Gecko [ www.utparral.edu.mx ]

Name	Size	Permission
snap-confine.snapd.25202	31.43 KB	-rw-r--r--
snap-confine.snapd.25577	31.43 KB	-rw-r--r--
snap.firefox.firefox	123.81 KB	-rw-r--r--
snap.firefox.geckodriver	124.65 KB	-rw-r--r--
snap.firefox.hook.configure	43.01 KB	-rw-r--r--
snap.firefox.hook.disconnect-plug-host-hunspell	30.97 KB	-rw-r--r--
snap.firefox.hook.install	30.9 KB	-rw-r--r--
snap.firefox.hook.post-refresh	31.11 KB	-rw-r--r--
snap.snapd-desktop-integration.hook.configure	45.76 KB	-rw-r--r--
snap.snapd-desktop-integration.snapd-desktop-integration	87.08 KB	-rw-r--r--
snap.snap-store.hook.configure	49.33 KB	-rw-r--r--
snap.snap-store.snap-store	88.36 KB	-rw-r--r--
snap.snap-store.ubuntu-software	88.37 KB	-rw-r--r--
snap.snap-store.ubuntu-software-local-file	88.41 KB	-rw-r--r--
snap-update-ns.firefox	107.06 KB	-rw-r--r--
snap-update-ns.snapd-desktop-integration	108.15 KB	-rw-r--r--
snap-update-ns.snap-store	102.72 KB	-rw-r--r--

Code Editor : snap.snap-store.ubuntu-software-local-file

# vim:syntax=apparmor

#include <tunables/global>

#include if exists "/etc/apparmor.d/tunables/home.d"
#include if exists "/var/lib/snapd/apparmor/snap-tuning"

# snapd supports the concept of 'parallel installs' where snaps with the same
# name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz
# may all be installed on the system. To support this, SNAP_NAME is set to the
# name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg
# 'foo_bar'). The profile name and most rules therefore reference
# SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime
# environment so the snap doesn't have to be aware of the distinction (eg,
# SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with
# SNAP_NAME so the security policy will allow writing to both locations (since
# they are equivalent).

# This is a snap name without the instance key
@{SNAP_NAME}="snap-store"
# This is a snap name with instance key
@{SNAP_INSTANCE_NAME}="snap-store"
@{SNAP_INSTANCE_DESKTOP}="snap-store"
@{SNAP_COMMAND_NAME}="ubuntu-software-local-file"
@{SNAP_REVISION}="1216"
@{PROFILE_DBUS}="snap_2esnap_2dstore_2eubuntu_2dsoftware_2dlocal_2dfile"
@{INSTALL_DIR}="/{,var/lib/snapd/}snap"

profile "snap.snap-store.ubuntu-software-local-file" flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/openssl>

# While in later versions of the base abstraction, include this explicitly
  # for series 16 and cross-distro
  /etc/ld.so.preload r,

# The base abstraction doesn't yet have this
  /etc/sysconfig/clock r,
  owner @{PROC}/@{pid}/maps k,

# /proc/XXXX/map_files contains the same info than /proc/XXXX/maps, but
  # in a format that is simpler to manage, because it doesn't require to
  # parse the text data inside a file, but just reading the contents of
  # a directory.
  # Reading /proc/XXXX/maps is already allowed in the base template
  # via <abstractions/base>. Also, only the owner can read it, and the
  # kernel limits access to it by requiring 'ptrace' enabled, so allowing
  # to access /proc/XXXX/map_files can be considered secure too.
  owner @{PROC}/@{pid}/map_files/ r,

# While the base abstraction has rules for encryptfs encrypted home and
  # private directories, it is missing rules for directory read on the toplevel
  # directory of the mount (LP: #1848919)
  owner @{HOME}/.Private/ r,
  owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,

# for python apps/services
  #include <abstractions/python>
  /etc/python3.[0-9]*/**                                r,

# explicitly deny noisy denials to read-only filesystems (see LP: #1496895
# for details)
deny /usr/lib/python3*/{,**/}__pycache__/ w,
deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w,
# bind mount used here (see 'parallel installs', above)
deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/             w,
deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w,

# for perl apps/services
  #include <abstractions/perl>
  # Missing from perl abstraction
  /usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr,

# Note: the following dangerous accesses should not be allowed in most
  # policy, but we cannot explicitly deny since other trusted interfaces might
  # add them.
  # Explicitly deny ptrace for now since it can be abused to break out of the
  # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
  #audit deny ptrace (trace),

# Explicitly deny capability mknod so apps can't create devices
  #audit deny capability mknod,

# Explicitly deny mount, remount and umount so apps can't modify things in
  # their namespace
  #audit deny mount,
  #audit deny remount,
  #audit deny umount,

# End dangerous accesses

# Note: this potentially allows snaps to DoS other snaps via resource
  # exhaustion but we can't sensibly mediate this today. In the future we may
  # employ cgroup limits, AppArmor rlimit mlock rules or something else.
  capability ipc_lock,

# for bash 'binaries' (do *not* use abstractions/bash)
  # user-specific bash files
  /etc/bash.bashrc r,
  /etc/inputrc r,
  /etc/environment r,
  /etc/profile r,

# user/group/seat lookups
  /etc/{passwd,group,nsswitch.conf} r,  # very common
  /var/lib/extrausers/{passwd,group} r,
  /run/systemd/users/[0-9]* r,
  /etc/default/nss r,

# libnss-systemd (subset from nameservice abstraction)
  #
  #   https://systemd.io/USER_GROUP_API/
  #   https://systemd.io/USER_RECORD/
  #   https://www.freedesktop.org/software/systemd/man/nss-systemd.html
  #
  # Allow User/Group lookups via common VarLink socket APIs. Applications need
  # to either consult all of them or the io.systemd.Multiplexer frontend.
  /run/systemd/userdb/ r,
  /run/systemd/userdb/io.systemd.Multiplexer rw,
  /run/systemd/userdb/io.systemd.DynamicUser rw,        # systemd-exec users
  /run/systemd/userdb/io.systemd.Home rw,               # systemd-home dirs
  /run/systemd/userdb/io.systemd.NameServiceSwitch rw,  # UNIX/glibc NSS
  /run/systemd/userdb/io.systemd.Machine rw,            # systemd-machined

/etc/libnl-3/{classid,pktloc} r,      # apps that use libnl

# For snappy reexec on 4.8+ kernels
  /usr/lib/snapd/snap-exec m,

# For gdb support
  /usr/lib/snapd/snap-gdb-shim ixr,
  /usr/lib/snapd/snap-gdbserver-shim ixr,

# For in-snap tab completion
  /etc/bash_completion.d/{,*} r,
  /usr/lib/snapd/etelpmoc.sh ixr,               # marshaller (see complete.sh for out-of-snap unmarshal)
  /usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here

# uptime
  @{PROC}/uptime r,
  @{PROC}/loadavg r,

# Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib
  # which is allowed by the base abstraction, but on 14.04 it is an actual file
  # so need to add it here. Also allow read locks on the file.
  /etc/os-release rk,
  /usr/lib/os-release k,

# Debian version of the host OS which might be required in AppArmor-secured Debian
  /etc/debian_version r,

# systemd native journal API (see sd_journal_print(4)). This should be in
  # AppArmor's base abstraction, but until it is, include here. We include
  # the base journal path as well as the journal namespace pattern path. Each
  # journal namespace for quota groups will be prefixed with 'snap-'.
  /run/systemd/journal{,.snap-*}/socket w,
  /run/systemd/journal{,.snap-*}/stdout rw, # 'r' shouldn't be needed, but journald
                                            # doesn't leak anything so allow
  /run/systemd/journal{,.snap-*}/dev-log w,

# snapctl and its requirements
  /usr/bin/snapctl ixr,
  /usr/lib/snapd/snapctl ixr,
  @{PROC}/sys/net/core/somaxconn r,
  /run/snapd-snap.socket rw,

# Note: for now, don't explicitly deny this noisy denial so --devmode isn't
  # broken but eventually we may conditionally deny this since it is an
  # information leak.
  #deny /{,var/}run/utmp r,

# Allow reading the maximum number of open file descriptors.
  @{PROC}/sys/fs/nr_open r,

# java
  @{PROC}/@{pid}/ r,
  @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/auxv r,
  @{PROC}/sys/vm/zone_reclaim_mode r,
  /etc/lsb-release r,
  /sys/devices/**/read_ahead_kb r,
  /sys/devices/system/cpu/** r,
  /sys/devices/system/node/node[0-9]*/* r,
  /sys/kernel/mm/transparent_hugepage/enabled r,
  /sys/kernel/mm/transparent_hugepage/defrag r,
  # NOTE: this leaks running process but java seems to want it (even though it
  # seems to operate ok without it) and SDL apps crash without it. Allow owner
  # match until AppArmor kernel var is available to solve this properly (see
  # LP: #1546825 for details). comm is a subset of cmdline, so allow it too.
  owner @{PROC}/@{pid}/cmdline r,
  owner @{PROC}/@{pid}/comm r,

# Per man(5) proc, the kernel enforces that a thread may only modify its comm
  # value or those in its thread group.
  owner @{PROC}/@{pid}/task/@{tid}/comm rw,

# Allow reading and writing to our file descriptors in /proc which, for
  # example, allow access to /dev/std{in,out,err} which are all symlinks to
  # /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE)
  # linkat() temporary file technique, allow all fds. Importantly, access to
  # another task's fd via this proc interface is mediated via 'ptrace (read)'
  # (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so
  # this rule by itself doesn't allow opening another snap's fds via proc.
  owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw,

