# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

  abi <abi/4.0>,

  @{lib}/@{multiarch}/libproxy/*/modules/*.so mr,
  @{lib}/@{multiarch}/libvisual-@{version}/*/*.so mr,
  @{lib}/frei0r-@{int}/*.so mr,

  @{lib}/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner rix,
  @{lib}/@{multiarch}/gstreamer-1.0/gst-plugin-scanner rix,
  @{lib}/gstreamer-1.0/gst-plugin-scanner rix,

  /usr/share/gstreamer-1.0/presets/Gst*Enc.prs r,

  /etc/openni2/OpenNI.ini r,

  /tmp/ r,
  /var/tmp/ r,

  owner @{HOME}/orcexec.@{rand6} rw,

  owner @{HOME}/.gstreamer-@{int}.@{int}/ rw,
  owner @{HOME}/.gstreamer-@{int}.@{int}/registry.*.bin{,.tmp@{rand6}} rw,

  owner @{user_cache_dirs}/gstreamer-@{int}.@{int}/ rw,
  owner @{user_cache_dirs}/gstreamer-@{int}.@{int}/registry.*.bin{,.tmp@{rand6}} rw,

  # The orcexec.* file is JIT compiled code for various GStreamer elements.
  # If one is blocked the next is used instead.
  # The orcexec file is placed under /home/user/ also when the /tmp/ dir is mounted with the noexec flag.
  owner @{run}/user/@{uid}/orcexec.@{rand6} mrw,
  owner @{tmp}/orcexec.@{rand6} mrw,
  #owner @{HOME}/orcexec.* mrw,

  @{run}/udev/data/+drm:card@{int}-* r,   # For screen outputs
  @{run}/udev/data/+usb:* r,              # Identifies all USB devices

  @{run}/udev/data/c81:@{int}  r,         # For video4linux
  @{run}/udev/data/c189:@{int} r,         # For USB serial converters
  @{run}/udev/data/c226:@{int} r,         # For /dev/dri/card[0-9]*

  @{sys}/bus/ r,
  @{sys}/bus/media/devices/ r,
  @{sys}/bus/usb/devices/ r,
  @{sys}/class/ r,
  @{sys}/class/drm/ r,
  @{sys}/class/video4linux/ r,
  @{sys}/devices/@{pci}/busnum r,
  @{sys}/devices/@{pci}/config r,
  @{sys}/devices/@{pci}/descriptors r,
  @{sys}/devices/@{pci}/devnum r,
  @{sys}/devices/@{pci}/numa_node r,
  @{sys}/devices/@{pci}/speed r,
  @{sys}/devices/@{pci}/uevent r,
  @{sys}/devices/system/node/ r,
  @{sys}/devices/system/node/node@{int}/cpumap r,
  @{sys}/devices/system/node/node@{int}/meminfo r,

  @{PROC}/devices r,

  /dev/ r,
  /dev/bus/usb/ r,
  /dev/dri/ r,
  /dev/nvidia-uvm rw,

  include if exists <abstractions/gstreamer.d>

# vim:syntax=apparmor