# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

include <tunables/global>

@{exec_path} = @{bin}/cupsd
profile cupsd @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/authentication>
  include <abstractions/dbus-strict>
  include <abstractions/nameservice-strict>
  include <abstractions/openssl>
  include <abstractions/python>

  capability audit_write,
  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability fsetid,
  capability kill,
  capability net_admin,
  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability wake_alarm,

  network inet stream,
  network inet6 stream,

  network appletalk dgram,
  network ash dgram,
  network ax25 dgram,
  network bluetooth,
  network econet dgram,
  network ipx dgram,
  network netrom seqpacket,
  network rose dgram,
  network x25 seqpacket,

  dbus send bus=system path=/org/freedesktop/ColorManager{,/devices/cups_*}
    interface=org.freedesktop.ColorManager{,.*}
    member={CreateProfile,CreateDevice,FindDeviceById,AddProfile}
    peer=(name=org.freedesktop.ColorManager),

  @{exec_path} mr,

  @{bin}/{,ba,da}sh          rix,
  @{bin}/cat                 rix,
  @{bin}/chmod               rix,
  @{bin}/cp                  rix,
  @{bin}/grep                rix,
  @{bin}/gs                  rix,
  @{bin}/gsc                 rix,
  @{bin}/hostname            rix,
  @{bin}/ippfind             rix,
  @{bin}/mktemp              rix,
  @{bin}/printenv            rix,
  @{bin}/python3.[0-9]*      rix,
  @{bin}/rm                  rix,
  @{bin}/sed                 rix,
  @{bin}/smbspool            rPx,
  @{bin}/touch               rix,
  @{bin}/xz                  rix,
  @{lib}/cups/backend/*      rPx,
  @{lib}/cups/cgi-bin/*.cgi  rix,
  @{lib}/cups/daemon/*       rix,
  @{lib}/cups/driver/*       rix,
  @{lib}/cups/filter/*       rix,
  @{lib}/cups/monitor/*      rix,
  @{lib}/cups/notifier/*     rix,

  /usr/share/cups/{,**} r,
  /usr/share/ghostscript/{,**} r,
  /usr/share/poppler/{,**} r,
  /usr/share/ppd/{,**} r,

  /etc/cups/{,**} rw,
  /etc/foomatic/* r,
  /etc/papersize r,
  /etc/paperspecs r,
  /etc/pnm2ppa.conf r,
  /etc/printcap rwl,

  /var/cache/cups/ rw,
  /var/cache/cups/** rwk,
  /var/log/cups/{,*} rw,
  /var/spool/cups/{,**} rw,

  @{run}/cups/{,**} rw,
  @{run}/systemd/notify w,

  @{sys}/module/apparmor/parameters/enabled r,

        @{PROC}/@{pids}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,
  
  owner /tmp/*_latest_print_info w,

  /dev/tty rw,

  include if exists <local/cupsd>
}