @{sys}/kernel/mm/hugepages/ r,
        @{sys}/kernel/mm/transparent_hugepage/enabled r,
        @{sys}/kernel/mm/transparent_hugepage/shmem_enabled r,
        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/{cpu,memory}.max r,
  owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/**/memory.max r,
  owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r,

        @{PROC}/cgroups r,
  owner @{PROC}/@{pid}/cgroup r,
  owner @{PROC}/@{pid}/coredump_filter rw,
  owner @{PROC}/@{pid}/mountinfo r,
  owner @{PROC}/@{pid}/mounts r,

  /dev/tty rw,

  deny owner @{HOME}/.thunderbird/** rwk,
  deny owner @{HOME}/.mozilla/** rwk,

  include if exists <local/libreoffice>
}

# vim:syntax=apparmor
