# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

# Core set of resources for any games on Linux. Runtimes such as sandboxing,
# wine, proton, game launchers should use this abstraction.

# This abstraction uses the following tunables:
# - @{XDG_GAMESSTUDIO_DIR}/ for game studio and game engines specific directories
#   (Default: @{XDG_GAMESSTUDIO_DIR}="unity3d")
# - @{user_games_dirs}/ for user specific game directories (eg: steam storage dir)

  abi <abi/4.0>,

  include <abstractions/audio-client>
  include <abstractions/desktop>
  include <abstractions/devices-usb>
  include <abstractions/fontconfig-cache-write>
  include <abstractions/graphics>
  include <abstractions/input>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>
  include <abstractions/uinput>

  @{bin}/uname          rix,
  @{bin}/xdg-settings   rpx,
  @{browsers_path}      rpx,

  @{bin}/env r,

  @{lib}/ r,
  / r,
  /home/ r,
  /usr/ r,
  /usr/local/ r,
  /usr/local/lib/ r,

  /etc/machine-id r,
  /var/lib/dbus/machine-id r,

  owner @{HOME}/ r,

  owner @{user_games_dirs}/ r,
  owner @{user_games_dirs}/*/ r,
  owner @{user_games_dirs}/*/** rwlk,

  owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw,
  owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk,

  owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw,
  owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk,

        @{tmp}/ r,
  owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/ rw,
  owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/** rwlk,
  owner @{tmp}/#@{int} rw,
  owner @{tmp}/AsyncGPUReadbackPlugin_*.log w,
  owner @{tmp}/CASESENSITIVETEST@{hex32} rw,
  owner @{tmp}/crashes/ rw,
  owner @{tmp}/crashes/** rwk,
  owner @{tmp}/miles_image_@{rand6} mrw,
  owner @{tmp}/runtime-info.txt.@{rand6} rw,
  owner @{tmp}/tmp@{rand6}.tmp rw,
  owner @{tmp}/tmp@{rand6}@{h}.tmp rw,
  owner @{tmp}/tmp@{rand8}.tmp rw,
  owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,

  owner /dev/shm/mono.@{int} rw,
  owner /dev/shm/softbuffer-x11-@{rand6}@{c} rw,

  @{sys}/ r,
  @{sys}/bus/ r,
  @{sys}/class/ r,
  @{sys}/class/hidraw/ r,
  @{sys}/class/input/ r,
  @{sys}/devices/ r,
  @{sys}/devices/@{pci}/boot_vga r,
  @{sys}/devices/@{pci}/net/*/carrier r,
  @{sys}/devices/**/input@{int}/ r,
  @{sys}/devices/**/input@{int}/**/{vendor,product} r,
  @{sys}/devices/**/input/input@{int}/ r,
  @{sys}/devices/**/uevent r,
  @{sys}/devices/system/ r,
  @{sys}/devices/system/clocksource/clocksource@{int}/current_clocksource r,
  @{sys}/devices/system/cpu/cpu@{int}/ r,
  @{sys}/devices/virtual/dmi/id/* r,
  @{sys}/devices/virtual/net/*/carrier r,
  @{sys}/kernel/ r,

        @{sys}/fs/cgroup/user.slice/cpu.max r,
        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
  owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max  r,

        @{PROC}/uptime r,
        @{PROC}/version r,
  owner @{PROC}/@{pid}/cgroup r,
  owner @{PROC}/@{pid}/cmdline r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,
  owner @{PROC}/@{pid}/pagemap r,
  owner @{PROC}/@{pid}/stat r,
  owner @{PROC}/@{pid}/task/ r,
  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
  owner @{PROC}/@{pid}/task/@{tid}/stat r,

  /dev/ r,
  /dev/hidraw@{int} rw,
  /dev/tty rw,

  include if exists <abstractions/common/game.d>

# vim:syntax=apparmor
