# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{bin}/plasma-discover
profile plasma-discover @{exec_path} {
  include <abstractions/base>
  include <abstractions/audio-client>
  include <abstractions/dconf-write>
  include <abstractions/graphics>
  include <abstractions/kde-strict>
  include <abstractions/nameservice-strict>
  include <abstractions/qt5-shader-cache>
  include <abstractions/ssl_certs>

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink dgram,
  network netlink raw,

  signal (send) set=(term) peer=kioworker,

  @{exec_path} mr,

  @{sh_path}                        rix,
  @{bin}/kreadconfig5               rPx,

  @{bin}/gpg                        rCx -> gpg,
  @{bin}/gpgconf                    rCx -> gpg,
  @{bin}/gpgsm                      rCx -> gpg,

  #aa:exec kio_http_cache_cleaner
  #aa:exec kioworker

  /usr/share/knotifications{5,6}/plasma_workspace.notifyrc r,
  /usr/share/knsrcfiles/{,*} r,
  /usr/share/kservices{5,6}/{,*} r,
  /usr/share/kservicetypes5/{,*} r,
  /usr/share/libdiscover/** r,

  /etc/appstream.conf r,
  /etc/flatpak/remotes.d/{,**} r,
  /etc/machine-id r,
  /etc/xdg/ r,
  /etc/xdg/accept-languages.codes r,

  /var/tmp/flatpak-cache-*/ rw,
  /var/tmp/flatpak-cache-*/** rwkl,
  /var/tmp/#@{int} rw,

  /var/cache/swcatalog/ rw,

  /var/lib/flatpak/repo/{,**} r,
  /var/lib/flatpak/appstream/{,**} r,

  /var/log/pacman.log r,

  owner @{user_cache_dirs}/appstream/ r,
  owner @{user_cache_dirs}/appstream/*.xb rw,
  owner @{user_cache_dirs}/discover/{,**} rwlk,
  owner @{user_cache_dirs}/flatpak/system-cache/{,**} rw,
  owner @{user_cache_dirs}/icon-cache.kcache rw,
  owner @{user_cache_dirs}/kio_http/ w,

  owner @{user_config_dirs}/ r,
  owner @{user_config_dirs}/#@{int} rwl,
  owner @{user_config_dirs}/discoverrc rwl,
  owner @{user_config_dirs}/discoverrc.lock rwk,
  owner @{user_config_dirs}/kde.org/{,**} rwlk,
  owner @{user_config_dirs}/KDE/* r,
  owner @{user_config_dirs}/kdedefaults/plasmarc r,
  owner @{user_config_dirs}/libaccounts-glib/ rw,
  owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk,

  owner @{user_share_dirs}/flatpak/repo/{,**} rw,
  owner @{user_share_dirs}/knewstuff3/{,*} rw,
  owner @{user_share_dirs}/kwin/ rw,
  owner @{user_share_dirs}/kwin/** rwlk -> @{user_share_dirs}/kwin/**,

  owner @{tmp}/*.kwinscript rwl -> /tmp/#@{int},
  owner @{tmp}/#@{int} rw,
  owner @{tmp}/discover-@{rand6}/{,**} rw,
  owner @{tmp}/ostree-gpg-@{rand6}/ rw,
  owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**,

  owner @{run}/user/@{uid}/.flatpak-cache rw,
  owner @{run}/user/@{uid}/.flatpak/{,**} rw,
  owner @{run}/user/@{uid}/.flatpak/**/*.ref rwk,
  owner @{run}/user/@{uid}/#@{int} rw,
  owner @{run}/user/@{uid}/discover@{rand6}.* rwl ->  @{run}/user/@{uid}/#@{int},

  owner @{PROC}/@{pid}/mountinfo r,

  /dev/tty r,

  profile gpg {
    include <abstractions/base>

    @{bin}/gpg{,2} mr,
    @{bin}/gpgconf mr,
    @{bin}/gpgsm   mr,

    @{HOME}/@{XDG_GPG_DIR}/*.conf r,

    owner @{tmp}/ostree-gpg-@{rand6}/ r,
    owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**,

    include if exists <local/plasma-discover_gpg>
  }

  include if exists <local/plasma-discover>
}

# vim:syntax=apparmor
