initial support for wemeet

apparmor.d/profiles-s-z/wemeet

@@ -0,0 +1,69 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 EricLin <ericlin050914@gmail.com>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/wemeet
+@{exec_path} += /opt/wemeet/bin/wemeetapp
+@{exec_path} += /opt/wemeet/bin/QtWebEngineProcess
+profile wemeet @{exec_path} flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+    include <abstractions/common/bwrap>
+    include <abstractions/common/chromium>
+    include <abstractions/X-strict>
+    include <abstractions/mesa>
+    include <abstractions/vulkan-strict>
+    include <abstractions/dri>
+    include <abstractions/desktop>
+    include <abstractions/fontconfig-cache-read>
+    include <abstractions/audio-client>
+
+    network netlink raw,
+    network netlink dgram,
+    network inet stream,
+    network inet dgram,
+    network inet6 dgram,
+    network inet6 stream,
+
+    @{sh_path} r,
+    @{bin}/basename rix,
+    @{bin}/bwrap rix,
+    @{bin}/id rix,
+    @{bin}/mkdir rix,
+
+    @{exec_path} mr,
+
+    /usr/share/hwdata/pnp.ids r,
+    /usr/share/icons/{,**} r,
+    /usr/share/mime/{,**} r,
+    /etc/machine-id r,
+    /usr/share/ca-certificates/trust-source/{,**} r, 
+    /etc/ca-certificates/extracted/tls-ca-bundle.pem r,
+    /etc/ca-certificates/trust-source/{,**} r,
+    /var/cache/ w,
+
+    # wemeet specifics
+    /opt/wemeet/bin/** rix,
+    owner @{user_share_dirs}/wemeetapp/{,**} rwk,
+
+    @{PROC}/ r,
+    @{PROC}/asound/ r,
+    @{PROC}/@{pid}/net/route r,
+    @{PROC}/@{pid}/net/wireless r,
+    @{PROC}/@{pid}/stat r,
+    @{PROC}/@{pid}/statm r,
+    @{PROC}/sys/fs/inotify/max_user_watches r,
+    owner @{PROC}/@{pid}/cmdline r,
+
+    /dev/ r,
+    /dev/tty rw,
+    /dev/shm/ r,
+    /dev/pts/[0-9]* rw,
+
+}
+
+# vim:syntax=apparmor