diff --git a/child-gedit b/child-gedit new file mode 100644 index 000000000..c7e56c91a --- /dev/null +++ b/child-gedit @@ -0,0 +1,31 @@ +#vim:syntax=apparmor +#AppArmor policy abstraction for child profiles of gedit +#Copyright (C) 2023 Andy Ramos +#SPDX-License-Identifier: GPL-2.0-only + + include + include + include + include + include + include + + @{bin}/gedit mrix, + + /usr/share/terminfo/x/xterm-256color r, + + owner @{user_config_dirs}/ibus/bus/{,**} r, + owner @{user_config_dirs}/gedit/{,**} r, + owner @{user_config_dirs}/gedit/accels rw, + + owner @{PROC}/@{pid}/mountinfo r, + + # needed? + deny network inet stream, + + deny unix (send, receive, connect) + type=stream + peer=(addr="@@{user_cache_dirs}/ibus/dbus-*"), + + deny /etc/{fstab,group,machine-id,passwd} r, + deny /run/user/@{uid}/bus rw,