feat(profiles): a the XDG_IMG_DIR and user_img_dirs variables

apparmor.d/groups/gvfs/gvfsd-archive

@@ -19,9 +19,7 @@ profile gvfsd-archive @{exec_path} {
   owner @{MOUNTS}/**.{TAR,TAR.GZ,ZIP} r,
   owner @{HOME}/**.{tar,tar.gz,zip} r,
 
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} r,
+  owner @{user_img_dirs}/{,**} r,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
 
   include if exists <local/gvfsd-archive>
 }

apparmor.d/profiles-a-f/blkid

@@ -19,23 +19,21 @@ profile blkid @{exec_path} {
 
   /etc/blkid.conf r,
 
+  # When the system doesn't have the /run/ dir, the cache file is placed under /etc/
+  @{etc_rw}/blkid.tab{,-*} rw,
+  @{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab,
+
+  # Image files
+  @{user_img_dirs}/{,**} r,
+
   # The standard location of the cache file
   # Without owner here if this tool should be used as a regular user
   @{run}/blkid/ rw,
   @{run}/blkid/blkid.tab{,-*} rw,
   @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
-  # When the system doesn't have the /run/ dir, the cache file is placed under /etc/
-  @{etc_rw}/blkid.tab{,-*} rw,
-  @{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab,
 
   # For the EVALUATE=scan method
   @{PROC}/partitions r,
 
-  # Image files
-  @{HOME}/**.{iso,img,bin,mdf,nrg} r,
-  @{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
-  @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
-  @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} r,
-
   include if exists <local/blkid>
 }

apparmor.d/profiles-a-f/btrfs

@@ -33,10 +33,7 @@ profile btrfs @{exec_path} {
   @{MOUNTS}/*/ext2_saved/image rw,
 
   # To be able to manage btrfs volumes
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   # For fsck of the btrfs filesystem directly from gparted
   owner /tmp/gparted-*/ rw,

apparmor.d/profiles-a-f/btrfs-find-root

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -14,10 +15,7 @@ profile btrfs-find-root @{exec_path} {
   @{exec_path} mr,
 
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   include if exists <local/btrfs-find-root>
 }

apparmor.d/profiles-a-f/btrfs-image

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -13,13 +14,10 @@ profile btrfs-image @{exec_path} {
 
   @{exec_path} mr,
 
-  owner @{PROC}/@{pid}/mounts r,
-
   # Image files
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
+
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
+  owner @{PROC}/@{pid}/mounts r,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   include if exists <local/btrfs-image>
 }

apparmor.d/profiles-a-f/btrfs-map-logical

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -14,10 +15,7 @@ profile btrfs-map-logical @{exec_path} {
   @{exec_path} mr,
 
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   include if exists <local/btrfs-map-logical>
 }

apparmor.d/profiles-a-f/cfdisk

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -15,23 +16,20 @@ profile cfdisk @{exec_path} {
 
   @{exec_path} mr,
 
-  owner @{PROC}/@{pid}/mountinfo r,
-        @{PROC}/partitions r,
-
   /etc/fstab r,
 
-  owner @{run}/blkid/blkid.tab{,-*} rw,
-  owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
-
-  # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   # A place for backups
   owner @{HOME}/**.{bak,back} rwk,
   owner @{MOUNTS}/**.{bak,back} rwk,
 
+  # A place for file images
+  owner @{user_img_dirs}/{,**} rwk,
+
+  owner @{run}/blkid/blkid.tab{,-*} rw,
+  owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
+
+        @{PROC}/partitions r,
+  owner @{PROC}/@{pid}/mountinfo r,
+
   include if exists <local/cfdisk>
 }

apparmor.d/profiles-a-f/cgdisk

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -16,10 +17,7 @@ profile cgdisk @{exec_path} {
   @{exec_path} mr,
 
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   # A place for backups
   owner @{HOME}/**.{bak,back} rwk,

apparmor.d/profiles-a-f/dumpe2fs

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2018-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -14,14 +15,11 @@ profile dumpe2fs @{exec_path} {
 
   @{exec_path} mr,
 
+  # Image files
+  owner @{user_img_dirs}/{,**} r,
+
   owner @{run}/blkid/blkid.tab{,-*} rw,
   owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
 
