# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/gtk-query-immodules-* @{lib}/@{multiarch}/libgtk-*/gtk-query-immodules-*
@{att} = ""
profile gtk-query-immodules /{{,usr/}bin/gtk-query-immodules-*,{,usr/}lib{,exec,32,64}/*-linux-gnu*/libgtk-*/gtk-query-immodules-*} flags=(complain) {
  include <abstractions/base-strict>
  include <abstractions/consoles>

  capability dac_override,
  capability dac_read_search,

  @{exec_path} mr,

  @{lib}/gtk-{2,3,4}.0/**/immodules.cache w,
  @{lib}/gtk-{2,3,4}.0/**/immodules.cache.@{rand6} w,

  @{lib}/@{multiarch}/gtk-{2,3,4}.0/**/immodules.cache w,
  @{lib}/@{multiarch}/gtk-{2,3,4}.0/**/immodules.cache.@{rand6} w,

  # Inherit silencer
  deny network inet6 stream,
  deny network inet stream,

  include if exists <local/gtk-query-immodules>
}

# vim:syntax=apparmor