# Miscellaneous accesses
  /dev/{,u}random w,
  /etc/machine-id r,
  /etc/mime.types r,
  /etc/default/keyboard r,
  @{PROC}/ r,
  @{PROC}/version r,
  @{PROC}/version_signature r,
  /etc/{,writable/}hostname r,
  /etc/{,writable/}localtime r,
  /etc/{,writable/}mailname r,
  /etc/{,writable/}timezone r,
  owner @{PROC}/@{pid}/cgroup rk,
  @{PROC}/@{pid}/cpuset r,
  @{PROC}/@{pid}/io r,
  owner @{PROC}/@{pid}/fdinfo/* r,
  owner @{PROC}/@{pid}/limits r,
  owner @{PROC}/@{pid}/loginuid r,
  owner @{PROC}/@{pid}/sessionid r,
  @{PROC}/@{pid}/smaps r,
  @{PROC}/@{pid}/stat r,
  @{PROC}/@{pid}/statm r,
  @{PROC}/@{pid}/status r,
  @{PROC}/@{pid}/task/ r,
  @{PROC}/@{pid}/task/[0-9]*/smaps r,
  @{PROC}/@{pid}/task/[0-9]*/stat r,
  @{PROC}/@{pid}/task/[0-9]*/statm r,
  @{PROC}/@{pid}/task/[0-9]*/status r,
  @{PROC}/sys/fs/pipe-max-size r,
  @{PROC}/sys/kernel/hostname r,
  @{PROC}/sys/kernel/osrelease r,
  @{PROC}/sys/kernel/ostype r,
  @{PROC}/sys/kernel/pid_max r,
  @{PROC}/sys/kernel/yama/ptrace_scope r,
  @{PROC}/sys/kernel/shmmax r,
  # Allow apps to introspect the level of dbus mediation AppArmor implements.
  /sys/kernel/security/apparmor/features/dbus/mask r,
  @{PROC}/sys/fs/file-max r,
  @{PROC}/sys/fs/file-nr r,
  @{PROC}/sys/fs/inotify/max_* r,
  @{PROC}/sys/kernel/pid_max r,
  @{PROC}/sys/kernel/random/boot_id r,
  @{PROC}/sys/kernel/random/entropy_avail r,
  @{PROC}/sys/kernel/random/uuid r,
  @{PROC}/sys/kernel/cap_last_cap r,
  # Allow access to the uuidd daemon (this daemon is a thin wrapper around
  # time and getrandom()/{,u}random and, when available, runs under an
  # unprivilged, dedicated user).
  /run/uuidd/request rw,
  /sys/devices/virtual/tty/{console,tty*}/active r,
  /sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r,
  /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r,
  /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.stat r,
  /sys/fs/cgroup/system.slice/snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.max r,
  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r,
  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r,
  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r,
  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r,
  /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
  /sys/module/apparmor/parameters/enabled r,
  /{,usr/}lib/ r,

# Reads of oom_adj and oom_score_adj are safe
  owner @{PROC}/@{pid}/oom_{,score_}adj r,

# Note: for now, don't explicitly deny write access so --devmode isn't broken
  # but eventually we may conditionally deny this since it allows the process
  # to increase the oom heuristic of other processes (make them more likely to
  # be killed). Once AppArmor kernel var is available to solve this properly,
  # this can safely be allowed since non-root processes won't be able to
  # decrease the value and root processes will only be able to with
  # 'capability sys_resource,' which we deny be default.
  # deny owner @{PROC}/@{pid}/oom_{,score_}adj w,

# Eases hardware assignment (doesn't give anything away)
  /etc/udev/udev.conf r,
  /sys/       r,
  /sys/bus/   r,
  /sys/class/ r,

# this leaks interface names and stats, but not in a way that is traceable
  # to the user/device
  @{PROC}/net/dev r,
  @{PROC}/@{pid}/net/dev r,

# Read-only of this snap
  /var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r,

# Read-only of snapd restart state for snapctl specifically
  /var/lib/snapd/maintenance.json r,

# Read-only for the install directory
  # bind mount used here (see 'parallel installs', above)
  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/                   r,
  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/    r,
  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/**  mrklix,

# Read-only install directory for other revisions to help with bugs like
  # LP: #1616650 and LP: #1655992
  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**  mrkix,

# Read-only home area for other versions
  # bind mount *not* used here (see 'parallel installs', above)
  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/                  r,
  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/**                mrkix,

# Experimental snap folder changes
  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/                    r,
  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/**                  mrkix,
  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/common/**           wl,

owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/                          r,
  owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/**                        mrkixwl,

# Writable home area for this version.
  # bind mount *not* used here (see 'parallel installs', above)
  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl,

# Read-only system area for other versions
  # bind mount used here (see 'parallel installs', above)
  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/   r,
  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,

# Writable system area only for this version
  # bind mount used here (see 'parallel installs', above)
  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl,
  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl,

# The snap-confine program creates an app-specific private restricted /tmp
  # and will fail to launch the app if something goes wrong. As such, we can
  # simply allow full access to /tmp.
  /tmp/   r,
  /tmp/** mrwlkix,

# App-specific access to files and directories in /dev/shm. We allow file
  # access in /dev/shm for shm_open() and files in subdirectories for open()
  # bind mount *not* used here (see 'parallel installs', above)
  /{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix,
  # Also allow app-specific access for sem_open()
  /{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk,

# Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
  # bind mount *not* used here (see 'parallel installs', above)
  owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/   rw,
  owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,

# Allow apps from the same package to communicate with each other via an
  # abstract or anonymous socket
  unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**",
  unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),

# Allow apps from the same package to communicate with each other via DBus.
  # Note: this does not grant access to the DBus sockets of well known buses
  # (will still need to use an appropriate interface for that).
  dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
  # In addition to the above, dbus-run-session attempts reading these files
  # from the snap base runtime.
  /usr/share/dbus-1/services/{,*} r,
  /usr/share/dbus-1/system-services/{,*} r,
  # Allow apps to perform DBus introspection on org.freedesktop.DBus for both
  # the system and session buses.
  # Note: this does not grant access to the DBus sockets of these buses, but
  # we grant it here since it is missing from the dbus abstractions
  # (LP: #1866168)
  dbus (send)
      bus={session,system}
      path=/org/freedesktop/DBus
      interface=org.freedesktop.DBus.Introspectable
      member=Introspect
      peer=(label=unconfined),

# Allow apps from the same package to signal each other via signals
  signal peer=snap.@{SNAP_INSTANCE_NAME}.*,

# Allow receiving signals from all snaps (and focus on mediating sending of
  # signals)
  signal (receive) peer=snap.*,

# Allow receiving signals from unconfined (eg, systemd)
  signal (receive) peer=unconfined,

# for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign'
  /{,usr/}{,s}bin/udevadm ixr,
  /etc/udev/udev.conf r,
  /{,var/}run/udev/tags/snappy-assign/ r,
  @{PROC}/cmdline r,
  /sys/devices/**/uevent r,

# LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above
  # requires:
  #   /run/udev/data/* r,
  # but that reveals too much about the system and cannot be granted to apps
  # by default at this time.

# For convenience, allow apps to see what is in /dev even though cgroups
  # will block most access
  /dev/ r,
  /dev/**/ r,

# Allow setting up pseudoterminal via /dev/pts system. This is safe because
  # the launcher uses a per-app devpts newinstance.
  /dev/ptmx rw,

# Do the same with /sys/devices and /sys/class to help people using hw-assign
  /sys/devices/ r,
  /sys/devices/**/ r,
  /sys/class/ r,
  /sys/class/**/ r,

# Allow all snaps to chroot
  capability sys_chroot,

# Lttng tracing is very noisy and should not be allowed by confined apps. Can
  # safely deny for the normal case (LP: #1260491). If/when an lttng-trace
  # interface is needed, we can rework this.
  deny /{dev,run,var/run}/shm/lttng-ust-* rw,

# Allow read-access on /home/ for navigating to other parts of the
  # filesystem. While this allows enumerating users, this is already allowed
  # via /etc/passwd and getent.
  @{HOMEDIRS}/ r,

# Allow read-access to / for navigating to other parts of the filesystem.
  / r,

# Snap-specific run directory. Bind mount *not* used here
  # (see 'parallel installs', above)
  /run/snap.@{SNAP_INSTANCE_NAME}/ rw,
  /run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,

# Snap-specific lock directory and prerequisite navigation permissions.
  /run/lock/ r,
  /run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw,
  /run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,

# Allow listing and reading systemd-provided credentials.
  /run/credentials/ r,
  /run/credentials/snap.@{SNAP_INSTANCE_NAME}.*.service/ r,
  /run/credentials/snap.@{SNAP_INSTANCE_NAME}.*.service/** r,

# Default rules for core base runtimes

# The base abstraction doesn't yet have this
  /{,usr/}lib/terminfo/** rk,
  /usr/share/terminfo/** k,
  /usr/share/zoneinfo/** k,

# for python apps/services
  /usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr,
  # additional accesses needed for newer pythons in later bases
  /usr/lib{,32,64}/python3.[0-9]*/**.{pyc,so}           mr,
  /usr/lib{,32,64}/python3.[0-9]*/**.{egg,py,pth}       r,
  /usr/lib{,32,64}/python3.[0-9]*/{site,dist}-packages/ r,
  /usr/lib{,32,64}/python3.[0-9]*/lib-dynload/*.so      mr,
  /usr/include/python3.[0-9]*/pyconfig.h               r,

# for perl apps/services
  /usr/bin/perl{,5*} ixr,
  # AppArmor <2.12 doesn't have rules for perl-base, so add them here
  /usr/lib/@{multiarch}/perl{,5,-base}/**            r,
  /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,

# for bash 'binaries' (do *not* use abstractions/bash)
  # user-specific bash files
  /{,usr/}bin/bash ixr,
  /{,usr/}bin/dash ixr,
  /usr/share/terminfo/** r,