-  # Image files
-  @{HOME}/**.{iso,img,bin,mdf,nrg} r,
-  @{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
-  @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
-  @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} r,
-
   include if exists <local/dumpe2fs>
 }

apparmor.d/profiles-a-f/e2fsck

@@ -25,10 +25,7 @@ profile e2fsck @{exec_path} {
   /usr/share/file/misc/magic.mgc r,
 
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
         @{run}/blkid/ rw,
   owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,

apparmor.d/profiles-a-f/e2image

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -14,14 +15,11 @@ profile e2image @{exec_path} {
 
   @{exec_path} mr,
 
+  # A place for the metadata image file
+  owner @{user_img_dirs}/{,**} rwk,
+
         @{PROC}/swaps r,
   owner @{PROC}/@{pid}/mounts r,
 
-  # A place for the metadata image file
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   include if exists <local/e2image>
 }

apparmor.d/profiles-a-f/fdisk

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -21,19 +22,16 @@ profile fdisk @{exec_path} {
 
   @{exec_path} mr,
 
-  @{PROC}/partitions r,
-
   /etc/terminal-colors.d/fdisk.disable r,
 
-  # For disk images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   # For backups
   owner @{HOME}/**.{bak,back} rwk,
   owner @{MOUNTS}/**.{bak,back} rwk,
 
+  # For disk images
+  owner @{user_img_dirs}/{,**} rwk,
+
+  @{PROC}/partitions r,
+
   include if exists <local/fdisk>
 }

apparmor.d/profiles-a-f/fsck-fat

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -15,10 +16,7 @@ profile fsck-fat @{exec_path} {
   @{exec_path} mr,
 
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   owner @{run}/systemd/fsck.progress rw,
 

apparmor.d/profiles-a-f/fuseiso

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2017-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -11,6 +12,11 @@ profile fuseiso @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
+  # Be able to mount ISO images
+  mount fstype=fuse.fuseiso -> @{HOME}/*/,
+  mount fstype=fuse.fuseiso -> @{HOME}/*/*/,
+  mount fstype=fuse.fuseiso -> @{HOME}/.cache/**/,
+
   @{exec_path} mr,
 
   /{usr/,}bin/fusermount{,3} rCx -> fusermount,
@@ -20,22 +26,13 @@ profile fuseiso @{exec_path} {
   owner @{HOME}/*/*/ rw,
   owner @{HOME}/.cache/**/ r,
 
-  # Be able to mount ISO images
-  mount fstype=fuse.fuseiso -> @{HOME}/*/,
-  mount fstype=fuse.fuseiso -> @{HOME}/*/*/,
-  mount fstype=fuse.fuseiso -> @{HOME}/.cache/**/,
-
-  # Image files to be mounted
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   owner @{HOME}/.mtab.fuseiso rwk,
   owner @{HOME}/.mtab.fuseiso.new rw,
 
-  /dev/fuse rw,
+  # Image files to be mounted
+  owner @{user_img_dirs}/{,**} rwk,
 
+  /dev/fuse rw,
 
   profile fusermount {
     include <abstractions/base>
@@ -46,23 +43,20 @@ profile fuseiso @{exec_path} {
 
     capability dac_read_search,
 
-    /{usr/,}bin/fusermount{,3} mr,
-
     mount fstype={fuse,fuse.fuseiso} -> @{HOME}/*/,
     mount fstype={fuse,fuse.fuseiso} -> @{HOME}/*/*/,
     mount fstype={fuse,fuse.fuseiso} -> @{HOME}/.cache/**/,
 
-    /dev/fuse rw,
+    /{usr/,}bin/fusermount{,3} mr,
 
     /etc/fuse.conf r,
 
+    # Image files to be mounted
+    owner @{user_img_dirs}/{,**} r,
+
     @{PROC}/@{pid}/mounts r,
 
-    # Image files to be mounted
+    /dev/fuse rw,
-    owner @{HOME}/**.{iso,img,bin,mdf,nrg} r,
-    owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
-    owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
-    owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} r,
 
   }
 

apparmor.d/profiles-g-l/gdisk

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -22,15 +23,12 @@ profile gdisk @{exec_path} {
 
   @{exec_path} mr,
 
-  # For disk images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   # For backups
   owner @{HOME}/**.{bak,back} rwk,
   owner @{MOUNTS}/**.{bak,back} rwk,
 
+  # For disk images
+  owner @{user_img_dirs}/{,**} rwk,
+
   include if exists <local/gdisk>
 }

apparmor.d/profiles-g-l/hdparm

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2018-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -25,14 +26,11 @@ profile hdparm @{exec_path} flags=(complain) {
 
