# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

# crashpad_handler's peer=@{name} needs both names: this profile is "helium-bin", not "helium"
@{name} = helium helium-bin
@{domain} = com.imput.helium org.chromium.Chromium
@{lib_dirs} = /opt/helium
@{config_dirs} = @{user_config_dirs}/net.imput.helium{,-beta} @{user_config_dirs}/Helium{,-Beta}
@{cache_dirs} = @{user_cache_dirs}/net.imput.helium{,-beta} @{user_cache_dirs}/Helium{,-Beta}

@{exec_path} = @{lib_dirs}/helium @{lib_dirs}/chrome
@{att} = /att/helium-bin/
profile helium-bin /{opt/helium/helium,opt/helium/chrome} flags=(attach_disconnected,attach_disconnected.path=@{att},complain) {
  include <abstractions/attached/base>
  include <abstractions/app/chromium>

  userns,

  #aa/dbus own bus=session name=org.mpris.MediaPlayer2.helium path=/org/mpris/MediaPlayer2
  include <abstractions/bus/session/own>
  dbus bind bus=session name=org.mpris.MediaPlayer2.helium{,.*},
  dbus receive bus=session path=/org/mpris/MediaPlayer2
       interface=org.mpris.MediaPlayer2.helium{,.*}
       peer=(name="@{busname}"),
  dbus send bus=session path=/org/mpris/MediaPlayer2
       interface=org.mpris.MediaPlayer2.helium{,.*}
       peer=(name="{@{busname},org.freedesktop.DBus}"),
  # DBus.Properties: reply to properties request from anyone
  dbus (send receive) bus=session path=/org/mpris/MediaPlayer2
       interface=org.freedesktop.DBus.Properties
       member={Get,GetAll,Set,PropertiesChanged}
       peer=(name="{@{busname},org.freedesktop.DBus}"),
  # DBus.Introspectable: allow clients to introspect the service
  dbus receive bus=session path=/org/mpris/MediaPlayer2
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name="@{busname}"),
  # DBus.ObjectManager: allow clients to enumerate sources
  dbus receive bus=session path=/org/mpris/MediaPlayer2
       interface=org.freedesktop.DBus.ObjectManager
       member=GetManagedObjects
       peer=(name="{@{busname},org.mpris.MediaPlayer2.helium{,.*}}"),
  dbus send bus=session path=/org/mpris/MediaPlayer2
       interface=org.freedesktop.DBus.ObjectManager
       member={InterfacesAdded,InterfacesRemoved}
       peer=(name="{@{busname},org.freedesktop.DBus}"),


  ptrace trace peer=helium-bin,

  @{exec_path} mrix,

  @{bin}/man  rpux, # For "helium --help"

  @{lib_dirs}/helium_crashpad_handler  px -> helium-bin//&helium-bin//crashpad_handler,

  @{sh_path}                   rix, # For helium-wrapper
  @{bin}/dirname                rix,
  @{bin}/readlink               rix,

  /usr/share/chromium/extensions/ r,


  /etc/crypto-policies/back-ends/gnutls.config r,

  /opt/helium/{,**} r,
  /opt/helium/helium mr,
  /opt/helium/helium_crashpad_handler mr,
  /opt/helium/chromedriver mr,
  /opt/helium/*.so* mr,
  /opt/helium/locales/{,*} r,
  /opt/helium/WidevineCdm/{,**} r,

  owner @{config_dirs}/WidevineCdm/libwidevinecdm.so mrw,

  owner @{tmp}/net-export/ rw,

  # Silencer
  deny /etc/opt/ w,
  deny /dev/disk/by-uuid/ r,
  deny @{user_share_dirs}/gvfs-metadata/* r,

  include if exists <local/helium-bin>
}

# vim:syntax=apparmor