# Common utilities for shell scripts
  /{,usr/}bin/arch ixr,
  /{,usr/}bin/{,g,m}awk ixr,
  /{,usr/}bin/base32 ixr,
  /{,usr/}bin/base64 ixr,
  /{,usr/}bin/basename ixr,
  /{,usr/}bin/bunzip2 ixr,
  /{,usr/}bin/busctl ixr,
  /{,usr/}bin/bzcat ixr,
  /{,usr/}bin/bzdiff ixr,
  /{,usr/}bin/bzgrep ixr,
  /{,usr/}bin/bzip2 ixr,
  /{,usr/}bin/cat ixr,
  /{,usr/}bin/chgrp ixr,
  /{,usr/}bin/chmod ixr,
  /{,usr/}bin/chown ixr,
  /{,usr/}bin/clear ixr,
  /{,usr/}bin/cmp ixr,
  /{,usr/}bin/cp ixr,
  /{,usr/}bin/cpio ixr,
  /{,usr/}bin/cut ixr,
  /{,usr/}bin/date ixr,
  /{,usr/}bin/dbus-daemon ixr,
  /{,usr/}bin/dbus-run-session ixr,
  /{,usr/}bin/dbus-send ixr,
  /{,usr/}bin/dd ixr,
  /{,usr/}bin/diff{,3} ixr,
  /{,usr/}bin/dir ixr,
  /{,usr/}bin/dirname ixr,
  /{,usr/}bin/du ixr,
  /{,usr/}bin/echo ixr,
  /{,usr/}bin/{,e,f,r}grep ixr,
  /{,usr/}bin/env ixr,
  /{,usr/}bin/expr ixr,
  /{,usr/}bin/false ixr,
  /{,usr/}bin/find ixr,
  /{,usr/}bin/flock ixr,
  /{,usr/}bin/fmt ixr,
  /{,usr/}bin/fold ixr,
  /{,usr/}bin/getconf ixr,
  /{,usr/}bin/getent ixr,
  /{,usr/}bin/getopt ixr,
  /{,usr/}bin/groups ixr,
  /{,usr/}bin/gzip ixr,
  /{,usr/}bin/head ixr,
  /{,usr/}bin/hostname ixr,
  /{,usr/}bin/id ixr,
  /{,usr/}bin/igawk ixr,
  /{,usr/}bin/infocmp ixr,
  /{,usr/}bin/kill ixr,
  /{,usr/}bin/ldd ixr,
  /{usr/,}lib{,32,64}/ld{,32,64}-*.so ix,
  /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so* ix,
  /{,usr/}bin/less{,file,pipe} ixr,
  /{,usr/}bin/ln ixr,
  /{,usr/}bin/line ixr,
  /{,usr/}bin/link ixr,
  /{,usr/}bin/locale ixr,
  /{,usr/}bin/logger ixr,
  /{,usr/}bin/ls ixr,
  /{,usr/}bin/md5sum ixr,
  /{,usr/}bin/mkdir ixr,
  /{,usr/}bin/mkfifo ixr,
  /{,usr/}bin/mknod ixr,
  /{,usr/}bin/mktemp ixr,
  /{,usr/}bin/more ixr,
  /{,usr/}bin/mv ixr,
  /{,usr/}bin/nice ixr,
  /{,usr/}bin/nohup ixr,
  /{,usr/}bin/numfmt ixr,
  /{,usr/}bin/od ixr,
  /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
  /{,usr/}bin/paste ixr,
  /{,usr/}bin/pgrep ixr,
  /{,usr/}bin/printenv ixr,
  /{,usr/}bin/printf ixr,
  /{,usr/}bin/ps ixr,
  /{,usr/}bin/pwd ixr,
  /{,usr/}bin/readlink ixr,
  /{,usr/}bin/realpath ixr,
  /{,usr/}bin/rev ixr,
  /{,usr/}bin/rm ixr,
  /{,usr/}bin/rmdir ixr,
  /{,usr/}bin/run-parts ixr,
  /{,usr/}bin/sed ixr,
  /{,usr/}bin/seq ixr,
  /{,usr/}bin/setpriv ixr,
  /{,usr/}bin/sha{1,224,256,384,512}sum ixr,
  /{,usr/}bin/shuf ixr,
  /{,usr/}bin/sleep ixr,
  /{,usr/}bin/sort ixr,
  /{,usr/}bin/stat ixr,
  /{,usr/}bin/stdbuf ixr,
  /{,usr/}bin/stty ixr,
  /{,usr/}bin/sync ixr,
  /{,usr/}bin/systemd-cat ixr,
  /{,usr/}bin/systemd-creds ixr,
  /{,usr/}bin/tac ixr,
  /{,usr/}bin/tail ixr,
  /{,usr/}bin/tar ixr,
  /{,usr/}bin/tee ixr,
  /{,usr/}bin/test ixr,
  /{,usr/}bin/tempfile ixr,
  /{,usr/}bin/tset ixr,
  /{,usr/}bin/touch ixr,
  /{,usr/}bin/tput ixr,
  /{,usr/}bin/tr ixr,
  /{,usr/}bin/true ixr,
  /{,usr/}bin/tty ixr,
  /{,usr/}bin/uname ixr,
  /{,usr/}bin/uniq ixr,
  /{,usr/}bin/unlink ixr,
  /{,usr/}bin/unxz ixr,
  /{,usr/}bin/unzip ixr,
  /{,usr/}bin/uptime ixr,
  /{,usr/}bin/vdir ixr,
  /{,usr/}bin/vim.tiny ixr,
  /{,usr/}bin/wc ixr,
  /{,usr/}bin/which{,.debianutils} ixr,
  /{,usr/}bin/xargs ixr,
  /{,usr/}bin/xz ixr,
  /{,usr/}bin/yes ixr,
  /{,usr/}bin/zcat ixr,
  /{,usr/}bin/z{,e,f}grep ixr,
  /{,usr/}bin/zip ixr,
  /{,usr/}bin/zipgrep ixr,

# lsb-release
  /usr/bin/lsb_release ixr,
  /usr/bin/ r,
  /usr/share/distro-info/*.csv r,

# For printing the cache (we don't allow updating the cache)
  /{,usr/}sbin/ldconfig{,.real} ixr,

# Allow all snaps to chroot
  /{,usr/}sbin/chroot ixr,

# Allow access to the Wayland compositor server socket
owner /run/user/[0-9]*/wayland-[0-9]* rw,

# Needed when using QT_QPA_PLATFORM=wayland-egl (MESA dri config)
/etc/drirc r,

# Description: Allow access to AppStream metadata from the host system

# Allow access to AppStream upstream metadata files
/usr/share/metainfo/{,**} r,
/usr/share/appdata/{,**} r,

# Allow access to AppStream collection metadata
/usr/share/{app-info,swcatalog}/** r,
/var/cache/{app-info,swcatalog}/** r,
/var/lib/{app-info,swcatalog}/** r,

# Apt symlinks the DEP-11 metadata to files in /var/lib/apt/lists
/var/lib/apt/lists/*.yml.gz r,

# Description: Allow access to PackageKit service which gives
# privileged access to native package management on the system

#include <abstractions/dbus-strict>

# Allow communication with the main PackageKit end point.
dbus (receive, send)
        bus=system
        path=/org/freedesktop/PackageKit
        interface=org.freedesktop.PackageKit
        peer=(label=unconfined),
dbus (receive, send)
        bus=system
        path=/org/freedesktop/PackageKit
        interface=org.freedesktop.PackageKit.Offline
        peer=(label=unconfined),
dbus (send)
        bus=system
        path=/org/freedesktop/PackageKit
        interface=org.freedesktop.DBus.Properties
        member=Get{,All}
        peer=(label=unconfined),
dbus (receive)
        bus=system
        path=/org/freedesktop/PackageKit
        interface=org.freedesktop.DBus.Properties
        member=PropertiesChanged
        peer=(label=unconfined),
dbus (send)
	bus=system
	path=/org/freedesktop/PackageKit
	interface=org.freedesktop.DBus.Introspectable
	member=Introspect
	peer=(label=unconfined),

# Allow communication with PackageKit transactions.  Transactions are
# exported with random object paths that currently take the form
# "/{number}_{hexstring}".  If PackageKit (or a reimplementation of
# packagekitd) changes this, then these rules will need to change too.
dbus (receive, send)
        bus=system
        path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
        interface=org.freedesktop.PackageKit.Transaction
        peer=(label=unconfined),
dbus (send)
        bus=system
        path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
        interface=org.freedesktop.DBus.Properties
        member=Get{,All}
        peer=(label=unconfined),
dbus (receive)
        bus=system
        path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
        interface=org.freedesktop.DBus.Properties
        member=PropertiesChanged
        peer=(label=unconfined),
dbus (send)
	bus=system
        path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
	interface=org.freedesktop.DBus.Introspectable
	member=Introspect
	peer=(label=unconfined),

# Description: Allow access to password manager services provided by popular
# Desktop Environments. This interface gives access to sensitive information
# available in the user's session.

#include <abstractions/dbus-session-strict>

# Provide full access to the secret-service API:
# - https://standards.freedesktop.org/secret-service/)
#
# The secret-service allows managing (add/delete/lock/etc) collections and
# (add/delete/etc) items within collections. The API also has the concept of
# aliases for collections which is typically used to access the default
# collection. While it would be possible for an application developer to use a
# snap-specific collection and mediate by object path, application developers
# are meant to instead to treat collections (typically the default collection)
# as a database of key/value attributes each with an associated secret that
# applications may query. Because AppArmor does not mediate member data,
# typical and recommended usage of the API does not allow for application
# isolation. For details, see:
# - https://standards.freedesktop.org/secret-service/ch03.html
#
dbus (receive, send)
    bus=session
    path=/org/freedesktop/secrets{,/**}
    interface=org.freedesktop.DBus.*
    peer=(label=unconfined),

dbus (receive, send)
    bus=session
    path=/org/freedesktop/secrets{,/**}
    interface=org.freedesktop.Secret.{Collection,Item,Prompt,Service,Session}
    peer=(label=unconfined),

# KWallet's client API is still in use in KDE/Plasma. It's DBus API relies upon
# member data for access to its 'folders' and 'entries' and it therefore does
# not allow for application isolation via AppArmor. For details, see:
# - https://cgit.kde.org/kdelibs.git/tree/kdeui/util/kwallet.h?h=v4.14.33
#
dbus (receive, send)
    bus=session
    path=/modules/kwalletd{,[56]}
    interface=org.freedesktop.DBus.*
    peer=(label=unconfined),

dbus (receive, send)
    bus=session
    path=/modules/kwalletd{,[56]}
    interface=org.kde.KWallet
    peer=(label=unconfined),

# Description: Allow owning a name on DBus public bus

#include <abstractions/dbus-session-strict>

# register on DBus
dbus (send)
    bus=session
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member="{Request,Release}Name"
    peer=(name=org.freedesktop.DBus, label=unconfined),

dbus (send)
    bus=session
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member="GetConnectionUnix{ProcessID,User}"
    peer=(name=org.freedesktop.DBus, label=unconfined),

dbus (send)
    bus=session
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member="GetConnectionCredentials"
    peer=(name=org.freedesktop.DBus, label=unconfined),

