# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{export_ext} = shortcuts pdf

@{exec_path} = @{bin}/okular
@{att} = ""
profile okular /{,usr/}bin/okular {
  include <abstractions/base-strict>
  include <abstractions/audio-client>
  include <abstractions/common/kde>
  include <abstractions/devices-usb>
  include <abstractions/kde-export-settings>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>
  include <abstractions/sys/dmi>
  include <abstractions/user-download-strict>
  include <abstractions/user-read-strict>
  include <abstractions/user-write-strict>

  network netlink raw,

  ptrace read peer=@{p_systemd},

  signal send set=term peer=kioworker,

  #aa/dbus own bus=session name=org.kde.okular-@{int}
  include <abstractions/bus/session/own>
  dbus bind bus=session name=org.kde.okular-@{int}{,.*},
  dbus receive bus=session path=/org/kde/okular-@{int}{,/**}
       interface=org.kde.okular-@{int}{,.*}
       peer=(name="@{busname}"),
  dbus send bus=session path=/org/kde/okular-@{int}{,/**}
       interface=org.kde.okular-@{int}{,.*}
       peer=(name="{@{busname},org.freedesktop.DBus}"),
  # DBus.Properties: reply to properties request from anyone
  dbus (send receive) bus=session path=/org/kde/okular-@{int}{,/**}
       interface=org.freedesktop.DBus.Properties
       member={Get,GetAll,Set,PropertiesChanged}
       peer=(name="{@{busname},org.freedesktop.DBus}"),
  # DBus.Introspectable: allow clients to introspect the service
  dbus receive bus=session path=/org/kde/okular-@{int}{,/**}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name="@{busname}"),
  # DBus.ObjectManager: allow clients to enumerate sources
  dbus receive bus=session path=/org/kde/okular-@{int}{,/**}
       interface=org.freedesktop.DBus.ObjectManager
       member=GetManagedObjects
       peer=(name="{@{busname},org.kde.okular-@{int}{,.*}}"),
  dbus send bus=session path=/org/kde/okular-@{int}{,/**}
       interface=org.freedesktop.DBus.ObjectManager
       member={InterfacesAdded,InterfacesRemoved}
       peer=(name="{@{busname},org.freedesktop.DBus}"),

  #aa/dbus own bus=session name=org.kde.okular.Instance_@{hex32}
  dbus bind bus=session name=org.kde.okular.Instance_@{hex32}{,.*},
  dbus receive bus=session path=/org/kde/okular/Instance_@{hex32}{,/**}
       interface=org.kde.okular.Instance_@{hex32}{,.*}
       peer=(name="@{busname}"),
  dbus send bus=session path=/org/kde/okular/Instance_@{hex32}{,/**}
       interface=org.kde.okular.Instance_@{hex32}{,.*}
       peer=(name="{@{busname},org.freedesktop.DBus}"),
  # DBus.Properties: reply to properties request from anyone
  dbus (send receive) bus=session path=/org/kde/okular/Instance_@{hex32}{,/**}
       interface=org.freedesktop.DBus.Properties
       member={Get,GetAll,Set,PropertiesChanged}
       peer=(name="{@{busname},org.freedesktop.DBus}"),
  # DBus.Introspectable: allow clients to introspect the service
  dbus receive bus=session path=/org/kde/okular/Instance_@{hex32}{,/**}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name="@{busname}"),
  # DBus.ObjectManager: allow clients to enumerate sources
  dbus receive bus=session path=/org/kde/okular/Instance_@{hex32}{,/**}
       interface=org.freedesktop.DBus.ObjectManager
       member=GetManagedObjects
       peer=(name="{@{busname},org.kde.okular.Instance_@{hex32}{,.*}}"),
  dbus send bus=session path=/org/kde/okular/Instance_@{hex32}{,/**}
       interface=org.freedesktop.DBus.ObjectManager
       member={InterfacesAdded,InterfacesRemoved}
       peer=(name="{@{busname},org.freedesktop.DBus}"),


  @{exec_path} mr,

  @{bin}/testparm          rix,
  @{bin}/net               rix,
  @{bin}/ps2pdf            rpux,
  @{bin}/speech-dispatcher rpx,

  @{bin}/gpg{,2}  rcx -> gpg,
  @{bin}/gpgconf  rcx -> gpg,
  @{bin}/gpgsm    rcx -> gpg,

