# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/inxi
@{att} = ""
profile inxi /{,usr/}bin/inxi flags=(complain) {
  include <abstractions/base-strict>
  include <abstractions/nameservice-strict>
  include <abstractions/perl>

  capability dac_read_search,

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink raw,

  @{exec_path} r,

  @{bin}/ r,
  @{sh_path}        rix,
  @{bin}/zsh        rix,
  @{bin}/tty        rix,
  @{bin}/tput       rix,
  @{bin}/getconf    rix,
  @{bin}/file       rix,

  @{lib}/llvm-[0-9]*/bin/clang      rix,
  @{bin}/{,@{multiarch}-}gcc-[0-9]* rix,

  @{bin}/ip              rcx -> ip,
  @{bin}/kmod            rcx -> kmod,
  @{bin}/systemctl       rcx -> systemctl,
  @{bin}/udevadm         rcx -> udevadm,
  @{lib}/systemd/systemd rcx -> systemd,

  # Do not strip env to avoid errors like the following:
  #  ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
  #  shared object file): ignored.
  @{bin}/dpkg-query rpx,

  @{sbin}/blockdev  rpx,
  @{bin}/compton    rpx,
  @{bin}/df         rpx,
  @{bin}/dig        rpx,
  @{sbin}/dmidecode rpx,
  @{bin}/glxinfo    rpx,
  @{bin}/hddtemp    rpx,
  @{bin}/lsblk      rpx,
  @{bin}/lspci      rpx,
  @{bin}/lsusb      rpx,
  @{bin}/openbox    rpx,
  @{bin}/ps         rpx,
  @{bin}/sensors    rpx,
  @{sbin}/smartctl  rpx,
  @{bin}/sudo       rpx,
  @{bin}/uptime     rpx,
  @{bin}/who        rpx,
  @{bin}/xdpyinfo   rpx,
  @{bin}/xprop      rpx,
  @{bin}/xrandr     rpx,
  @{bin}/xset       rpx,

  /etc/ r,
  /etc/inxi.conf r,
  /etc/issue r,
  /etc/magic r,
  /etc/apt/sources.list r,
  /etc/apt/sources.list.d/{,*.list} r,

  /var/log/ r,
  /var/log/Xorg.@{int}.log r,

  /home/ r,
  @{user_share_dirs}/xorg/ r,
  @{user_share_dirs}/xorg/Xorg.@{int}.log r,

  # For shell pwd
  /root/ r,

  @{run}/ r,

  @{sys}/class/power_supply/ r,
  @{sys}/class/net/ r,
  @{sys}/firmware/acpi/tables/ r,
  @{sys}/bus/usb/devices/ r,
  @{sys}/devices/{,**} r,
  @{sys}/module/*/version r,
  @{sys}/power/wakeup_count r,

  @{PROC}/asound/ r,
  @{PROC}/asound/version r,
  @{PROC}/sys/kernel/hostname r,
  @{PROC}/swaps r,
  @{PROC}/partitions r,
  @{PROC}/scsi/scsi r,
  @{PROC}/cmdline r,
  @{PROC}/version r,
  @{PROC}/sys/vm/swappiness r,
  @{PROC}/sys/vm/vfs_cache_pressure r,
  @{PROC}/sys/dev/cdrom/info r,
  @{PROC}/1/comm r,

  /dev/ r,
  /dev/mapper/ r,
  /dev/disk/*/ r,
  /dev/dm-[0-9]* r,

  profile ip flags=(complain) {
    include <abstractions/base-strict>

    network netlink raw,

    @{bin}/ip mr,

    @{sys}/devices/@{pci}/net/*/{duplex,address,speed,operstate} r,

    /etc/iproute2/group r,

    include if exists <local/inxi_ip>
  }

  profile systemd flags=(complain) {
    include <abstractions/base-strict>
    include <abstractions/common/systemd>

    @{lib}/systemd/systemd mr,

    /etc/systemd/user.conf r,

    include if exists <local/inxi_systemd>
  }

  profile udevadm flags=(complain) {
    include <abstractions/base-strict>
    include <abstractions/app/udevadm>

    include if exists <local/inxi_udevadm>
  }

  profile kmod flags=(complain) {
    include <abstractions/base-strict>
    include <abstractions/app/kmod>

    include if exists <local/inxi_kmod>
  }

  profile systemctl flags=(complain) {
    include <abstractions/base-strict>
    include <abstractions/app/systemctl>

    include if exists <local/inxi_systemctl>
  }

  include if exists <local/inxi>
}

# vim:syntax=apparmor
