# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/plasma-discover
@{att} = /att/plasma-discover/
profile plasma-discover /{,usr/}bin/plasma-discover flags=(attach_disconnected,attach_disconnected.path=@{att}) {
  include <abstractions/attached/base>
  include <abstractions/accounts-observe>
  include <abstractions/audio-client>
  include <abstractions/dconf-write>
  include <abstractions/graphics>
  include <abstractions/kde-strict>
  include <abstractions/attached/nameservice-strict>
  include <abstractions/qt-shader-cache>
  include <abstractions/ssl_certs>
  include <abstractions/bus/system/org.freedesktop.locale1>
  include <abstractions/network-manager-observe>

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink dgram,
  network netlink raw,

  signal (send) set=(term) peer=kioworker,

  #aa/dbus talk bus=system name=org.freedesktop.Flatpak.SystemHelper label=flatpak-system-helper
  # Unix: allow connection to the profile
  unix type=stream peer=(label=flatpak-system-helper),
  # org.freedesktop.Flatpak.SystemHelper: send and receive anything to the interface on the specific peer label
  dbus (send receive) bus=system path=/org/freedesktop/Flatpak/SystemHelper{,/**}
       interface=org.freedesktop.Flatpak.SystemHelper{,.*}
       peer=(name="{@{busname},org.freedesktop.Flatpak.SystemHelper{,.*},org.freedesktop.DBus}", label=flatpak-system-helper),
  dbus send bus=system path=/org/freedesktop/Flatpak/SystemHelper{,/**}
       interface=org.freedesktop.Flatpak.SystemHelper{,.*}
       peer=(name="org.freedesktop.Flatpak.SystemHelper{,.*}"),
  # DBus.Properties: read and send properties
  dbus (send receive) bus=system path=/org/freedesktop/Flatpak/SystemHelper{,/**}
       interface=org.freedesktop.DBus.Properties
       member={Get,GetAll,Set,PropertiesChanged}
       peer=(name="{@{busname},org.freedesktop.Flatpak.SystemHelper{,.*},org.freedesktop.DBus}", label=flatpak-system-helper),
  # DBus.Introspectable: allow service introspection
  dbus send bus=system path=/org/freedesktop/Flatpak/SystemHelper{,/**}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name="{@{busname},org.freedesktop.Flatpak.SystemHelper{,.*},org.freedesktop.DBus}", label=flatpak-system-helper),
  # DBus.ObjectManager: allow clients to enumerate sources
  dbus send bus=system path=/org/freedesktop/Flatpak/SystemHelper{,/**}
       interface=org.freedesktop.DBus.ObjectManager
       member=GetManagedObjects
       peer=(name="{@{busname},org.freedesktop.Flatpak.SystemHelper{,.*},org.freedesktop.DBus}", label=flatpak-system-helper),
  dbus receive bus=system path=/org/freedesktop/Flatpak/SystemHelper{,/**}
       interface=org.freedesktop.DBus.ObjectManager
       member={InterfacesAdded,InterfacesRemoved}
       peer=(name="{@{busname},org.freedesktop.Flatpak.SystemHelper{,.*},org.freedesktop.DBus}", label=flatpak-system-helper),


  @{exec_path} mr,

  @{sh_path}                        rix,
  @{bin}/kreadconfig{,5}             px,

  @{bin}/gpg                         cx -> gpg,
  @{bin}/gpgconf                     cx -> gpg,
  @{bin}/gpgsm                       cx -> gpg,
  @{lib}/revokefs-fuse               cx -> revokefs-fuse,
  @{bin}/fusermount{,3}              cx -> fusermount,

  /{,usr/}lib{,exec,32,64}/*-linux-gnu*/{,libexec/}kf{5,6}/kio_http_cache_cleaner Px,
  /{,usr/}lib{,exec,32,64}/kf{5,6}/kio_http_cache_cleaner Px,
  /{,usr/}lib{,exec,32,64}/*-linux-gnu*/{,libexec/}kf5/kioslave5 Px,
  /{,usr/}lib{,exec,32,64}/*-linux-gnu*/{,libexec/}kf6/kioworker Px,
  /{,usr/}lib{,exec,32,64}/kf5/kioslave5 Px,
  /{,usr/}lib{,exec,32,64}/kf6/kioworker Px,

  /usr/share/color-schemes/{,**} r,
  /usr/share/knsrcfiles/{,*} r,
  /usr/share/kservices{5,6}/{,*} r,
  /usr/share/kservicetypes5/{,*} r,
  /usr/share/libdiscover/** r,
  /usr/share/metainfo/{,**} r,
  /usr/share/flatpak/remotes.d/{,**} r,

  /etc/appstream.conf r,
  /etc/flatpak/remotes.d/{,**} r,
  /etc/machine-id r,
  /etc/xdg/ r,
  /etc/xdg/accept-languages.codes r,