   /etc/hdparm.conf r,
 
+  # Image files
+  owner @{user_img_dirs}/{,**} r,
+
   # for hdparm --fibmap
   @{PROC}/devices r,
 
-  # Image files
-  @{HOME}/**.{iso,img,bin,mdf,nrg} r,
-  @{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
-  @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
-  @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} r,
-
   include if exists <local/hdparm>
 }

apparmor.d/profiles-m-r/mke2fs

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -24,20 +25,17 @@ profile mke2fs @{exec_path} {
 
   /etc/mke2fs.conf r,
 
-  owner @{PROC}/@{pid}/mounts r,
-        @{PROC}/swaps r,
-
-  owner @{run}/blkid/blkid.tab{,-*} rw,
-  owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
-
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   # For virt-resize
   owner /var/tmp/.guestfs-[0-9]*/** rwk,
 
+  owner @{run}/blkid/blkid.tab{,-*} rw,
+  owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
+
+        @{PROC}/swaps r,
+  owner @{PROC}/@{pid}/mounts r,
+
   include if exists <local/mke2fs>
 }

apparmor.d/profiles-m-r/mkfs-btrfs

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -17,16 +18,13 @@ profile mkfs-btrfs @{exec_path} {
 
   /dev/btrfs-control rw,
 
+  # A place for file images
+  owner @{user_img_dirs}/{,**} rwk,
+
   @{run}/blkid/blkid.* rw,
 
-  owner @{PROC}/@{pid}/mounts r,
         @{PROC}/swaps r,
-
+  owner @{PROC}/@{pid}/mounts r,
-  # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   include if exists <local/mkfs-btrfs>
 }

apparmor.d/profiles-m-r/mkfs-fat

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -14,13 +15,10 @@ profile mkfs-fat @{exec_path} {
 
   @{exec_path} mr,
 
-  owner @{PROC}/@{pid}/mounts r,
-
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
+
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
+  owner @{PROC}/@{pid}/mounts r,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   include if exists <local/mkfs-fat>
 }

apparmor.d/profiles-m-r/mount

@@ -52,10 +52,7 @@ profile mount @{exec_path} flags=(complain) {
   /media/cdrom[0-9]/ r,
 
   # Mount iso/img files
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   owner @{run}/mount/ rw,
   owner @{run}/mount/utab{,.*} rw,

apparmor.d/profiles-m-r/mtools

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -24,10 +25,7 @@ profile mtools @{exec_path} {
   owner @{HOME}/.mtoolsrc r,
 
   # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
   /dev/shm/*/**.{iso,img,bin,mdf,nrg} rwk,
   /dev/shm/*/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 

apparmor.d/profiles-m-r/parted

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -33,21 +34,17 @@ profile parted @{exec_path} {
 
   /{usr/,}{s,}bin/dmidecode rPx,
 
-  owner @{PROC}/@{pid}/mounts r,
-        @{PROC}/swaps r,
-        @{PROC}/devices r,
-
-  /dev/mapper/ r,
-  /dev/mapper/control rw,
-
   /etc/inputrc r,
 
   # Image files
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+  owner @{user_img_dirs}/{,**} rwk,
-  owner @{MOUNTS}/*/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/*/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
+        @{PROC}/devices r,
+        @{PROC}/swaps r,
+  owner @{PROC}/@{pid}/mounts r,
+
+  /dev/mapper/ r,
+  /dev/mapper/control rw,
 
   profile udevadm {
     include <abstractions/base>
@@ -58,21 +55,18 @@ profile parted @{exec_path} {
 
     /etc/udev/udev.conf r,
 
-    owner @{PROC}/@{pid}/stat r,
-    owner @{PROC}/@{pid}/cgroup r,
-          @{PROC}/cmdline r,
-          @{PROC}/1/sched r,
-          @{PROC}/1/environ r,
           @{PROC}/1/cgroup r,
+          @{PROC}/1/environ r,
+          @{PROC}/1/sched r,
+          @{PROC}/cmdline r,
           @{PROC}/sys/kernel/osrelease r,
           @{PROC}/sys/kernel/random/boot_id r,
+    owner @{PROC}/@{pid}/cgroup r,
+    owner @{PROC}/@{pid}/stat r,
 
