# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{bin}/reportbug
profile reportbug @{exec_path} {
  include <abstractions/base>
  include <abstractions/common/apt>
  include <abstractions/consoles>
  include <abstractions/dconf-write>
  include <abstractions/desktop>
  include <abstractions/enchant>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/nameservice-strict>
  include <abstractions/python>

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink raw,

  @{exec_path} r,

  @{bin}/ r,
  @{bin}/python3.@{int} r,

  @{bin}/ldconfig         rix,
  @{bin}/selinuxenabled   rix,
  @{sh_path}              rix,
  @{bin}/aa-enabled       rix,
  @{bin}/locale           rix,
  @{bin}/md5sum           rix,
  @{bin}/readlink         rix,
  @{bin}/stty             rix,
  /usr/share/reportbug/handle_bugscript rix,

  @{bin}/exim4            rPx,
  @{bin}/apt-cache        rPx,
  @{bin}/debconf-show     rPx,
  @{bin}/debsums          rPx,
  @{bin}/dlocate          rPx,
  @{bin}/dpkg             rPx -> child-dpkg,
  @{bin}/dpkg-query       rpx,
  @{bin}/less             rPx -> child-pager,
  @{bin}/lsb_release      rPx -> lsb_release,
  @{bin}/more             rPx -> child-pager,
  @{bin}/pager            rPx -> child-pager,
  @{bin}/systemctl        rCx -> systemctl,
  @{lib}/firefox/firefox rPUx,  # App allowed to open
  /usr/share/bug/*       rPUx,

  @{bin}/gpg{,2}          rCx -> gpg,
  @{bin}/run-parts        rCx -> run-parts,
  @{open_path}            rPx -> child-open,

  @{lib}/python3/dist-packages/pylocales/locales.db rk,

  /usr/share/bug/*/{control,presubj} r,

  /etc/** r,
  /etc/reportbug.conf r,

  owner @{HOME}/ r,  # For shell pwd
  owner @{HOME}/.reportbugrc{,~} rw,
  owner @{HOME}/draftbugreports/ r,
  owner @{HOME}/draftbugreports/reportbug-* rw,

        @{PROC}/1/cgroup r,
        @{PROC}/sys/kernel/tainted r,
  owner @{PROC}/@{pid}/cgroup r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,

  owner @{tmp}/* rw,
  owner @{tmp}/reportbug-*-@{int}-@{pid}-* rw,
  owner /var/tmp/*.bug{,~} rw,

  @{sys}/module/apparmor/parameters/enabled r,

  /dev/ptmx rw,

  profile run-parts {
    include <abstractions/base>

    @{bin}/run-parts mr,

    include if exists <local/reportbug_run-parts>
  }

  profile gpg {
    include <abstractions/base>

    @{bin}/gpg{,2} mr,

    owner @{HOME}/@{XDG_GPG_DIR}/ rw,
    owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,

    owner @{tmp}/reportbug-*-{signed,unsigned}-* rw,
    owner @{HOME}/draftbugreports/reportbug-*-{signed,unsigned}-* rw,

    include if exists <local/reportbug_gpg>
  }

  profile systemctl {
    include <abstractions/base>
    include <abstractions/app/systemctl>
  
    include if exists <local/reportbug_systemctl>
  }

  include if exists <local/reportbug>
}