  /var/tmp/flatpak-cache-*/ rw,
  /var/tmp/flatpak-cache-*/** rwlk,
  /var/tmp/#@{int} rw,

  /var/cache/swcatalog/ rw,

  /var/lib/flatpak/app/{,**} r,
  /var/lib/flatpak/appstream/{,**} r,
  /var/lib/flatpak/repo/{,**} r,
  /var/lib/flatpak/runtime/{,**} r,

  @{log}/pacman.log r,

  owner @{user_cache_dirs}/appstream/ r,
  owner @{user_cache_dirs}/appstream/*.xb rw,
  owner @{user_cache_dirs}/appstream/.goutputstream-@{rand6} rw,
  owner @{user_cache_dirs}/discover/{,**} rwlk,
  owner @{user_cache_dirs}/flatpak/system-cache/{,**} rw,
  owner @{user_cache_dirs}/kio_http/ w,

  owner @{user_config_dirs}/ r,
  owner @{user_config_dirs}/#@{int} rwl,
  owner @{user_config_dirs}/discoverrc rwl,
  owner @{user_config_dirs}/discoverrc.lock rwk,
  owner @{user_config_dirs}/kde.org/{,**} rwlk,
  owner @{user_config_dirs}/KDE/* r,
  owner @{user_config_dirs}/kdedefaults/plasmarc r,
  owner @{user_config_dirs}/libaccounts-glib/ rw,
  owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk,

  owner @{user_share_dirs}/flatpak/repo/{,**} rw,
  owner @{user_share_dirs}/knewstuff3/{,*} rw,
  owner @{user_share_dirs}/kwin/ rw,
  owner @{user_share_dirs}/kwin/** rwlk -> @{user_share_dirs}/kwin/**,
  owner @{user_state_dirs}/discoverstaterc r,
  owner @{user_state_dirs}/UserFeedback.org.kde.discover@{atomic} rwlk,

  owner @{tmp}/*.kwinscript rwl -> /tmp/#@{int},
  owner @{tmp}/#@{int} rw,
  owner @{tmp}/discover-@{rand6}/{,**} rw,
  owner @{tmp}/ostree-gpg-@{rand6}/ rw,
  owner @{tmp}/ostree-gpg-@{rand6}/** rwlk -> /tmp/ostree-gpg-@{rand6}/**,
  owner @{tmp}/discover.@{rand6} rwl,

  owner @{run}/user/@{uid}/.flatpak-cache rw,
  owner @{run}/user/@{uid}/.flatpak/{,**} rw,
  owner @{run}/user/@{uid}/.flatpak/**/*.ref rwk,
  owner @{run}/user/@{uid}/#@{int} rw,
  owner @{run}/user/@{uid}/discover@{rand6}.* rwl ->  @{run}/user/@{uid}/#@{int},

  owner @{PROC}/@{pid}/mountinfo r,

  /dev/tty r,

  profile gpg {
    include <abstractions/attached/base>

    @{bin}/gpg{,2} mr,
    @{bin}/gpgconf mr,
    @{bin}/gpgsm   mr,

    @{HOME}/@{XDG_GPG_DIR}/*.conf r,

    owner @{tmp}/ostree-gpg-@{rand6}/ r,
    owner @{tmp}/ostree-gpg-@{rand6}/** rwlk -> /tmp/ostree-gpg-@{rand6}/**,

    include if exists <local/plasma-discover_gpg>
  }

  profile revokefs-fuse {
    include <abstractions/attached/base>

    mount fstype=fuse.revokefs-fuse options=(rw nodev nosuid) revokefs-fuse -> /var/tmp/flatpak-cache-@{rand6}/*/,

    unix (send receive) type=seqpacket peer=(label=flatpak-system-helper),
    unix (send receive) type=stream peer=(label=bazaar//fusermount),
    unix (send receive) type=stream peer=(label=fusermount//mount),

    @{bin}/fusermount3 px -> plasma-discover//fusermount,

    /var/lib/flatpak/repo/tmp/flatpak-cache-@{rand6}/{,**} r,

    /var/tmp/flatpak-cache-@{rand6}/*/ r,
    /var/tmp/flatpak-cache-@{rand6}/*/** r,

    /dev/fuse rw,

    include if exists <local/plasma-discover_revokefs-fuse>
  }

  profile fusermount {
    include <abstractions/attached/base>
    include <abstractions/app/fusermount>

    capability setuid,

    unix (send receive) type=stream    peer=(label=gnome-software),
    unix (send receive) type=seqpacket peer=(label=flatpak-system-helper),

    mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
    umount /var/tmp/flatpak-cache-@{rand6}/*/,

    include if exists <local/plasma-discover_fusermount>
  }

  include if exists <local/plasma-discover>
}

# vim:syntax=apparmor