# bind to a well-known DBus name: io.snapcraft.Store
dbus (bind)
    bus=session
    name=io.snapcraft.Store,

# For KDE applications and some other cases, also support alternation for:
# - using org.kde.foo-PID as the 'well-known' name
# - using org.foo.cmd_<num>_<num> as the 'well-known' name
# Note, snapd does not allow declaring a 'well-known' name that ends with
# '-[0-9]+' or that contains '_'. Parallel installs of DBus services aren't
# supported at this time, but if they were, this could allow a parallel
# install'swell-known name to overlap with the normal install.
dbus (bind)
    bus=session
    name=io.snapcraft.Store{_,-}[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}{,_[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}},

# For Firefox, support using org.mozilla.firefox.<id> as the 'well-known' name
# where <id> is the base64-encoded profile name.
# See https://bugzilla.mozilla.org/1441894 for a discussion and details.
dbus (bind)
    bus=session
    name="io.snapcraft.Store.*",

# Allow us to talk to dbus-daemon
dbus (receive)
    bus=session
    path="/io/snapcraft/Store{,/**}"
    peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
    bus=session
    path="/io/snapcraft/Store{,/**}"
    interface=org.freedesktop.DBus.Properties
    peer=(name=org.freedesktop.DBus, label=unconfined),

# Allow us to introspect org.freedesktop.DBus (needed by pydbus)
dbus (send)
    bus=session
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect
    peer=(name=org.freedesktop.DBus, label=unconfined),

# Description: Allow owning a name on DBus public bus

#include <abstractions/dbus-session-strict>

dbus (send)
    bus=session
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member="GetConnectionUnix{ProcessID,User}"
    peer=(name=org.freedesktop.DBus, label=unconfined),

dbus (send)
    bus=session
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member="GetConnectionCredentials"
    peer=(name=org.freedesktop.DBus, label=unconfined),

# bind to a well-known DBus name: org.freedesktop.PackageKit
dbus (bind)
    bus=session
    name=org.freedesktop.PackageKit,

# For KDE applications and some other cases, also support alternation for:
# - using org.kde.foo-PID as the 'well-known' name
# - using org.foo.cmd_<num>_<num> as the 'well-known' name
# Note, snapd does not allow declaring a 'well-known' name that ends with
# '-[0-9]+' or that contains '_'. Parallel installs of DBus services aren't
# supported at this time, but if they were, this could allow a parallel
# install'swell-known name to overlap with the normal install.
dbus (bind)
    bus=session
    name=org.freedesktop.PackageKit{_,-}[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}{,_[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}},

# Allow us to talk to dbus-daemon
dbus (receive)
    bus=session
    path="/org/freedesktop/PackageKit{,/**}"
    peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
    bus=session
    path="/org/freedesktop/PackageKit{,/**}"
    interface=org.freedesktop.DBus.Properties
    peer=(name=org.freedesktop.DBus, label=unconfined),

# Description: Allow using fwupd service. This gives # privileged access to the
# fwupd service.

#Can access the network
  #include <abstractions/nameservice>
  #include <abstractions/ssl_certs>
  /run/systemd/resolve/stub-resolv.conf r,

# DBus accesses
  #include <abstractions/dbus-strict>

# systemd-resolved (not yet included in nameservice abstraction)
  #
  # Allow access to the safe members of the systemd-resolved D-Bus API:
  #
  #   https://www.freedesktop.org/wiki/Software/systemd/resolved/
  #
  # This API may be used directly over the D-Bus system bus or it may be used
  # indirectly via the nss-resolve plugin:
  #
  #   https://www.freedesktop.org/software/systemd/man/nss-resolve.html
  #
  dbus send
      bus=system
      path="/org/freedesktop/resolve1"
      interface="org.freedesktop.resolve1.Manager"
      member="Resolve{Address,Hostname,Record,Service}"
      peer=(name="org.freedesktop.resolve1"),

# Allow access to fwupd service
  dbus (receive, send)
      bus=system
      path=/
      interface=org.freedesktop.fwupd
      peer=(label=unconfined),

dbus (receive, send)
      bus=system
      path=/
      interface=org.freedesktop.DBus.Properties
      peer=(label=unconfined),

# Allow clients to introspect the service on non-classic (due to the path,
  # allowing on classic would reveal too much for unconfined)
  dbus (send)
      bus=system
      path=/
      interface=org.freedesktop.DBus.Introspectable
      member=Introspect
      peer=(label=unconfined),

dbus (send)
      bus=system
      path=/org/freedesktop/systemd1
      interface=org.freedesktop.systemd1.Manager
      member="GetDefaultTarget"
      peer=(label=unconfined),

dbus (send)
      bus=system
      interface=org.freedesktop.DBus.Properties
      path=/org/freedesktop/systemd1
      member=Get{,All}
      peer=(label=unconfined),

dbus (send)
      bus=system
      path=/org/freedesktop/systemd1
      interface=org.freedesktop.systemd1.Manager
      member=GetUnit
      peer=(label=unconfined),

# Description: Can access basic graphical desktop resources. To be used with
# other interfaces (eg, wayland).

#include <abstractions/dbus-strict>
#include <abstractions/dbus-session-strict>

# Allow finding the DBus session bus id (eg, via dbus_bus_get_id())
dbus (send)
     bus=session
     path=/org/freedesktop/DBus
     interface=org.freedesktop.DBus
     member=GetId
     peer=(name=org.freedesktop.DBus, label=unconfined),

#include <abstractions/fonts>
owner @{HOME}/.local/share/fonts/{,**} r,
/var/cache/fontconfig/   r,
/var/cache/fontconfig/** mr,
# some applications are known to mmap fonts
/usr/{,local/}share/fonts/** m,

# Allow access to xdg-document-portal file system.  Access control is
# handled by bind mounting a snap-specific sub-tree to this location
# (ie, this is /run/user/<uid>/doc/by-app/snap.@{SNAP_INSTANCE_NAME}
# on the host).
owner /run/user/[0-9]*/doc/{,*/} r,
# Allow rw access without owner match to the documents themselves since
# the user guided the access and can specify anything DAC allows.
/run/user/[0-9]*/doc/*/** rw,

# Allow access to xdg-desktop-portal and xdg-document-portal
dbus (receive, send)
    bus=session
    interface=org.freedesktop.portal.*
    path=/org/freedesktop/portal/{desktop,documents}{,/**}
    peer=(label=unconfined),

dbus (receive, send)
    bus=session
    interface=org.freedesktop.DBus.Properties
    path=/org/freedesktop/portal/{desktop,documents}{,/**}
    peer=(label=unconfined),

dbus (receive, send)
    bus=session
    interface=org.freedesktop.DBus.Introspectable
    path=/org/freedesktop/portal/{desktop,documents}{,/**}
    peer=(label=unconfined),

# The portals service is normally running and newer versions of
# xdg-desktop-portal include AssumedAppArmor=unconfined. Since older
# systems don't have this and because gtkfilechoosernativeportal.c relies on
# service activation, allow sends to peer=(name=org.freedesktop.portal.{Desktop,Documents})
# for service activation.
dbus (send)
    bus=session
    interface=org.freedesktop.portal.*
    path=/org/freedesktop/portal/desktop{,/**}
    peer=(name=org.freedesktop.portal.Desktop),
dbus (send)
    bus=session
    interface=org.freedesktop.DBus.Properties
    path=/org/freedesktop/portal/desktop{,/**}
    peer=(name=org.freedesktop.portal.Desktop),
dbus (send)
    bus=session
    interface=org.freedesktop.portal.*
    path=/org/freedesktop/portal/documents{,/**}
    peer=(name=org.freedesktop.portal.Documents),
dbus (send)
    bus=session
    interface=org.freedesktop.DBus.Properties
    path=/org/freedesktop/portal/documents{,/**}
    peer=(name=org.freedesktop.portal.Documents),

# Allow to get the current idle time only from Mutter
dbus (send)
    bus=session
    path="/org/gnome/Mutter/IdleMonitor/Core"
    interface="org.gnome.Mutter.IdleMonitor"
    member="GetIdletime"
    peer=(label=unconfined),

# Allow for color managed applications to communicate with colord
dbus (receive, send)
  bus=system
  interface=org.freedesktop.ColorManager
  path=/org/freedesktop/ColorManager
  member=FindDeviceByProperty
  peer=(label=unconfined),
dbus (send)
  bus=system
  interface=org.freedesktop.DBus.Properties
  path=/org/freedesktop/ColorManager
  member="Get{,All}"
  peer=(label=unconfined),
dbus (send)
  bus=system
  interface=org.freedesktop.DBus.Properties
  path="/org/freedesktop/ColorManager/{devices,profiles}/*"
  member="Get{,All}"
  peer=(label=unconfined),

# Allow access to the ICC profiles in the home directory to
# be referred to from colord
owner @{HOME}/.local/share/icc r,

# Allow to send updates to the desktop session about ongoing jobs
# (for progress display in the task list)
dbus (send)
    bus=session
    interface=com.canonical.Unity.LauncherEntry
    member=Update
    peer=(label=unconfined),

# Allow to send updates to the desktop session about ongoing jobs
# (for KDE Plasma specific details)
dbus (send)
    bus=session
    interface=org.kde.JobViewServer{,V2}
    path=/JobViewServer
    member=requestView
    peer=(label=unconfined),
dbus (send)
    bus=session
    interface=org.kde.JobView{,V2,V3}
    path=/org/kde/notificationmanager/jobs/*
    member={update,terminate}
    peer=(label=unconfined),

# Allow to display Status Notifier Items in the KDE Plasma systray
# (including supporting context menu)
dbus (send)
    bus=session
    interface=org.kde.StatusNotifierWatcher
    path=/StatusNotifierWatcher
    member=RegisterStatusNotifierItem
    peer=(label=unconfined),
dbus (send)
    bus=session
    interface=org.freedesktop.DBus.Properties
    path=/StatusNotifierWatcher
    member=Get
    peer=(label=unconfined),
dbus (receive)
    bus=session
    interface=org.kde.StatusNotifierItem
    path=/StatusNotifierItem
    member={ProvideXdgActivationToken,Activate}
    peer=(label=unconfined),
dbus (receive)
    bus=session
    interface=org.freedesktop.DBus.Properties
    path=/StatusNotifierItem
    member=GetAll
    peer=(label=unconfined),
dbus (receive)
    bus=session
    interface=com.canonical.dbusmenu
    path=/MenuBar
    member={AboutToShow,GetLayout,Event}
    peer=(label=unconfined),