  @{open_path}    rpx -> child-open,

  /{,usr/}lib{,exec,32,64}/*-linux-gnu*/{,libexec/}kf5/kioslave5 Px,
  /{,usr/}lib{,exec,32,64}/*-linux-gnu*/{,libexec/}kf6/kioworker Px,
  /{,usr/}lib{,exec,32,64}/kf5/kioslave5 Px,
  /{,usr/}lib{,exec,32,64}/kf6/kioworker Px,

  /usr/share/desktop-directories/kf5-*.directory r,
  /usr/share/djvu/** r,
  /usr/share/kf6/searchproviders/{,*} r,
  /usr/share/kf6/purpose/{,*} r,
  /usr/share/thumbnailers/{,**} r,

  /etc/exports r,
  /etc/fstab r,
  /etc/xdg/dolphinrc r,
  @{etc_ro}/krb5.conf r,
  @{etc_ro}/krb5.conf.d/{,**} r,
  @{etc_ro}/vdpau_wrapper.cfg r,

  owner /var/cache/samba/ w,

  / r,
  @{bin}/ r,
  @{MOUNTS}/ r,

  /usr/local/lib{,exec,32,64}/ r,

  /var/tmp/ r,

  owner @{user_config_dirs}/kbookmarkrc r,
  owner @{user_config_dirs}/KDE/*.conf r,
  owner @{user_config_dirs}/kioslaverc r,
  owner @{user_config_dirs}/knfsshare r,
  owner @{user_config_dirs}/kservicemenurc r,
  owner @{user_config_dirs}/kwalletrc r,
  owner @{user_config_dirs}/okular* rwlk,

  # CA certs from firefox and thunderbird.
  owner @{HOME}/.mozilla/firefox/ r,
  owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
  owner @{HOME}/.mozilla/firefox/*/pkcs11.txt rw,
  owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db-journal rw,
  owner @{HOME}/.thunderbird{,-bin}/ r,
  owner @{HOME}/.thunderbird{,-bin}/*/{cert9,key4}.db rwk,
  owner @{HOME}/.thunderbird{,-bin}/*/pkcs11.txt rw,
  owner @{HOME}/.thunderbird{,-bin}/*/{cert9,key4}.db-journal rw,
  owner @{user_config_dirs}/mozilla/firefox/ r,
  owner @{user_config_dirs}/mozilla/firefox/*/{cert9,key4}.db rwk,
  owner @{user_config_dirs}/mozilla/firefox/*/pkcs11.txt rw,
  owner @{user_config_dirs}/mozilla/firefox/*/{cert9,key4}.db-journal rw,

  owner @{user_share_dirs}/user-places.xbel r,

        @{tmp}/ r,
  owner @{tmp}/@{hex12}@{h} rw, # when opening pdf files as attchments in Thunderbird
  owner @{tmp}/#@{int} rw,
  owner @{tmp}/calibre-@{word8}/src.pdf r, # opening pdfs converted in calibre
  owner @{tmp}/kmail_messageviewer_attachment_@{rand6}/{,**} r,
  owner @{tmp}/kmail2.@{rand6} r,
  owner @{tmp}/messageviewer_attachment_@{rand6}/{,*} r, # files opened from KMail as mail attachment,
  owner @{tmp}/okular.@{rand6} rwl -> @{tmp}/#@{int},
  owner @{tmp}/okular_@{rand6}.ps rwl -> @{tmp}/#@{int},
  # ToDo: theoretically any attached files file could be there!
  #owner @{tmp}/*.@{rand6}.* w,
  #owner link @{tmp}/*.@{rand6}.* -> @{tmp}/#@{int},

  owner @{run}/user/@{uid}/#@{int} rw,
  owner @{run}/user/@{uid}/okular@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int},

  @{run}/udev/data/b259:@{int} r,     # Block Extended Major

  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mountinfo r,
  owner @{PROC}/@{pid}/mounts r,
  owner @{PROC}/@{pid}/stat r,
  owner @{PROC}/@{pid}/task/@{tid}/comm w,

  /dev/rfkill r,  # sending via Bluetooth
  /dev/tty r,

  profile gpg {
    include <abstractions/base-strict>
    include <abstractions/consoles>

    @{bin}/gpg{,2}  mr,
    @{bin}/gpgconf  mr,
    @{bin}/gpgsm    mr,

    @{bin}/gpg-agent rpx,
    @{lib}/keyboxd   rpx,

    owner @{user_gpg_dirs}/ rw,
    owner @{user_gpg_dirs}/** rwlk -> @{user_gpg_dirs}/**,

    owner @{run}/user/@{uid}/ r,
    owner @{run}/user/@{uid}/gnupg/ rw,

    include if exists <local/okular_gpg>
  }

  include if exists <local/okular>
}

# vim:syntax=apparmor
