apparmor.d/apparmor.d/profiles-a-f/downloadhelper

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = /opt/net.downloadhelper.coapp/bin/net.downloadhelper.coapp-*
profile downloadhelper @{exec_path} {
  include <abstractions/base>
  include <abstractions/nameservice-strict>
  include <abstractions/user-download-strict>

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink raw,

  @{exec_path} mr,

  @{bin}/ffmpeg rix,

  /opt/ r,
  /opt/net.downloadhelper.coapp/ r,
  /opt/net.downloadhelper.coapp/bin/ r,
  /opt/net.downloadhelper.coapp/converter/build/** rix,

  owner @{HOME}/.mozilla/firefox/[0-9a-z]*.*/.parentlock rw,
  owner @{HOME}/.mozilla/firefox/[0-9a-z]*.*/extensions/* r,
  owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/startupCache/scriptCache-*.bin r,
  owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/startupCache/startupCache.*.little r,
  owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/safebrowsing-updating/google@{int}/goog-phish-proto-@{int}.vlpset rw,

  owner /tmp/vdh-*.tmp rw,

  @{sys}/devices/system/node/ r,
  @{sys}/devices/system/node/node@{int}/meminfo r,

  deny @{PROC}/version r,
  deny @{user_share_dirs}/gvfs-metadata/* r,

  include if exists <local/downloadhelper>
}