# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{lib_dirs} = @{user_share_dirs}/Steam/ubuntu@{int}_{32,64}
@{exec_path} = @{user_share_dirs}/Steam/steam.sh
profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) {
  include <abstractions/base>
  include <abstractions/audio>
  include <abstractions/chromium-common>
  include <abstractions/consoles>
  include <abstractions/dconf-write>
  include <abstractions/disks-read>
  include <abstractions/dri-common>
  include <abstractions/dri-enumerate>
  include <abstractions/fonts>
  include <abstractions/freedesktop.org>
  include <abstractions/gtk>
  include <abstractions/mesa>
  include <abstractions/nameservice-strict>
  include <abstractions/opencl>
  include <abstractions/ssl_certs>
  include <abstractions/vulkan>

  capability sys_ptrace,

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink raw,

  ptrace (read),

  signal (send) peer=steam-game,
  signal (read),

  unix (receive) type=stream,

  @{exec_path} mrix,

  @{bin}/{,ba,da}sh             rix,
  @{bin}/{m,g,}awk              rix,
  @{bin}/*sum                   rix,
  @{bin}/basename               rix,
  @{bin}/cat                    rix,
  @{bin}/cmp                    rix,
  @{bin}/cp                     rix,
  @{bin}/cut                    rix,
  @{bin}/dirname                rix,
  @{bin}/file                   rix,
  @{bin}/find                   rix,
  @{bin}/getopt                 rix,
  @{bin}/grep                   rix,
  @{bin}/head                   rix,
  @{bin}/ldconfig               rix,
  @{bin}/ldd                    rix,
  @{bin}/ln                     rix,
  @{bin}/lsb_release            rPx -> lsb_release,
  @{bin}/lsof                   rix,
  @{bin}/lspci                  rCx -> lspci,
  @{bin}/mkdir                  rix,
  @{bin}/mv                     rix,
  @{bin}/readlink               rix,
  @{bin}/realpath               rix,
  @{bin}/rm                     rix,
  @{bin}/rmdir                  rix,
  @{bin}/sed                    rix,
  @{bin}/steam-runtime-urlopen  rix,
  @{bin}/tail                   rix,
  @{bin}/tar                    rix,
  @{bin}/timeout                rix,
  @{bin}/touch                  rix,
  @{bin}/tr                     rix,
  @{bin}/uname                  rix,
  @{bin}/which                  rix,
  @{bin}/xdg-icon-resource      rPx,
  @{bin}/xdg-user-dir           rix,
  @{bin}/xz                     rix,
  @{bin}/zenity                 rix,
  @{lib}/ld-linux.so*    rix,

  @{lib_dirs}/*.so*  mr,
  @{lib_dirs}/*driverquery rix,
  @{lib_dirs}/fossilize_replay rpx,
  @{lib_dirs}/gameoverlayui rpx,
  @{lib_dirs}/panorama/** rm,
  @{lib_dirs}/reaper rpx,
  @{lib_dirs}/steam rix,
  @{lib_dirs}/steam-runtime-heavy.sh rix,
  @{lib_dirs}/steam-runtime{,-heavy}/{amd64,i386}/usr/bin/* rix,
  @{lib_dirs}/steam-runtime{,-heavy}/{setup,run}.sh  rix,
  @{lib_dirs}/steam-runtime/{usr/,}lib{exec,}/**  mrix,
  @{lib_dirs}/steamwebhelper rix,
  @{lib_dirs}/steamwebhelper.sh rix,
  @{lib_dirs}/swiftshader/* rm,
  @{user_share_dirs}/Steam/config/widevine/linux-x64/libwidevinecdm.so mr,
  @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier/*entry-point rpx,

  /usr/lib/os-release rk,
  /usr/share/fonts/**.{ttf,otf} rk,
  /usr/share/terminfo/x/xterm-256color r,
  /usr/share/themes/{,**} r,
  /usr/share/X11/{,**} r,
  /usr/share/zenity/* r,

  /etc/lsb-release r,
  /etc/udev/udev.conf r,
  /etc/machine-id r,
  /var/lib/dbus/machine-id r,

  @{bin}/ r,
  @{lib}/ r,
  / r,
  /{usr/,}{local/,} r,
  /{usr/,}{local/,}share/ r,
  /etc/ r,
  /home/ r,
  /run/ r,
  /var/ r,

  owner @{HOME}/ r,
  owner @{HOME}/.local/ r,
  owner @{HOME}/.steam/{,**} rw,
  owner @{HOME}/.steam/registry.vdf rwk,
  owner @{HOME}/.steampath rw,
  owner @{HOME}/.steampid rw,

  owner @{user_games_dirs}/{,**} rwkl,

  owner @{user_config_dirs}/ r,
  owner @{user_config_dirs}/autostart/ r,
  owner @{user_config_dirs}/cef_user_data/{,**} r,
  owner @{user_config_dirs}/unity3d/{,**} rwk,
  owner @{user_config_dirs}/user-dirs.dirs r,

