initial support for linuxqq

apparmor.d/profiles-g-l/linuxqq

@@ -0,0 +1,65 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 EricLin <ericlin050914@gmail.com>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/linuxqq
+@{exec_path} += /opt/QQ/qq
+profile linuxqq @{exec_path} flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+    include <abstractions/common/bwrap>
+    include <abstractions/common/chromium>
+    include <abstractions/graphics>
+    include <abstractions/desktop>
+    include <abstractions/ssl_certs>
+    include <abstractions/fontconfig-cache-read>
+    include <abstractions/audio-client>
+
+    network netlink raw,
+    network netlink dgram,
+    network inet stream,
+    network inet dgram,
+    network inet6 dgram,
+    network inet6 stream,
+
+    @{exec_path} mr,
+
+    @{sh_path}  r,
+    @{bin}/find rix,
+    @{bin}/rm   rix,
+    @{bin}/xdg-open rix,
+    /opt/QQ/chrome_crashpad_handler ix,
+    /opt/QQ/qq  rix,
+
+    /opt/QQ/{,**} mr,
+
+    @{run}/systemd/inhibit/@{int}.ref rw,
+    @{run}/utmp r,
+
+    @{user_config_dirs}/dconf/user r,
+    @{user_config_dirs}/ibus/bus/ r,
+    owner @{user_config_dirs}/QQ/{,**} rwk,
+    owner @{run}/user/@{uid}/dconf/user rw,
+    owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-qq-@{int6}.scope/memory.{high,max} r,
+
+    @{PROC}/ r,
+    @{PROC}/sys/fs/inotify/max_user_watches r,
+    @{PROC}/@{pid}/oom_score_adj w,
+    @{PROC}/@{pid}/task/@{tid}/status r,
+    @{PROC}/@{pid}/stat r,
+    @{PROC}/@{pid}/statm r,
+    @{PROC}/@{pid}/task/ r,
+    owner @{PROC}/@{pid}/loginuid r,
+    owner @{PROC}/@{pid}/mounts r,
+    owner @{PROC}/@{pid}/cmdline r,
+
+    /dev/tty rw,
+    /dev/pts/@{int} rw,
+
+    include if exists <local/linuxqq>
+}
+