From f1b01d03cda1610b8cb3215df5b006299b8f1247 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Mon, 4 Mar 2024 12:54:39 +0000
Subject: [PATCH] feat(profile): add gnome-desktop-thumbnailers.

---
 .../groups/gnome/gnome-desktop-thumbnailers   | 30 +++++++++++++++++++
 apparmor.d/groups/gnome/nautilus              |  2 +-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 apparmor.d/groups/gnome/gnome-desktop-thumbnailers

diff --git a/apparmor.d/groups/gnome/gnome-desktop-thumbnailers b/apparmor.d/groups/gnome/gnome-desktop-thumbnailers
new file mode 100644
index 00000000..73b81b85
--- /dev/null
+++ b/apparmor.d/groups/gnome/gnome-desktop-thumbnailers
@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile gnome-desktop-thumbnailers flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/bwrap>
+  include <abstractions/gnome-strict>
+  include <abstractions/gstreamer>
+
+  capability dac_override,
+
+  @{bin}/bwrap mr,
+  @{bin}/*-thumbnailer rix,
+
+  /usr/share/poppler/{,**} r,
+
+  owner @{user_cache_dirs}/gnome-desktop-thumbnailer/{,**} rw,
+
+  owner /tmp/flatpak-seccomp-@{rand6} rw,
+  owner /tmp/gnome-desktop-file-to-thumbnail.* r,
+  owner /tmp/gnome-desktop-thumbnailer.png w,
+  owner /tmp/gsf-thumbnailer-@{rand6} rw,
+
+  include if exists <local/gnome-desktop-thumbnailers>
+}
\ No newline at end of file
diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus
index b0018819..f85c9e3c 100644
--- a/apparmor.d/groups/gnome/nautilus
+++ b/apparmor.d/groups/gnome/nautilus
@@ -76,7 +76,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{sh_path}                 rix,
-  @{bin}/bwrap              rPUx,
+  @{bin}/bwrap               rPx -> gnome-desktop-thumbnailers,
   @{bin}/file-roller         rPx,
   @{bin}/firejail           rPUx,
   @{bin}/net                rPUx,