# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2022 Mikhail Morfikov
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/qbittorrent
profile qbittorrent @{exec_path} {
  include <abstractions/base>
  include <abstractions/bus-accessibility>
  include <abstractions/bus-session>
  include <abstractions/bus-system>
  include <abstractions/bus/org.a11y>
  include <abstractions/bus/org.kde.StatusNotifierWatcher>
  include <abstractions/consoles>
  include <abstractions/dconf-write>
  include <abstractions/desktop>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/graphics>
  include <abstractions/ibus>
  include <abstractions/nameservice-strict>
  include <abstractions/private-files-strict>
  include <abstractions/qt5>
  include <abstractions/qt5-compose-cache-write>
  include <abstractions/qt5-settings-write>
  include <abstractions/ssl_certs>
  include <abstractions/user-download-strict>

  signal send set=(term, kill) peer=qbittorrent//python3,

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink dgram,
  network netlink raw,

  dbus send bus=session path=/StatusNotifierItem
       interface=org.kde.StatusNotifierItem
       member={NewToolTip,NewIcon}
       peer=(name=org.freedesktop.DBus),

  dbus receive bus=session path=/StatusNotifierItem
       interface=org.kde.StatusNotifierItem
       member=Activate
       peer=(name=:*),

  dbus receive bus=session path=/{StatusNotifierItem,MenuBar}
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*),

  dbus send bus=session path=/MenuBar
       interface=com.canonical.dbusmenu
       member=ItemsPropertiesUpdated
       peer=(name=org.freedesktop.DBus),

  dbus receive bus=session path=/MenuBar
       interface=com.canonical.dbusmenu
       member={GetLayout,GetGroupProperties,AboutToShow,AboutToShowGroup,EventGroup,Event}
       peer=(name=:*),

  dbus bind bus=session name=org.kde.StatusNotifierItem-*,

  @{exec_path} mr,

  @{open_path}           rPx -> child-open,
  @{bin}/python3.@{int}  rCx -> python, # For "search engine"

  # Allowed apps to open
  @{bin}/ebook-viewer    rPx,
  @{bin}/geany           rPx,
  @{bin}/mpv             rPx,
  @{bin}/nautilus        rPx,
  @{bin}/qpdfview        rPx,
  @{bin}/smplayer        rPx,
  @{bin}/spacefm         rPx,
  @{bin}/viewnior       rPUx,
  @{bin}/vlc             rPx,
  @{browsers_path}       rPx,

  /usr/share/GeoIP/GeoIP.dat r,
  /usr/share/gvfs/remote-volume-monitors/{,*} r,

  owner @{user_cache_dirs}/qBittorrent/{,**} rw,

  owner @{user_config_dirs}/qBittorrent/ rw,
  owner @{user_config_dirs}/qBittorrent/** rwkl -> @{user_config_dirs}/qBittorrent/#@{int},

  owner @{user_share_dirs}/{,data/}qBittorrent/ rw,
  owner @{user_share_dirs}/{,data/}qBittorrent/** rwl -> @{user_share_dirs}/{,data/}qBittorrent/**/#@{int},
  owner @{user_share_dirs}/data/ rw,

  owner @{user_torrents_dirs}/ r,
  owner @{user_torrents_dirs}/** rw,

  owner /dev/shm/#@{int} rw,
  owner @{tmp}/.*/{,s} rw,
  owner @{tmp}/.qBittorrent/ rw,
  owner @{tmp}/.qBittorrent/* rwl -> /tmp/.qBittorrent/*,
  owner @{tmp}/*.torrent rw,
  owner @{tmp}/mozilla_*/*.torrent rw,
  owner @{tmp}/qtsingleapp-qBitto-* rw,
  owner @{tmp}/qtsingleapp-qBitto-*-lockfile rwk,
  owner @{tmp}/tmp* rw,

  owner @{PROC}/@{pids}/cmdline r,
  owner @{PROC}/@{pids}/comm r,
  owner @{PROC}/@{pids}/fd/ r,
  owner @{PROC}/@{pids}/mountinfo r,
  owner @{PROC}/@{pids}/mounts r,

  owner /dev/tty@{int} rw,

  profile python {
    include <abstractions/base>
    include <abstractions/nameservice-strict>
    include <abstractions/python>
    include <abstractions/ssl_certs>

    signal (receive) set=(term, kill) peer=qbittorrent,

    network inet dgram,
    network inet6 dgram,
    network inet stream,
    network inet6 stream,
    network netlink raw,

    @{bin}/python3.@{int} r,

    owner @{user_share_dirs}/{,data/}qBittorrent/nova[0-9]/{,**} rw,

    owner @{user_torrents_dirs}/** r,

    owner /dev/shm/sem.mp-@{word8} rwl -> /dev/shm/@{int},
    owner /dev/shm/* rw,

    owner @{tmp}/@{int} rw,
    owner @{tmp}/tmp* rw,

    deny /dev/dri/card@{int} rw,

    include if exists <local/qbittorrent_python>
  }

  include if exists <local/qbittorrent>
}

# vim:syntax=apparmor
