# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

# Default profile for all flatpak applications. Ideally, this profile should be
# generated by flatpak itself with settings from the flatpak manifest and
# fully separated from bwrap.

# Note: This profile used to be split in two (flatpak-bwrap & flatpak-app) in order
# to separate bwrap from the sandboxed app itself. It was generating issue with
# zypak-sandbox, therefore the profiles have been merged. Meanwhile, to install
# some applications, flatpak needs write access to the sandbox content. This is
# done through bwrap and therefore in this profile.
#
# 1. All of this will have to be improved. However, as of today, it is the only
#    way to not break some (major) flatpak app.
# 2. It is not a big deal as flatpak is responsible for the sandbox anyway.
#    This this only defence in depth.
# 3. The main purpose of this profile is to ensure all processes are confined.

abi <abi/4.0>,

include <tunables/global>

profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
  include <abstractions/base>
  include <abstractions/bus-system>
  include <abstractions/common/app>
  include <abstractions/common/bwrap>

  capability dac_override,
  capability dac_read_search,
  capability setuid,          # Needed when bwrap is setup with setuid privileges.
  capability sys_resource,

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink dgram,
  network netlink raw,
  network unix stream,

  ptrace (read),
  ptrace trace peer=flatpak-app,

  signal receive peer=flatpak,
  signal receive set=(int term) peer=flatpak-portal,
  signal receive set=(int) peer=flatpak-session-helper,

  @{bin}/**                            rmix,
  @{lib}/**                            rmix,
  /app/**                              rmix,
  /usr/plugins/**                      rmix,
  /usr/share/flatpak/triggers/*        rix,
  /usr/share/runtime/**                rmix,
  /var/lib/flatpak/app/*/**/@{bin}/**  rmix,
  /var/lib/flatpak/app/*/**/@{lib}/**  rmix,

  @{run}/flatpak/app/*/**so*           rm,
  @{run}/parent/@{bin}/**              rmix,
  @{run}/parent/@{lib}/**              rmix,
  @{run}/parent/app/**                 rmix,

  @{bin}/gtk{,4}-update-icon-cache     rPx -> flatpak-app//&gtk-update-icon-cache,
  @{bin}/update-desktop-database       rPx -> flatpak-app//&update-desktop-database,
  @{bin}/update-mime-database          rPx -> flatpak-app//&update-mime-database,
  @{bin}/xdg-dbus-proxy                rPx -> flatpak-app//&xdg-dbus-proxy,

  @{lib}/kf5/kioslave5                 rPx,
  @{lib}/kf6/kioworker                 rPx,

  /etc/**/ rw,
  /etc/shells rw,

  /app/.ref rk,
  /app/extra/** rw,
  /app/lib/** rk,
  /bindfile@{rand6} rw,
  /usr/.ref rk,

  /var/lib/flatpak/app/{,**} r,
  /var/lib/flatpak/exports/** rw,
  /var/tmp/etilqs_@{hex16} rw,

        @{run}/.userns r,
        @{run}/parent/** r,
        @{run}/parent/app/.ref rk,
        @{run}/parent/usr/.ref rk,
  owner @{run}/flatpak/{,**} rk,
  owner @{run}/flatpak/app/** rw,
  owner @{run}/flatpak/doc/** rw,
  owner @{run}/ld-so-cache-dir/* rw,
  owner @{run}/user/ r,

  include if exists <usr/flatpak-app.d>
  include if exists <local/flatpak-app>
}

# vim:syntax=apparmor