# Description: Can access common desktop legacy methods. This gives privileged
# access to the user's input.

# accessibility (a11y)
#include <abstractions/dbus-session-strict>
dbus (send)
    bus=session
    path=/org/a11y/bus
    interface=org.a11y.Bus
    member=GetAddress
    peer=(label=unconfined),

#include <abstractions/dbus-accessibility-strict>

# Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
#   https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
owner /{,var/}run/user/[0-9]*/at-spi/bus* rw,

# Allow access to the socket used by speech-dispatcher
owner /{,var/}run/user/[0-9]*/speech-dispatcher/speechd.sock rw,

# Allow the accessibility services in the user session to send us any events
dbus (receive)
    bus=accessibility
    peer=(label=unconfined),

# Allow querying for capabilities and registering
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/accessible/root"
    interface="org.a11y.atspi.Socket"
    member="Embed"
    peer=(name=org.a11y.atspi.Registry, label=unconfined),
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/registry"
    interface="org.a11y.atspi.Registry"
    member="GetRegisteredEvents"
    peer=(name=org.a11y.atspi.Registry, label=unconfined),
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/registry/deviceeventcontroller"
    interface="org.a11y.atspi.DeviceEventController"
    member="Get{DeviceEvent,Keystroke}Listeners"
    peer=(name=org.a11y.atspi.Registry, label=unconfined),
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/registry/deviceeventcontroller"
    interface="org.a11y.atspi.DeviceEventController"
    member="NotifyListenersSync"
    peer=(name=org.a11y.atspi.Registry, label=unconfined),

# org.a11y.atspi is not designed for application isolation and these rules
# can be used to send change events for other processes.
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/accessible/root"
    interface="org.a11y.atspi.Event.Object"
    member="ChildrenChanged"
    peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/accessible/root"
    interface="org.a11y.atspi.Accessible"
    member="Get*"
    peer=(label=unconfined),
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/accessible/[0-9]*"
    interface="org.a11y.atspi.Event.Object"
    member="{ChildrenChanged,PropertyChange,StateChanged,TextCaretMoved}"
    peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/accessible/[0-9]*"
    interface="org.freedesktop.DBus.Properties"
    member="Get{,All}"
    peer=(label=unconfined),

dbus (send)
    bus=accessibility
    path="/org/a11y/atspi/cache"
    interface="org.a11y.atspi.Cache"
    member="{Add,Remove}Accessible"
    peer=(name=org.freedesktop.DBus, label=unconfined),

# ibus
# subset of ibus abstraction
/usr/lib/@{multiarch}/gtk-2.0/[0-9]*/immodules/im-ibus.so mr,
owner @{HOME}/.config/ibus/      r,
owner @{HOME}/.config/ibus/bus/  r,
owner @{HOME}/.config/ibus/bus/* r,

# allow communicating with ibus-daemon (this allows sniffing key events)
unix (connect, receive, send)
    type=stream
    peer=(addr="@/tmp/ibus/dbus-*"),

# abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache)
# This should use this, but due to LP: #1856738 we cannot
#unix (connect, receive, send)
#    type=stream
#    peer=(addr="@@{HOME}/.cache/ibus/dbus-*"),
unix (connect, receive, send)
     type=stream
     peer=(addr="@/home/*/.cache/ibus/dbus-*"),

# when running with glib >= 2.75.0, ibus uses a regular socket
owner @{HOME}/.cache/ibus/dbus-* rw,

# mozc
# allow communicating with mozc server
unix (connect, receive, send)
     type=stream
     peer=(addr="@tmp/.mozc.*"),

# gcin
# allow communicating with gcin server
unix (connect, receive, send)
     type=stream
     peer=(addr="@tmp/gcin-*/socket*"),

# fcitx
# allow communicating with fcitx dbus service
dbus send
    bus=fcitx
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
    peer=(name=org.freedesktop.DBus),

owner @{HOME}/.config/fcitx/dbus/* r,

# allow creating an input context
dbus send
    bus={fcitx,session}
    path=/inputmethod
    interface=org.fcitx.Fcitx.InputMethod
    member=CreateIC*
    peer=(label=unconfined),

# allow setting up and tearing down the input context
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="{Close,Destroy,Enable}IC"
    peer=(label=unconfined),

dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member=Reset
    peer=(label=unconfined),

# allow service to send us signals
dbus receive
    bus=fcitx
    peer=(label=unconfined),

dbus receive
    bus=session
    interface=org.fcitx.Fcitx.*
    peer=(label=unconfined),

# use the input context
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="Focus{In,Out}"
    peer=(label=unconfined),

dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="{CommitPreedit,Set*}"
    peer=(label=unconfined),

# this is an information leak and allows key and mouse sniffing. If the input
# context path were tied to the process' security label, this would not be an
# issue.
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="{MouseEvent,ProcessKeyEvent}"
    peer=(label=unconfined),

# this method does not exist with the sunpinyin backend (at least), so allow
# it for other input methods. This may consitute an information leak (which,
# again, could be avoided if the path were tied to the process' security
# label).
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.freedesktop.DBus.Properties
    member=GetAll
    peer=(label=unconfined),

# gtk2/gvfs gtk_show_uri()
dbus (send)
    bus=session
    path=/org/gtk/vfs/mounttracker
    interface=org.gtk.vfs.MountTracker
    member=ListMountableInfo,
dbus (send)
    bus=session
    path=/org/gtk/vfs/mounttracker
    interface=org.gtk.vfs.MountTracker
    member=LookupMount,

# Snaps are unable to use the data in mimeinfo.cache (since they can't execute
# the returned desktop file themselves). unity messaging menu doesn't require
# mimeinfo.cache and xdg-mime will fallback to reading the desktop files
# directly to look for MimeType. Since reading the snap's own desktop files is
# allowed, we can safely deny access to this file (and xdg-mime will either
# return one of the snap's mimetypes, or none).
deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,

# glib-networking's GLib proxy (different than the portal's proxy service
# org.freedesktop.portal.ProxyResolver). The Lookup API allows specifying
# various URLs (eg, file://, http:// and https://) which will be given to the
# unconfined glib-pacrunner.
dbus (send)
    bus=session
    path=/org/gtk/GLib/PACRunner
    interface=org.gtk.GLib.PACRunner
    member=Lookup
    peer=(label=unconfined),

# dbusmenu
dbus (send)
    bus=session
    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
    interface=com.canonical.dbusmenu
    member="{LayoutUpdated,ItemsPropertiesUpdated}"
    peer=(label="{plasmashell,unconfined}"),

dbus (receive)
    bus=session
    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
    interface="{com.canonical.dbusmenu,org.freedesktop.DBus.Properties}"
    member=Get*
    peer=(label="{plasmashell,unconfined}"),

dbus (receive)
    bus=session
    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
    interface=com.canonical.dbusmenu
    member="{AboutTo*,Event*}"
    peer=(label="{plasmashell,unconfined}"),

dbus (receive)
    bus=session
    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect
    peer=(label="{plasmashell,unconfined}"),

dbus (receive)
    bus=session
    path=/com/canonical/dbusmenu
    interface=org.freedesktop.DBus.Properties
    member=Get*
    peer=(label="{plasmashell,unconfined}"),

# app-indicators
dbus (send)
    bus=session
    path=/StatusNotifierWatcher
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect
    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),

dbus (send)
    bus=session
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member="{GetConnectionUnixProcessID,RequestName,ReleaseName}"
    peer=(name=org.freedesktop.DBus, label=unconfined),

dbus (bind)
    bus=session
    name=org.kde.StatusNotifierItem-[0-9]*,

dbus (send)
    bus=session
    path=/StatusNotifierWatcher
    interface=org.freedesktop.DBus.Properties
    member=Get
    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),

dbus (send)
    bus=session
    path=/{StatusNotifierWatcher,org/ayatana/NotificationItem/*}
    interface=org.kde.StatusNotifierWatcher
    member=RegisterStatusNotifierItem
    peer=(label="{plasmashell,unconfined}"),

dbus (send)
    bus=session
    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
    interface=org.kde.StatusNotifierItem
    member="New{AttentionIcon,Icon,IconThemePath,OverlayIcon,Status,Title,ToolTip}"
    peer=(name=org.freedesktop.DBus, label="{plasmashell,unconfined}"),

dbus (receive)
    bus=session
    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
    interface=org.kde.StatusNotifierItem
    member={Activate,ContextMenu,Scroll,SecondaryActivate,ProvideXdgActivationToken,XAyatanaSecondaryActivate}
    peer=(label="{plasmashell,unconfined}"),

dbus (send)
    bus=session
    path=/{StatusNotifierItem/menu,org/ayatana/NotificationItem/*/Menu}
    interface=com.canonical.dbusmenu
    member="{LayoutUpdated,ItemsPropertiesUpdated}"
    peer=(name=org.freedesktop.DBus, label="{plasmashell,unconfined}"),

dbus (receive)
    bus=session
    path=/{StatusNotifierItem,StatusNotifierItem/menu,org/ayatana/NotificationItem/**}
    interface={org.freedesktop.DBus.Properties,com.canonical.dbusmenu}
    member={Get*,AboutTo*,Event*}
    peer=(label="{plasmashell,unconfined}"),

# notifications
dbus (send)
    bus=session
    path=/org/freedesktop/Notifications
    interface=org.freedesktop.Notifications
    member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
    peer=(label=unconfined),

dbus (receive)
    bus=session
    path=/org/freedesktop/Notifications
    interface=org.freedesktop.Notifications
    member={ActionInvoked,NotificationClosed,NotificationReplied}
    peer=(label=unconfined),

# KDE Plasma's Inhibited property indicating "do not disturb" mode
# https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
dbus (send)
    bus=session
    path=/org/freedesktop/Notifications
    interface=org.freedesktop.DBus.Properties
    member="Get{,All}"
    peer=(label=unconfined),

dbus (receive)
    bus=session
    path=/org/freedesktop/Notifications
    interface=org.freedesktop.DBus.Properties
    member=PropertiesChanged
    peer=(label=unconfined),

dbus (send)
    bus=session
    path=/org/ayatana/NotificationItem/*
    interface=org.kde.StatusNotifierItem
    member=XAyatanaNew*
    peer=(name=org.freedesktop.DBus, label="{plasmashell,unconfined}"),

# Description: Can access global gsettings of the user's session. Restricted
# because this gives privileged access to sensitive information stored in
# gsettings and allows adjusting settings of other applications. Future GLib
# will not require plugging the interface and will instead probe if running
# under confinement and use a private data store in $SNAP_USER_DATA).

