# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# LOGPROF-SUGGEST: no
# NEEDS-VARIABLE: appid
# NEEDS-VARIABLE: path
# NEEDS-VARIABLE: profile_app

# Base rules for `xdg-dbus-proxy` launcher used by Flatpak

# xdg-dbus-proxy is used to filter and forward D-Bus messages between the
# sandboxed application and the host system. As we know the exact D-Bus
# interfaces used by the application, we can restrict the proxy to only those
# interfaces.

# All dbus rules needed by the application must be allowed in this profile.

# See https://docs.flatpak.org/en/latest/sandbox-permissions.html#d-bus-access
# for the list of dbus access allowed by default.

  abi <abi/4.0>,

  include <abstractions/accessibility>
  include <abstractions/bus-session>
  include <abstractions/bus-system>

  include <abstractions/bus/session/org.freedesktop.portal.FileChooser>
  include <abstractions/bus/session/org.freedesktop.portal.Flatpak>
  include <abstractions/bus/session/org.freedesktop.portal.Inhibit>
  include <abstractions/bus/session/org.freedesktop.portal.Realtime>
  include <abstractions/bus/session/org.freedesktop.portal.Request>
  include <abstractions/bus/session/org.freedesktop.portal.Session>
  include <abstractions/bus/session/org.freedesktop.portal.Settings>

  include <abstractions/flatpak/mpris>

  # Scoped version of abstractions/bus/session/org.gtk.Actions to our specific program
  # DBus.Properties: read properties from the interface
  dbus receive bus=session path=@{path}
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=@{busname}, label=gnome-shell),
  # org.gtk.Actions
  dbus receive bus=session path=@{path}{,/**}
       interface=org.gtk.Actions
       member=DescribeAll
       peer=(name=@{busname}, label=gnome-shell),

  signal receive peer=flatpak-portal,

  unix (send receive) type=seqpacket peer=(label=@{profile_app}),
  unix (send receive) type=stream    peer=(label=@{profile_app}),

  dbus receive bus=system path=/org/freedesktop/login1
       interface=org.freedesktop.DBus.Properties
       member=PropertiesChanged
       peer=(name=@{busname}, label=systemd-logind),

  @{bin}/xdg-dbus-proxy ix,

  owner @{att}@{HOME}/.var/app/@{appid}/**/usr/.ref rw,

  audit owner @{att}@{tmp}/* r,

        @{att}@{run}/systemd/inhibit/@{int}.ref w,
  owner @{att}@{run}/flatpak/doc/** r,
  owner @{att}@{run}/user/@{uid}/at-spi/bus rw,
  owner @{att}@{run}/user/@{uid}/bus rw,

  owner @{run}/user/@{uid}/.dbus-proxy/a11y-bus-proxy-@{rand6} w,
  owner @{run}/user/@{uid}/.dbus-proxy/session-bus-proxy-@{rand6} w,
  owner @{run}/user/@{uid}/.dbus-proxy/system-bus-proxy-@{rand6} w,

  owner @{att}/dev/pts/@{int} w,

  include if exists <abstractions/flatpak/dbus-proxy.d>

# vim:syntax=apparmor
