# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# LOGPROF-SUGGEST: no

# Full set of rules for desktop generic `open-*` used in `child-open-*` profiles.

  abi <abi/4.0>,

  include <abstractions/desktop>
  include <abstractions/dconf>

  dbus send bus=session path=/org/gnome/Nautilus
       interface=org.freedesktop.Application
       member=Open
       peer=(name=org.gnome.Nautilus, label=nautilus),

  @{bin}/env rix,
  @{sh_path} r,

    @{bin}/gio                 mrix,
    @{bin}/gio-launch-desktop  mrix,
    @{bin}/xdg-open            mrix,
    @{lib}/gio-launch-desktop  mrix,

    priority=1 @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mrix,


    include <abstractions/audio-client>
    include <abstractions/graphics>
    include <abstractions/nameservice-strict>

    @{bin}/kde-open            mrix,

    /etc/xdg/menus/*.menu r,

    owner @{user_config_dirs}/kioclientrc r,
    owner @{user_config_dirs}/menus/*.menu r,

    owner @{run}/user/@{uid}/#@{int} rw,
    owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int},
    owner @{run}/user/@{uid}/kde-open@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int},

    @{PROC}/sys/kernel/random/boot_id r,


  /dev/tty rw,

  include if exists <abstractions/app/open.d>

# vim:syntax=apparmor