#include <abstractions/dbus-session-strict>

#include <abstractions/dconf>
owner /{,var/}run/user/*/dconf/user w,
owner @{HOME}/.config/dconf/user w,
dbus (receive, send)
    bus=session
    interface="ca.desrt.dconf.Writer"
    peer=(label=unconfined),

# Description: Can access opengl.

# specific gl libs
/var/lib/snapd/lib/gl{,32}/ r,
/var/lib/snapd/lib/gl{,32}/** rm,

# libdrm data files
/usr/share/libdrm/amdgpu.ids r,

# The nvidia container toolkit needs to traverse the top level libs directory
# in order to discover the libraries and generate a CDI config
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/} r,
# Bi-arch distribution nvidia support
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcuda*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvidia*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvoptix*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}tls/libnvidia*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvcuvid.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}lib{GL,GLESv1_CM,GLESv2,EGL}*nvidia.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libGLdispatch.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}vdpau/libvdpau_nvidia.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnv{rm,dc,imp,os}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}gbm/nvidia-drm_gbm.so{,.*} rm,

# CUDA libs
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnpp{c,ig,ial,icc,idei,ist,if,im,itc}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcublas{,Lt}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcufft.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcusolver.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcuparse.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcurand.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcudnn{,_adv_infer,_adv_train,_cnn_infer,_cnn_train,_ops_infer,_ops_train}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvrtc{,-builtins}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvToolsExt.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}nvidia/wine/*.dll rm,

# Support reading the Vulkan ICD files
/var/lib/snapd/lib/vulkan/ r,
/var/lib/snapd/lib/vulkan/** r,
/var/lib/snapd/hostfs/usr/share/vulkan/icd.d/*nvidia*.json r,

# Support reading the GLVND EGL vendor files
/var/lib/snapd/lib/glvnd/ r,
/var/lib/snapd/lib/glvnd/** r,
/var/lib/snapd/hostfs/usr/share/glvnd/egl_vendor.d/ r,
/var/lib/snapd/hostfs/usr/share/glvnd/egl_vendor.d/*nvidia*.json r,

# Support Nvidia EGL external platform
/var/lib/snapd/hostfs/usr/share/egl/egl_external_platform.d/ r,
/var/lib/snapd/hostfs/usr/share/egl/egl_external_platform.d/*nvidia*.json r,

# Main bi-arch GL libraries
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}{,nvidia*/}lib{OpenGL,GL,GLU,GLESv1_CM,GLESv2,EGL,GLX}.so{,.*} rm,

# Allow access to all cards since a) this is common on hybrid systems, b) ARM
# devices commonly have two devices (such as on the Raspberry Pi 4, one for KMS
# and another that does not) and c) there is nothing saying that /dev/dri/card0
# is the default card or the application is currently using.
/dev/dri/ r,
/dev/dri/card[0-9]* rw,

# nvidia
/etc/vdpau_wrapper.cfg r,
@{PROC}/driver/nvidia/params r,
@{PROC}/driver/nvidia/gpus/*/information r,
@{PROC}/driver/nvidia/capabilities/mig/monitor r,
@{PROC}/modules r,
/dev/nvidia* rw,
unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"),
# A socketpair with the NVIDIA DDX is needed for GLX.
# When Xorg is not confined, then a special-case object delegation allows this automatically.
# When Xorg is confined, object delegation is not implemented yet and we need a rule on our side to allow this.
unix (send, receive) type=stream peer=(label="Xorg"),
# driver profiles
/usr/share/nvidia/ r,
/usr/share/nvidia/** r,

# VideoCore/EGL (shared device with VideoCore camera)
/dev/vchiq rw,
# VideoCore Video decoding (required for accelerated MMAL video playback)
/dev/vcsm-cma rw,

# va-api
/dev/dri/renderD[0-9]* rw,

# intel
@{PROC}/sys/dev/i915/perf_stream_paranoid r,

# cuda
@{PROC}/sys/vm/mmap_min_addr r,
@{PROC}/devices r,
/sys/devices/system/memory/block_size_bytes r,
/sys/module/tegra_fuse/parameters/tegra_* r,
unix (bind,listen) type=seqpacket addr="@cuda-uvmfd-[0-9a-f]*",
/{dev,run}/shm/cuda.* rw,
/dev/nvhost-* rw,
/dev/nvmap rw,

# Tegra display driver
/dev/tegra_dc_ctrl rw,
/dev/tegra_dc_[0-9]* rw,

# Xilinx zocl DRM driver
# https://github.com/Xilinx/XRT/tree/master/src/runtime_src/core/edge/drm
/sys/devices/platform/amba{,_pl@[0-9]*}/amba{,_pl@[0-9]*}:zyxclmm_drm/* r,

# Imagination PowerVR driver
/dev/pvr_sync rw,

# ARM Mali driver
/dev/mali[0-9]* rw,
/dev/dma_buf_te rw,
/dev/dma_heap/linux,cma rw,
/dev/dma_heap/system rw,

# NXP i.MX driver
# https://github.com/Freescale/kernel-module-imx-gpu-viv
/dev/galcore rw,

# OpenCL ICD files
/etc/OpenCL/vendors/ r,
/etc/OpenCL/vendors/** r,

# Parallels guest tools 3D acceleration (video toolgate)
@{PROC}/driver/prl_vtg rw,

# /sys/devices
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/config r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/revision r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/resource r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/irq r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/boot_vga r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}class r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}device r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}vendor r,
/sys/devices/**/drm{,_dp_aux_dev}/** r,

# FIXME: this is an information leak and snapd should instead query udev for
# the specific accesses associated with the above devices.
/sys/bus/pci/devices/ r,
/sys/bus/platform/devices/soc:gpu/ r,
/run/udev/data/+drm:card* r,
/run/udev/data/+pci:[0-9a-f]* r,
/run/udev/data/+platform:soc:gpu* r,

# FIXME: for each device in /dev that this policy references, lookup the
# device type, major and minor and create rules of this form:
# /run/udev/data/<type><major>:<minor> r,
# For now, allow 'c'haracter devices and 'b'lock devices based on
# https://www.kernel.org/doc/Documentation/devices.txt
/run/udev/data/c226:[0-9]* r,  # 226 drm

# From https://bugs.launchpad.net/snapd/+bug/1862832
/run/nvidia-xdriver-* rw,
unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"),

/dev/nvgpu/igpu[0-9]*/power rw,
/dev/nvgpu/igpu[0-9]*/ctrl rw,
/dev/nvgpu/igpu[0-9]*/prof rw,
/dev/host1x-fence rw,

# Kernel Fusion Driver for AMD GPUs
/dev/kfd rw,
/sys/module/amdgpu/initstate r,
/sys/devices/virtual/kfd/kfd/dev r,
/sys/devices/virtual/kfd/kfd/uevent r,
/sys/devices/virtual/kfd/kfd/topology/{,generation_id,system_properties} r,
/sys/devices/virtual/kfd/kfd/topology/nodes/[0-9]*/{,gpu_id,properties,io_links/[0-9]*/properties,caches/[0-9]*/properties,mem_banks/[0-9]*/properties} r,

# Description: Can access specific system files or directories.
# This is restricted because it gives file access to arbitrary locations.
"/var/lib/snapd/hostfs/usr/share/applications{,/,/**}" rk,

# Description: Can access the X server. Restricted because X does not prevent
# eavesdropping or apps interfering with one another.

# The X abstraction doesn't check the peer label, but in this case that's
# ok because x11ConnectedSlotAppArmor will limit which clients can connect
# to the slot implementation.
#include <abstractions/X>
#include <abstractions/fonts>
owner @{HOME}/.local/share/fonts/{,**} r,
/var/cache/fontconfig/   r,
/var/cache/fontconfig/** mr,

# Allow access to the user specific copy of the xauth file specified
# in the XAUTHORITY environment variable, that "snap run" creates on
# startup.
owner /run/user/[0-9]*/.Xauthority r,

# Allow reading an Xwayland Xauth file
# (see https://gitlab.gnome.org/GNOME/mutter/merge_requests/626)
owner /run/user/[0-9]*/.mutter-Xwaylandauth.* r,
owner /run/user/[0-9]*/mutter/Xauthority r,

# Allow reading KDE Plasma's Xwayland Xauth file
owner /run/user/[0-9]*/xauth_* r,

# Needed by QtSystems on X to detect mouse and keyboard. Note, the 'netlink
# raw' rule is not finely mediated by apparmor so we mediate with seccomp arg
# filtering.
network netlink raw,
/run/udev/data/c13:[0-9]* r,
/run/udev/data/+input:* r,

# Deny access to ICE granted by abstractions/X
# See: https://bugs.launchpad.net/snapd/+bug/1901489
deny owner @{HOME}/.ICEauthority r,
deny owner /run/user/*/ICEauthority r,
deny unix (connect, receive, send)
    type=stream
    peer=(addr="@/tmp/.ICE-unix/[0-9]*"),

# Description: Can access the network as a client.
#include <abstractions/nameservice>
/run/systemd/resolve/stub-resolv.conf rk,
/etc/mdns.allow r,     # not yet included in the mdns abstraction
network netlink dgram, # not yet included in the nameservice abstraction

# systemd-resolved (not yet included in nameservice abstraction)
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
#   https://www.freedesktop.org/wiki/Software/systemd/resolved/
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
#   https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
#include <abstractions/dbus-strict>
dbus send
     bus=system
     path="/org/freedesktop/resolve1"
     interface="org.freedesktop.resolve1.Manager"
     member="Resolve{Address,Hostname,Record,Service}"
     peer=(name="org.freedesktop.resolve1"),

# libnss-systemd (D-Bus portion from nameservice abstraction)
# Also allow lookups for systemd-exec's DynamicUsers via D-Bus
#   https://www.freedesktop.org/software/systemd/man/systemd.exec.html
dbus send
     bus=system
     path="/org/freedesktop/systemd1"
     interface="org.freedesktop.systemd1.Manager"
     member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
     peer=(name="org.freedesktop.systemd1"),

