# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2020 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{name} = dropbox
@{config_dirs}=@{HOME}/.@{name}/
@{share_dirs}=@{HOME}/Dropbox*/
@{demon_dirs}=@{HOME}/.dropbox-dist/

@{exec_path} = @{bin}/dropbox
@{att} = ""
profile dropbox /{,usr/}bin/dropbox flags=(complain) {
  include <abstractions/base-strict>
  include <abstractions/bus-session>
  include <abstractions/bus/org.kde.StatusNotifierWatcher>
  include <abstractions/desktop>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/nameservice-strict>
  include <abstractions/notifications>
  include <abstractions/python>
  include <abstractions/qt5-settings-write>
  include <abstractions/sqlite>
  include <abstractions/ssl_certs>

  @{exec_path} mr,

  @{bin}/ r,
  @{sh_path}        rix,
  @{bin}/readlink   rix,
  @{bin}/dirname    rix,
  @{bin}/uname      rix,
  @{sbin}/ldconfig  rix,
  @{bin}/python3.@{int}             rix,
  @{lib}/llvm-[0-9]*/bin/clang      rix,
  @{bin}/{,@{multiarch}-}gcc-[0-9]* rix,
  @{bin}/{,@{multiarch}-}objdump    rix,

  @{open_path}                      rpx -> child-open-strict,
  @{bin}/lsb_release                rpx,

  owner @{HOME}/ r,
  owner @{config_dirs}/ rw,
  owner @{config_dirs}/** rwk,

  owner @{share_dirs}/ rw,
  owner @{share_dirs}/{,**} rw,

  # Dropbox proprietary demon files
  owner @{demon_dirs}/{,**} rw,
  owner @{demon_dirs}/dropboxd rwix,
  owner @{demon_dirs}/dropbox-lnx.*/dropbox rwix,
  owner @{demon_dirs}/dropbox-lnx.*/dropboxd rwix,
  owner @{demon_dirs}/dropbox-lnx.*/dropbox_py3 rwix,
  owner @{demon_dirs}/dropbox-lnx.*/wmctrl rwix,
  owner @{demon_dirs}/dropbox-lnx.*/*.so* mrw,
  owner @{demon_dirs}/dropbox-lnx.*/plugins/platforms/*.so mrw,

  # Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead
  owner @{tmp}/dropbox-antifreeze-* rw,
  owner @{tmp}/#@{int} rw,

  @{run}/systemd/users/@{uid} r,

        @{PROC}/@{pid}/cmdline r,
        @{PROC}/@{pid}/net/tcp{,6} r,
        @{PROC}/@{pid}/net/udp{,6} r,
        @{PROC}/vmstat r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/fdinfo/* r,
  owner @{PROC}/@{pid}/mountinfo r,
  owner @{PROC}/@{pid}/mounts r,
  owner @{PROC}/@{pid}/oom_{,score_}adj rw,
  owner @{PROC}/@{pid}/stat r,
  owner @{PROC}/@{pid}/task/ r,
  owner @{PROC}/@{pid}/task/@{tid}/comm r,
  owner @{PROC}/@{pid}/task/@{tid}/stat r,

  deny @{sys}/module/apparmor/parameters/enabled r,
  deny @{user_config_dirs}/autostart/dropbox.desktop rw,

  include if exists <local/dropbox>
}

# vim:syntax=apparmor
