# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{okular_ext}  = [pP][dD][fF]

@{exec_path} = /{usr/,}bin/okular
profile okular @{exec_path} {
  include <abstractions/base>
  include <abstractions/X>
  include <abstractions/audio>
  include <abstractions/gtk>
  include <abstractions/fonts>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/freedesktop.org>
  include <abstractions/mesa>
  include <abstractions/user-download-strict>
  include <abstractions/nameservice-strict>
  include <abstractions/dri-enumerate>
  include <abstractions/kde-icon-cache-write>
  include <abstractions/qt5-settings-write>
  include <abstractions/qt5-compose-cache-write>
  include <abstractions/deny-root-dir-access>

  @{exec_path} mr,

  # Which media files Okular should be able to open
        / r,
        /home/ r,
  owner @{HOME}/ r,
  owner @{HOME}/**/ r,
        /media/ r,
  owner /media/**/ r,
        /tmp/ r,
        /tmp/mozilla_*/ r,
  owner /{home,media,tmp/mozilla_*}/**.@{okular_ext} rw,

  owner @{HOME}/.config/#[0-9]*[0-9] rw,

  owner @{HOME}/.config/okularrc rw,
  owner @{HOME}/.config/okularrc.lock rwk,
  owner @{HOME}/.config/okularrc.* rwl -> @{HOME}/.config/#[0-9]*[0-9],

  owner @{HOME}/.config/okularpartrc rw,
  owner @{HOME}/.config/okularpartrc.lock rwk,
  owner @{HOME}/.config/okularpartrc.* rwl -> @{HOME}/.config/#[0-9]*[0-9],

  owner @{HOME}/.config/kdeglobals r,
  owner @{HOME}/.config/kwalletrc r,

  owner @{HOME}/.local/share/okular/{,**} rw,

  owner @{HOME}/.config/qt5ct/{,**} r,
  /usr/share/qt5ct/** r,

  owner @{HOME}/.cache/ rw,
  owner @{HOME}/.cache/okular/{,**} rw,

  /usr/share/okular/{,**} r,
  /usr/share/kxmlgui5/okular/{,*} r,

  /usr/share/poppler/** r,
  /usr/share/hwdata/pnp.ids r,

  /etc/xdg/ui/ui_standards.rc r,

             @{PROC}/sys/kernel/core_pattern r,
  deny       @{PROC}/sys/kernel/random/boot_id r,
  deny owner @{PROC}/@{pid}/cmdline r,

  /dev/shm/#[0-9]*[0-9] rw,

  /var/lib/dbus/machine-id r,
  /etc/machine-id r,

  # Search phrase in google
  /{usr/,}bin/xdg-open rCx -> open,
  /usr/share/kservices5/searchproviders/{,*.desktop} r,
  /usr/share/kservices5/{,*.protocol} r,
  /etc/xdg/kshorturifilterrc r,

  # Print to pdf
  /{usr/,}bin/ps2pdf rPUx,
  owner /tmp/[0-9a-f]* rw,
  owner /tmp/#[0-9]*[0-9] rw,
  owner /tmp/okular_*.ps rwl -> /tmp/#[0-9]*[0-9],

  # About
  /usr/share/kf5/licenses/GPL_V2 r,

  # Allowed apps to open
  /{usr/,}lib/firefox/firefox rPUx,


  profile open {
    include <abstractions/base>
    include <abstractions/xdg-open>

    /{usr/,}bin/xdg-open mr,

    /{usr/,}bin/{,ba,da}sh      rix,
    /{usr/,}bin/gawk            rix,
    /{usr/,}bin/readlink        rix,
    /{usr/,}bin/basename        rix,

    owner @{HOME}/ r,

    owner @{run}/user/[0-9]*/ r,

    # Allowed apps to open
    /{usr/,}lib/firefox/firefox rPUx,

    # file_inherit
    owner @{HOME}/.xsession-errors w,

  }

  include if exists <local/okular>
}