  owner @{user_share_dirs}/ r,
  owner @{user_share_dirs}/applications/*.desktop w,
  owner @{user_share_dirs}/icons/hicolor/**/apps/steam*.png rw,
  owner @{user_share_dirs}/Steam/ rw,
  owner @{user_share_dirs}/Steam/** rwkl -> @{user_share_dirs}/Steam/**,
  owner @{user_share_dirs}/vulkan/implicit_layer.d/steam*.json rwk,

  owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
  owner @{run}/user/@{uid}/gdm/Xauthority r,

  owner /dev/shm/#@{int} rw,
  owner /dev/shm/fossilize-*-@{int}-@{int} rw,
  owner /dev/shm/u@{uid}-Shm_@{hex} rw,
  owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
  owner /dev/shm/ValveIPCSHM_@{uid} rw,

  owner /tmp/dumps/ rw,
  owner /tmp/dumps/{assert,crash}_@{int}_@{int}.dmp rw,
  owner /tmp/gdkpixbuf-xpm-tmp.[0-9A-Z]* rw,
  owner /tmp/miles_image_* mrw,
  owner /tmp/runtime-info.txt.* rwk,
  owner /tmp/sh-thd.* rw,
  owner /tmp/steam_chrome_shmem_uid@{uid}_spid@{int} rw,

  @{run}/udev/data/+input:input@{int} r,  # for mouse, keyboard, touchpad
  @{run}/udev/data/+sound* r,
  @{run}/udev/data/+pci:* r,

  @{run}/udev/data/c13:@{int}  r,         # for /dev/input/*
  @{run}/udev/data/c116:@{int} r,         # for ALSA
  @{run}/udev/data/c23[4-9]:@{int} r,     # For dynamic assignment range 234 to 254
  @{run}/udev/data/c24[0-9]:@{int} r,
  @{run}/udev/data/c25[0-4]:@{int} r,
  @{run}/udev/data/n@{int} r,

  @{sys}/ r,
  @{sys}/bus/ r,
  @{sys}/bus/pci/devices/ r,
  @{sys}/class/ r,
  @{sys}/class/hidraw/ r,
  @{sys}/class/input/ r,
  @{sys}/class/net/ r,
  @{sys}/class/sound/ r,
  @{sys}/devices/**/input@{int}/ r,
  @{sys}/devices/**/input@{int}/capabilities/* r,
  @{sys}/devices/**/input/input@{int}/ r,
  @{sys}/devices/**/uevent r,
  @{sys}/devices/pci[0-9]*/**/class r,
  @{sys}/devices/pci[0-9]*/**/i2c-[0-9]*/report_descriptor r,
  @{sys}/devices/pci[0-9]*/**/sound/card[0-9]*/** r,
  @{sys}/devices/pci[0-9]*/**/usb[0-9]*/{manufacturer,product,bcdDevice,bInterfaceNumber} r,
  @{sys}/devices/system/cpu/** r,
  @{sys}/devices/system/node/ r,
  @{sys}/devices/virtual/dmi/id/bios_version rk,
  @{sys}/devices/virtual/dmi/id/board_{vendor,name,version} rk,
  @{sys}/devices/virtual/dmi/id/product_{name,version} r,
  @{sys}/devices/virtual/dmi/id/sys_vendor r,
  @{sys}/devices/virtual/net/*/ r,
  @{sys}/devices/virtual/tty/tty[0-9]/active r,
  @{sys}/kernel/ r,
  @{sys}/power/suspend_stats/success rk,

        @{PROC}/ r,
        @{PROC}/@{pids}/comm rk,
        @{PROC}/@{pids}/net/route r,
        @{PROC}/@{pids}/stat r,
        @{PROC}/1/cgroup r,
        @{PROC}/sys/fs/inotify/max_user_watches r,
        @{PROC}/sys/kernel/sched_autogroup_enabled r,
        @{PROC}/sys/kernel/unprivileged_userns_clone r,
        @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
        @{PROC}/sys/kernel/yama/ptrace_scope r,
        @{PROC}/sys/user/max_user_namespaces r,
        @{PROC}/version r,
  owner @{PROC}/@{pid}/autogroup rw,
  owner @{PROC}/@{pid}/cmdline rk,
  owner @{PROC}/@{pid}/environ r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,
  owner @{PROC}/@{pid}/oom_score_adj w,
  owner @{PROC}/@{pid}/statm r,
  owner @{PROC}/@{pid}/task/ r,
  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
  owner @{PROC}/@{pid}/task/@{tid}/status r,

  /dev/hidraw@{int} rw,
  /dev/input/ r,
  /dev/input/event@{int} r,
  /dev/tty rw,
  /dev/uinput w,
  /dev/video@{int} rw,

  audit deny /**.steam_exec_test.sh rw,
  deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,

  profile lspci {
    include <abstractions/base>
    include <abstractions/consoles>
    include <abstractions/nameservice-strict>

    @{bin}/lspci mr,

    owner @{HOME}/.steam/steam.pipe r,

    @{sys}/bus/pci/devices/ r,
    @{sys}/bus/pci/slots/ r,
    @{sys}/bus/pci/slots/@{int}/address r,
    @{sys}/devices/pci[0-9]*/** r,
  
    owner /dev/shm/ValveIPCSHM_@{uid} rw,

    include if exists <local/steam_lspci>
  }

  include if exists <local/steam>
}