#include <abstractions/ssl_certs>

@{PROC}/sys/net/core/somaxconn r,
@{PROC}/sys/net/ipv4/tcp_fastopen r,

# Allow using netcat as client
/{,usr/}bin/nc{,.openbsd} ixr,

# Description: Can manage snaps via snapd.

/run/snapd.socket rw,

# Description: Can query UPower for power devices, history and statistics.

#include <abstractions/dbus-strict>

# Find all devices monitored by UPower
dbus (send)
    bus=system
    path=/org/freedesktop/UPower
    interface=org.freedesktop.UPower
    member=EnumerateDevices
    peer=(label=unconfined),

# Read all properties from UPower and devices
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
    bus=system
    path=/org/freedesktop/UPower{,/Wakeups,/devices/**}
    interface=org.freedesktop.DBus.Properties
    member=Get{,All},

dbus (send)
    bus=system
    path=/org/freedesktop/UPower
    interface=org.freedesktop.UPower
    member=GetCriticalAction
    peer=(label=unconfined),

dbus (send)
    bus=system
    path=/org/freedesktop/UPower
    interface=org.freedesktop.UPower
    member=GetDisplayDevice
    peer=(label=unconfined),

dbus (send)
    bus=system
    path=/org/freedesktop/UPower/devices/**
    interface=org.freedesktop.UPower.Device
    member={GetHistory,Refresh}
    peer=(label=unconfined),

# Receive property changed events
dbus (receive)
    bus=system
    path=/org/freedesktop/UPower{,/devices/**}
    interface=org.freedesktop.DBus.Properties
    member=PropertiesChanged
    peer=(label=unconfined),

# Allow clients to introspect the service
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
    bus=system
    interface=org.freedesktop.DBus.Introspectable
    path=/org/freedesktop/UPower
    member=Introspect,

# Description: Can query system status information. This is restricted because
# it gives privileged read access to all processes on the system and should
# only be used with trusted apps.

# Needed by 'ps'
@{PROC}/tty/drivers r,

# This ptrace is an information leak. Intentionlly omit 'ptrace (trace)' here
# since since ps doesn't actually need to trace other processes. Note this
# allows a number of accesses (assuming the associated /proc file is allowed),
# such as various memory address locations and esp/eip via /proc/*/stat,
# /proc/*/mem, /proc/*/personality, /proc/*/stack, /proc/*/syscall,
# /proc/*/timerslack_ns and /proc/*/wchan (see man proc).
#
# Some files like /proc/kallsyms (but anything using %pK format specifier) need
# 'capability syslog' when /proc/sys/kernel/kptr_restrict=1, but we
# intentionally do not allow since it could be used to defeat KASLR.
ptrace (read),

# Other miscellaneous accesses for observing the system
@{PROC}/cgroups r,
@{PROC}/buddyinfo r,
@{PROC}/locks r,
@{PROC}/modules r,
@{PROC}/mdstat r,
@{PROC}/schedstat r,
@{PROC}/slabinfo r,
@{PROC}/softirqs r,
@{PROC}/stat r,
@{PROC}/vmstat r,
@{PROC}/zoneinfo r,
@{PROC}/diskstats r,
@{PROC}/kallsyms r,
@{PROC}/partitions r,
@{PROC}/pressure/cpu r,
@{PROC}/pressure/io r,
@{PROC}/pressure/memory r,
@{PROC}/sys/kernel/panic r,
@{PROC}/sys/kernel/panic_on_oops r,
@{PROC}/sys/kernel/random/poolsize r,
@{PROC}/sys/kernel/random/urandom_min_reseed_secs r,
@{PROC}/sys/kernel/random/write_wakeup_threshold r,
@{PROC}/sys/kernel/sched_autogroup_enabled r,
@{PROC}/sys/kernel/threads-max r,
@{PROC}/sys/vm/max_map_count r,
@{PROC}/sys/vm/panic_on_oom r,
@{PROC}/sys/vm/swappiness r,

# These are not process-specific (/proc/*/... and /proc/*/task/*/...)
@{PROC}/*/{,task/,task/*/} r,
@{PROC}/*/{,task/*/}autogroup r,
@{PROC}/*/{,task/*/}auxv r,
@{PROC}/*/{,task/*/}cgroup r,
@{PROC}/*/{,task/*/}cmdline r,
@{PROC}/*/{,task/*/}comm r,
@{PROC}/*/{,task/*/}exe r,
@{PROC}/*/{,task/*/}fdinfo/* r,
@{PROC}/*/{,task/*/}io r,
@{PROC}/*/{,task/*/}oom_score r,
# allow reading of smaps_rollup, which is a summary of the memory use of a process,
# but not smaps which contains a detailed mappings breakdown like
# /proc/self/maps, which we do not allow access to for other processes
@{PROC}/*/{,task/*/}smaps_rollup r,
@{PROC}/*/{,task/*/}schedstat r,
@{PROC}/*/{,task/*/}stat r,
@{PROC}/*/{,task/*/}statm r,
@{PROC}/*/{,task/*/}status r,
@{PROC}/*/{,task/*/}wchan r,

# Allow reading processes security label
@{PROC}/*/{,task/*/}attr/{,apparmor/}current r,

# Allow discovering the os-release of the host
/var/lib/snapd/hostfs/etc/os-release rk,
/var/lib/snapd/hostfs/usr/lib/os-release rk,

# Allow discovering the Kernel build config
@{PROC}/config.gz r,
/boot/config* r,

# Allow discovering system-wide CFS Bandwidth Control information
# https://www.kernel.org/doc/html/latest/scheduler/sched-bwc.html
/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us r,
/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
/sys/fs/cgroup/cpu,cpuacct/cpu.shares r,
/sys/fs/cgroup/cpu,cpuacct/cpu.stat r,
/sys/fs/cgroup/memory/memory.stat r,

# Allow reading the system max CPU resource constraints
/sys/fs/cgroup/system.slice/cpu.max r,

#include <abstractions/dbus-strict>

# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
    bus=system
    path=/org/freedesktop/hostname1
    interface=org.freedesktop.DBus.Properties
    member=Get{,All},

# Allow clients to introspect hostname1
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
    bus=system
    path=/org/freedesktop/hostname1
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect,

# Allow clients to enumerate DBus connection names on common buses
dbus (send)
    bus={session,system}
    path={/,/org/freedesktop/DBus}
    interface=org.freedesktop.DBus
    member={ListNames,ListActivatableNames}
    peer=(label=unconfined),

# Allow clients to obtain the DBus machine ID on common buses. We do not
# mediate the path since any peer can be used.
dbus (send)
    bus={session,system}
    interface=org.freedesktop.DBus.Peer
    member=GetMachineId
    peer=(label=unconfined),

# Allow clients to get properties of systemd (the manager) and
# units
dbus (send)
    bus=system
    interface=org.freedesktop.DBus.Properties
    path=/org/freedesktop/systemd1{,/**}
    member=Get{,All}
    peer=(label=unconfined),

# Allow clients to explicitly list units with some of their details (path,
# status) and get unit path, see
# https://www.freedesktop.org/wiki/Software/systemd/dbus/ for details
dbus (send)
    bus=system
    path=/org/freedesktop/systemd1
    interface=org.freedesktop.systemd1.Manager
    member={GetUnit,ListUnits}
    peer=(label=unconfined),

# Allow reading if protected hardlinks are enabled, but don't allow enabling or
# disabling them
@{PROC}/sys/fs/protected_hardlinks r,
@{PROC}/sys/fs/protected_symlinks r,
@{PROC}/sys/fs/protected_fifos r,
@{PROC}/sys/fs/protected_regular r,

# Description: allow access to network connectivity status

#include <abstractions/dbus-session-strict>

# Allow access to xdg-desktop-portal NetworkMonitor methods and signals
dbus (send, receive)
    bus=session
    interface=org.freedesktop.portal.NetworkMonitor
    path=/org/freedesktop/portal/desktop
    peer=(label=unconfined),

# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gnome-42-2204/226/**" mrkix,

# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gtk-common-themes/1535/share/icons/default/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Adwaita/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/hicolor/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/HighContrast/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Humanity/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Humanity-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/ubuntu-mono-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/ubuntu-mono-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/DMZ-Black/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/DMZ-White/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-bark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-blue/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-magenta/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-olive/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-purple/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-red/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-sage/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-viridian/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-bark-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-blue-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-magenta-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-olive-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-purple-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-red-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-sage-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-viridian-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Ambiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Radiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-MATE-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-MATE-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-mate/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-mate-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Nokto-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Dark-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Light-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/breeze_cursors/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Breeze_Snow/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-darker/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-darkest/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/handhelds/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/redglass/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/whiteglass/**" mrkix,

# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gtk-common-themes/1535/share/sounds/Yaru/**" mrkix,
"/snap/gtk-common-themes/1535/share/sounds/freedesktop/**" mrkix,

# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gtk-common-themes/1535/share/themes/Adwaita/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Adwaita-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/HighContrast/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Ambiance/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Radiance/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Arc/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Arc-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Arc-Darker/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Breeze/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Breeze-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-bark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-blue/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-olive/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-purple/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-red/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-sage/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-red-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/elementary/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Ambiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Ambiant-MATE-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Radiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-mate/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-aliz/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-azul/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-aliz/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-azul/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-sea/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-sea/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Greybird/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Greybird-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-compact/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-dark-compact/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-light-compact/**" mrkix,

# allow unconfined clients to introspect us on classic
dbus (receive)
    bus=session
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect
    peer=(label=unconfined),

# allow us to respond to unconfined clients via "io.snapcraft.Store{,.*}"
# on classic (send should be handled via another snappy interface).
dbus (receive)
    bus=session
    interface="io.snapcraft.Store{,.*}"
    peer=(label=unconfined),

# allow us to respond to unconfined clients via "/io/snapcraft/Store{,/**}" (eg,
# org.freedesktop.*, org.gtk.Application, etc) on classic (send should be
# handled via another snappy interface).
dbus (receive)
    bus=session
    path="/io/snapcraft/Store{,/**}"
    peer=(label=unconfined),

# allow unconfined clients to introspect us on classic
dbus (receive)
    bus=session
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect
    peer=(label=unconfined),

# allow us to respond to unconfined clients via "org.freedesktop.PackageKit{,.*}"
# on classic (send should be handled via another snappy interface).
dbus (receive)
    bus=session
    interface="org.freedesktop.PackageKit{,.*}"
    peer=(label=unconfined),

