apparmor.d/apparmor.d/groups/gnome/nautilus

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{bin}/nautilus
profile nautilus @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/bus/atspi>
  include <abstractions/bus/desktop>
  include <abstractions/bus/hostname>
  include <abstractions/dbus-accessibility-strict>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
  include <abstractions/deny-sensitive-home>
  include <abstractions/dri-enumerate>
  include <abstractions/gnome>
  include <abstractions/mesa>
  include <abstractions/nameservice-strict>
  include <abstractions/opencl-nvidia>
  include <abstractions/openssl>
  include <abstractions/trash>
  include <abstractions/vulkan>

  dbus bind bus=session name=org.gnome.Nautilus,
  dbus (send, receive) bus=session path=/org/gnome/Nautilus
       interface=org.gtk.{Actions,Application},
  dbus  (send, receive) bus=session path=/org/gnome/Nautilus{,/**}
       interface=org.freedesktop.DBus.Properties
       peer=(name=:*),

  dbus bind bus=session name=org.freedesktop.FileManager1,
  dbus receive bus=session path=/org/freedesktop/FileManager1
       interface=org.freedesktop.DBus.Properties
       peer=(name=:*),
  dbus send bus=session path=/org/freedesktop/FileManager1
       interface=org.freedesktop.DBus.Properties
       peer=(name=org.freedesktop.DBus),

  dbus receive bus=session path=/org/gnome/Nautilus/*
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-extension-ding),

  dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
       interface=org.freedesktop.DBus.Peer
       peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner),
  dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
       interface=org.freedesktop.Tracker3.Endpoint
       peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner),

  dbus (send, receive) bus=session path=/org/gtk/Private/RemoteVolumeMonitor
       interface=org.gtk.Private.RemoteVolumeMonitor
       peer=(name=:*, label=gvfs-*-monitor),

  dbus send bus=session path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus.Properties
       member={GetAll,ListActivatableNames}
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

  # talk: org.gtk.vfs.*
  dbus send bus=session path=/org/gtk/vfs/**
       interface=org.gtk.vfs.*
       peer=(name=:*, label=gvfsd),

  # talk: org.gtk.MountOperationHandler
  dbus send bus=session path=/org/gtk/MountOperationHandler
       interface=org.freedesktop.DBus.Properties
       peer=(name=:*, label=gnome-shell),

  dbus send bus=session path=/org/gtk/Notifications
       interface=org.gtk.Notifications
       member=AddNotification
       peer=(name=org.gtk.Notifications, label=gnome-shell),

  dbus (send, receive) bus=session path=/org/gtk/Application/CommandLine
       interface=org.gtk.private.CommandLine
       member=Print
       peer=(name=:*, label=nautilus),

  dbus send bus=session path=/com/canonical/unity/launcherentry/@{int}
       interface=com.canonical.Unity.LauncherEntry
       member=Update
       peer=(name=org.freedesktop.DBus, label=gnome-shell),

  dbus send bus=session path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
       member=ListActivatableNames
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

  dbus send bus=session path=/org/freedesktop/dbus
       interface=org.freedesktop.DBus
       member=NameHasOwner
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

  @{exec_path} mr,

  @{bin}/{,ba,da}sh          rix,
  @{bin}/bwrap              rPUx,
  @{bin}/firejail           rPUx,
  @{bin}/net                rPUx,
  @{bin}/tracker3           rPUx,

  @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop  rPx -> child-open,
  @{lib}/gio-launch-desktop                           rPx -> child-open,

  /usr/share/*ubuntu/applications/{,**} r,
  /usr/share/icu/@{int}.@{int}/*.dat r,
  /usr/share/libdrm/*.ids r,
  /usr/share/nautilus/{,**} r,
  /usr/share/poppler/{,**} r,
  /usr/share/sounds/freedesktop/stereo/*.oga r,
  /usr/share/terminfo/ r,
  /usr/share/thumbnailers/{,**} r,
  /usr/share/tracker*/{,**} r,

  /etc/fstab r,

  /var/cache/fontconfig/ r,
  /var/lib/snapd/desktop/icons/{,**} r,

  # Full access to user's data
  / r,
  /*/ r,
  @{bin}/ r,
  @{lib}/ r,
  @{MOUNTDIRS}/ r,
  @{MOUNTS}/ r,
  @{MOUNTS}/** rw,
  owner @{HOME}/{,**} rw,
  owner @{run}/user/@{uid}/{,**} rw,
  owner /tmp/{,**} rw,

  # Silence non user's data
  deny /boot/{,**} r,
  deny /opt/{,**} r,
  deny /root/{,**} r,
  deny /tmp/.* rw,
  deny /tmp/.*/{,**} rw,

  owner @{user_share_dirs}/nautilus/{,**} rwk,

  @{run}/mount/utab r,

  @{sys}/devices/**/hwmon@{int}/{,name,temp*,fan*} r,
  @{sys}/devices/**/hwmon@{int}/**/{,name,temp*,fan*} r,
  @{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
  @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
  @{sys}/devices/pci[0-9]*/**/revision r,
  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,

        @{PROC}/@{pids}/net/wireless r,
        @{PROC}/sys/dev/i915/perf_stream_paranoid r,
  owner @{PROC}/@{pid}/cmdline r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mountinfo r,

  /dev/tty rw,
  /dev/dri/card@{int} rw,

  include if exists <local/nautilus>
}