     # file_inherit
     include <abstractions/disks-write>  # lots of files in this abstraction get inherited
-    owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
+    owner @{user_img_dirs}/{,**} rwk,
-    owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-    owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-    owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
 
   }
 

apparmor.d/profiles-m-r/resize2fs

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -19,14 +20,11 @@ profile resize2fs @{exec_path} {
   / r,
   /.ismount-test-file rw,
 
+  # A place for file images
+  owner @{user_img_dirs}/{,**} rwk,
+
         @{PROC}/swaps r,
   owner @{PROC}/@{pid}/mounts r,
 
-  # A place for file images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   include if exists <local/resize2fs>
 }

apparmor.d/profiles-s-z/sfdisk

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -22,15 +23,12 @@ profile sfdisk @{exec_path} {
 
   @{exec_path} mr,
 
-  # For disk images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   # For backups
   owner @{HOME}/**.{bak,back} rwk,
   owner @{MOUNTS}/*/**.{bak,back} rwk,
 
+  # For disk images
+  owner @{user_img_dirs}/{,**} rwk,
+
   include if exists <local/sfdisk>
 }

apparmor.d/profiles-s-z/sgdisk

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -22,15 +23,12 @@ profile sgdisk @{exec_path} {
 
   @{exec_path} mr,
 
-  # For disk images
-  owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
-  owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-  owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
-
   # For backups
   owner @{HOME}/**.{bak,back} rwk,
   owner @{MOUNTS}/**.{bak,back} rwk,
 
+  # For disk images
+  owner @{user_img_dirs}/{,**} rwk,
+
   include if exists <local/sgdisk>
 }

apparmor.d/profiles-s-z/tune2fs

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -11,27 +12,24 @@ profile tune2fs @{exec_path} {
   include <abstractions/base>
   include <abstractions/disks-write>
   include <abstractions/nameservice-strict>
-  include <abstractions/user-download-strict>
   include <abstractions/private-files-strict>
+  include <abstractions/user-download-strict>
 
   network inet stream,
   network inet6 stream,
 
   @{exec_path} mr,
 
-  owner @{PROC}/@{pid}/mounts r,
-        @{PROC}/swaps r,
-
   /.ismount-test-file rw,
 
+  # Image files
+  owner @{user_img_dirs}/{,**} rw,
+
   owner @{run}/blkid/blkid.tab{,-*} rw,
   owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
 
-  # Image files
+        @{PROC}/swaps r,
-  @{HOME}/**.{iso,img,bin,mdf,nrg} rw,
+  owner @{PROC}/@{pid}/mounts r,
-  @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rw,
-  @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rw,
-  @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rw,
 
   include if exists <local/tune2fs>
 }

apparmor.d/profiles-s-z/virt-manager

@@ -72,10 +72,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
 
   # For disk images
   @{MOUNTS}/ r,
-  @{HOME}/**.{iso,img,bin,mdf,nrg} r,
+  @{user_img_dirs}/{,**} r,
-  @{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
-  @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
-  @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} r,
 
   # System VM images
   /var/lib/libvirt/images/{,**} rw,

apparmor.d/tunables/xdg-user-dirs

@@ -30,6 +30,7 @@
 @{XDG_GAMES_DIR}=".games"
 @{XDG_VM_DIR}=".vm"
 @{XDG_WALLPAPERS_DIR}="@{XDG_PICTURES_DIR}/Wallpapers"
+@{XDG_IMG_DIR}="images"
 
 # User personal keyrings
 @{XDG_SSH_DIR}=".ssh"
@@ -55,6 +56,7 @@
 @{user_build_dirs}="/tmp/"
 @{user_pkg_dirs}="/tmp/pkg/"
 @{user_tmp_dirs}=@{run}/user/@{uid} /tmp/
+@{user_img_dirs}=@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}
 
 # Other user directories
 @{user_books_dirs}=@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}

docs/variables.md

@@ -23,6 +23,7 @@ title: Variables References
 | Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` |
 | Vm | `@{XDG_VM_DIR}` | `.vm`
 | Wallpapers | `@{XDG_WALLPAPERS_DIR}` | `@{XDG_PICTURES_DIR}/Wallpapers` |
+| Disk images | `@{XDG_IMG_DIR}` | `images` |
 
 ### Dotfiles
 
@@ -67,6 +68,7 @@ title: Variables References
 | Videos | `@{user_videos_dirs}` | `@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR}` |
 | Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}`
 | Password | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` |
+| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` |
 
 
 ## System variables