# allow us to respond to unconfined clients via "/org/freedesktop/PackageKit{,/**}" (eg,
# org.freedesktop.*, org.gtk.Application, etc) on classic (send should be
# handled via another snappy interface).
dbus (receive)
    bus=session
    path="/org/freedesktop/PackageKit{,/**}"
    peer=(label=unconfined),

# subset of gnome abstraction
/etc/gtk-3.0/settings.ini r,
owner @{HOME}/.config/gtk-3.0/settings.ini r,
owner @{HOME}/.config/gtk-3.0/*.css r,
# Note: this leaks directory names that wouldn't otherwise be known to the snap
owner @{HOME}/.config/gtk-3.0/bookmarks r,

# kde theming support
owner @{HOME}/.config/kdeglobals r,

/usr/share/icons/                          r,
/usr/share/icons/**                        r,
/usr/share/icons/*/index.theme             rk,
/usr/share/pixmaps/                        r,
/usr/share/pixmaps/**                      r,
/usr/share/unity/icons/**                  r,
/usr/share/thumbnailer/icons/**            r,
/usr/share/themes/**                       r,

# The snapcraft desktop part may look for schema files in various locations, so
# allow reading system installed schemas.
/usr/share/glib*/schemas/{,*}              r,
/usr/share/gnome/glib*/schemas/{,*}        r,
/usr/share/ubuntu/glib*/schemas/{,*}       r,

# subset of freedesktop.org
owner @{HOME}/.local/share/mime/**   r,
owner @{HOME}/.config/user-dirs.* r,

/etc/xdg/user-dirs.conf r,
/etc/xdg/user-dirs.defaults r,

# gmenu
dbus (send)
     bus=session
     interface=org.gtk.Actions
     member=Changed
     peer=(label=unconfined),

dbus (receive)
    bus=session
    path=/org/freedesktop/Notifications
    interface=org.freedesktop.DBus.Properties
    member=PropertiesChanged
    peer=(label="{plasmashell,unconfined}"),

# DesktopAppInfo Launched
dbus (send)
    bus=session
    path=/org/gtk/gio/DesktopAppInfo
    interface=org.gtk.gio.DesktopAppInfo
    member=Launched
    peer=(label=unconfined),

# Allow requesting interest in receiving media key events. This tells Gnome
# settings that our application should be notified when key events we are
# interested in are pressed, and allows us to receive those events.
dbus (receive, send)
  bus=session
  interface=org.gnome.SettingsDaemon.MediaKeys
  path=/org/gnome/SettingsDaemon/MediaKeys
  peer=(label=unconfined),
dbus (send)
  bus=session
  interface=org.freedesktop.DBus.Properties
  path=/org/gnome/SettingsDaemon/MediaKeys
  member="Get{,All}"
  peer=(label=unconfined),

# Allow accessing the GNOME crypto services prompt APIs as used by
# applications using libgcr (such as pinentry-gnome3) for secure pin
# entry to unlock GPG keys etc. See:
# https://developer.gnome.org/gcr/unstable/GcrPrompt.html
# https://developer.gnome.org/gcr/unstable/GcrSecretExchange.html
dbus (send)
    bus=session
    path=/org/gnome/keyring/Prompter
    interface=org.gnome.keyring.internal.Prompter
    member="{BeginPrompting,PerformPrompt,StopPrompting}"
    peer=(label=unconfined),

# While the DBus path is not snap-specific, by the time an application
# registers the prompt path via DBus, Gcr will check that it isn't
# already in use and send the client an error if it is. See:
# https://github.com/snapcore/snapd/pull/7673#issuecomment-592229711
dbus (receive)
    bus=session
    path=/org/gnome/keyring/Prompt/p[0-9]*
    interface=org.gnome.keyring.internal.Prompter.Callback
    member="{PromptReady,PromptDone}"
    peer=(label=unconfined),

# Allow use of snapd's internal 'xdg-open'
/usr/bin/xdg-open ixr,
# While /usr/share/applications comes from the base runtime of the snap, it
# has some things that snaps actually need, so allow access to those and deny
# access to the others
/usr/share/applications/ r,
/usr/share/applications/mimeapps.list r,
/usr/share/applications/xdg-open.desktop r,
# silence noisy denials from desktop files in core* snaps that aren't usable by
# snaps
deny /usr/share/applications/python*.desktop r,
deny /usr/share/applications/vim.desktop r,
deny /usr/share/applications/snap-handle-link.desktop r,  # core16

dbus (send)
    bus=session
    path=/
    interface=com.canonical.SafeLauncher
    member=OpenURL
    peer=(label=unconfined),
# ... and this allows access to the new xdg-open service which
# is now part of snapd itself.
dbus (send)
    bus=session
    path=/io/snapcraft/Launcher
    interface=io.snapcraft.Launcher
    member={OpenURL,OpenFile}
    peer=(label=unconfined),

# Allow checking status, activating and locking the screensaver
# gnome/kde/freedesktop.org
dbus (send)
    bus=session
    path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
    interface="org.{freedesktop,gnome}.ScreenSaver"
    member="{GetActive,GetActiveTime,Lock,SetActive}"
    peer=(label=unconfined),

dbus (receive)
    bus=session
    path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
    interface="org.{freedesktop,gnome}.ScreenSaver"
    member=ActiveChanged
    peer=(label=unconfined),

# Allow unconfined to introspect us
dbus (receive)
    bus=session
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect
    peer=(label=unconfined),

# Allow use of snapd's internal 'xdg-settings'
/usr/bin/xdg-settings ixr,
dbus (send)
    bus=session
    path=/io/snapcraft/Settings
    interface=io.snapcraft.Settings
    member={Check,CheckSub,Get,GetSub,Set,SetSub}
    peer=(label=unconfined),

# These accesses are noisy and applications can't do anything with the found
# icon files, so explicitly deny to silence the denials
deny /var/lib/snapd/desktop/icons/{,**/} r,

# These accesses occur when flatpaks are on the system since it updates
# XDG_DATA_DIRS to contain $HOME/.local/share/flatpak/exports/share. Until
# we have better XDG_DATA_DIRS handling, silence these noisy denials.
# https://github.com/snapcrafters/discord/issues/23#issuecomment-637607843
deny @{HOME}/.local/share/flatpak/exports/share/** r,

# Allow access to the IBus portal (IBUS_USE_PORTAL=1)
dbus (send)
      bus=session
      path=/org/freedesktop/IBus
      interface=org.freedesktop.IBus.Portal
      member=CreateInputContext
      peer=(name=org.freedesktop.portal.IBus),

dbus (send, receive)
      bus=session
      path=/org/freedesktop/IBus/InputContext_[0-9]*
      interface=org.freedesktop.IBus.InputContext
      peer=(label=unconfined),

# Allow access to the Fcitx portal, supported by fcitx/fcitx5
dbus (send)
      bus=session
      path=/{,org/freedesktop/portal/}inputmethod
      interface=org.fcitx.Fcitx.InputMethod1
      member={CreateInputContext,Version}
      peer=(name=org.freedesktop.portal.Fcitx),

dbus (send, receive)
      bus=session
      path=/{,org/freedesktop/portal/}inputcontext/**
      interface=org.fcitx.Fcitx.InputContext1
      peer=(label=unconfined),

# Layout path: /etc/PackageKit
"/etc/PackageKit{,/**}" mrwklix,
# Layout path: /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0
"/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0{,/**}" mrwklix,
# Layout path: /usr/lib/x86_64-linux-gnu/webkit2gtk-4.1
"/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1{,/**}" mrwklix,
# Layout path: /usr/pkg/share/xml/iso-codes
# (no extra permissions required for symlink)
# Layout path: /usr/share/libdrm
"/usr/share/libdrm{,/**}" mrwklix,
# Layout path: /usr/share/xml/iso-codes
"/usr/share/xml/iso-codes{,/**}" mrwklix,
# Support applications which use the unity messaging menu, xdg-mime, etc
# This leaks the names of snaps with desktop files
/var/lib/snapd/desktop/applications/ r,
# Allowing reading only our desktop files (required by (at least) the unity
# messaging menu).
# parallel-installs: this leaks read access to desktop files owned by keyed
# instances of @{SNAP_NAME} to @{SNAP_NAME} snap
/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,
# Explicitly deny access to other snap's desktop files
deny /var/lib/snapd/desktop/applications/[^s]**.desktop r,
deny /var/lib/snapd/desktop/applications/s[^n]**.desktop r,
deny /var/lib/snapd/desktop/applications/sn[^a]**.desktop r,
deny /var/lib/snapd/desktop/applications/sna[^p]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap[^-]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-[^s]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-s[^t]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-st[^o]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-sto[^r]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-stor[^e]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store[^_]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_[^su]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{s[^n],u[^b]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{sn[^a],ub[^u]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{sna[^p],ubu[^n]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{snap[^-],ubun[^t]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{snap-[^s],ubunt[^u]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{snap-s[^t],ubuntu[^-]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{snap-st[^o],ubuntu-[^s]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{snap-sto[^r],ubuntu-s[^o]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_{snap-stor[^e],ubuntu-so[^f]}**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-sof[^t]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-soft[^w]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-softw[^a]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-softwa[^r]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-softwar[^e]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software[^-]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-[^l]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-l[^o]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-lo[^c]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-loc[^a]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-loca[^l]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-local[^-]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-local-[^f]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-local-f[^i]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-local-fi[^l]**.desktop r,
deny /var/lib/snapd/desktop/applications/snap-store_ubuntu-software-local-fil[^e]**.desktop r,

# While commands like 'ps', 'ip netns identify <pid>', 'ip netns pids foo', etc
# trigger a 'ptrace (trace)' denial, they aren't actually tracing other
# processes. Unfortunately, the kernel overloads trace such that the LSMs are
# unable to distinguish between tracing other processes and other accesses.
# ptrace (trace) can be used to break out of the seccomp sandbox unless the
# kernel has 93e35efb8de45393cf61ed07f7b407629bf698ea (in 4.8+). Until snapd
# has full ptrace support conditional on kernel support, explicitly deny to
# silence noisy denials/avoid confusion and accidentally giving away this
# dangerous access frivolously.
deny ptrace (trace),
deny capability sys_ptrace,

}

${this.title}

Code Editor : snap.snap-store.ubuntu-software-local-file