Attachment 867627 Details for Bug 1211989

snap.acestreamplayer.engine Profile

snap.acestreamplayer.engine.profile (text/plain), 110.50 KB, created by Aleksey Kontsevich on 2023-06-16 16:31:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Aleksey Kontsevich

Created: 2023-06-16 16:31:54 UTC

Size: 110.50 KB

patch

obsolete

>
># vim:syntax=apparmor
>
> 
>
>##included <tunables/global>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006-2009 Novell/SUSE
>#    Copyright (C) 2010-2014 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># All the tunables definitions that should be available to every profile
># should be included here
>
> 
>
>##included <tunables/home>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006-2009 Novell/SUSE
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{HOMEDIRS} is a space-separated list of where user home directories
># are stored, for programs that must enumerate all home directories on a
># system.
>@{HOMEDIRS}=/home/
>
>
># @{HOME} is a space-separated list of all user home directories. While
># it doesn't refer to a specific home directory (AppArmor doesn't
># enforce discretionary access controls) it can be used as if it did
># refer to a specific home directory
>@{HOME}=@{HOMEDIRS}/*/ /root/
>
>
># Also, include files in tunables/home.d for site-specific adjustments to
># @{HOMEDIRS}.
> 
>
>##included <tunables/home.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following is a space-separated list of where additional user home
># directories are stored, each must have a trailing '/'. Directories added
># here are appended to @{HOMEDIRS}.  See tunables/home for details. Eg:
>#@{HOMEDIRS}+=/srv/nfs/home/ /mnt/home/
>
>
> 
>
>##included <tunables/multiarch>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{multiarch} is the set of patterns matching multi-arch library
># install prefixes.
>@{multiarch}=*-linux-gnu*
>
>
># Also, include files in tunables/multiarch.d for site and packaging
># specific adjustments to @{multiarch}.
> 
>
>##included <tunables/multiarch.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following is a space-separated list of where additional multipath
># prefixes are stored, each should not have a trailing '/'. Directories
># added here are appended to @{multiarch}. See tunables/mutliarch for details. Eg:
>#@{multiarch}+=*-freebsd* s390-hurd-zomg
>
>
> 
>
>##included <tunables/proc>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{PROC} is the location where procfs is mounted.
>@{PROC}=/proc/
>
>
> 
>
>##included <tunables/alias>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># Alias rules can be used to rewrite paths and are done after variable
># resolution. For example, if '/usr' is on removable media:
># alias /usr/ -> /mnt/usr/,
>#
># Or if mysql databases are stored in /home:
># alias /var/lib/mysql/ -> /home/mysql/,
>
> 
>
>##included <tunables/kernelvars>
>#    Copyright (C) 2012 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># This file should contain declarations to kernel vars or variables
># that will become kernel vars at some point
>
># until kernel vars are implemented
># and until the parser supports nested groupings like
>#   @{pid}=[1-9]{[0-9]{[0-9]{[0-9]{[0-9]{[0-9],},},},},}
># use
>@{pid}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]}
>
>
>#same pattern as @{pid} for now
>@{tid}=@{pid}
>
>
>#A pattern for pids that can appear
>@{pids}=@{pid}
>
>
># Placeholder for user id until kernel var is implemented to match
># current user of the confined application.
># Values are 0...4,294,967,295 (32-bit unsigned, 10 digits).
>@{uid}={[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]}
>
>
>#same pattern as @{uid} for now
>@{uids}=@{uid}
>
>
># until kernel var is implemented
>@{sys}=/sys/
>
>
> 
>
>##included <tunables/xdg-user-dirs>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2014 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># Define the common set of XDG user directories (usually defined in
># /etc/xdg/user-dirs.defaults)
>@{XDG_DESKTOP_DIR}="Desktop"
>
>@{XDG_DOWNLOAD_DIR}="Downloads"
>
>@{XDG_TEMPLATES_DIR}="Templates"
>
>@{XDG_PUBLICSHARE_DIR}="Public"
>
>@{XDG_DOCUMENTS_DIR}="Documents"
>
>@{XDG_MUSIC_DIR}="Music"
>
>@{XDG_PICTURES_DIR}="Pictures"
>
>@{XDG_VIDEOS_DIR}="Videos"
>
>
># Also, include files in tunables/xdg-user-dirs.d for site-specific adjustments
># to the various XDG directories
> 
>
>##included <tunables/xdg-user-dirs.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2014 Canonical Ltd.
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following may be used to add additional entries such as for
># translations. See tunables/xdg-user-dirs for details. Eg:
>#@{XDG_MUSIC_DIR}+="Musique"
>
>#@{XDG_DESKTOP_DIR}+=""
>#@{XDG_DOWNLOAD_DIR}+=""
>#@{XDG_TEMPLATES_DIR}+=""
>#@{XDG_PUBLICSHARE_DIR}+=""
>#@{XDG_DOCUMENTS_DIR}+=""
>#@{XDG_MUSIC_DIR}+=""
>#@{XDG_PICTURES_DIR}+=""
>#@{XDG_VIDEOS_DIR}+=""
>
>
> 
>
>##included <tunables/share>
>@{flatpak_exports_root} = {flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}
>
>
># System-wide directories with behaviour analogous to /usr/share
># in patterns like the freedesktop.org basedir spec. These are
># owned by root or a system user, appear in XDG_DATA_DIRS, and
># are the parent directory for `applications`, `themes`,
># `dbus-1/services`, etc.
>@{system_share_dirs} = /{usr,usr/local,var/lib/@{flatpak_exports_root}}/share
>
>
># Per-user/personal directories with behaviour analogous to
># ~/.local/share in patterns like the freedesktop.org basedir spec.
># These are owned by the user running an application, appear in
># XDG_DATA_DIRS or XDG_DATA_HOME, and are the parent directory
># for the same subdirectories as @{system_share_dirs}
>@{user_share_dirs} = @{HOME}/.local{,/share/@{flatpak_exports_root}}/share
>
>
> 
>
>##included <tunables/etc>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2020 Christian Boltz
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{etc_ro} contains a space-separated list of the system configuration directories.
># Traditionally this means /etc/, but when using a read-only / filesystem and/or
># with the goal of having only user-modified config files in /etc/, directories
># like /usr/etc/ get introduced for storing the default config.
>
># @{etc_ro} contains directories with configuration files, including read-only directories.
># Do not use @{etc_ro} in rules that allow write access.
>@{etc_ro}=/etc/ /usr/etc/
>
>
># @{etc_rw} contains directories where writing to configuration files is allowed.
># @{etc_rw} should always be a subset of @{etc_ro}.
>#
># Only use @{etc_rw} if the profile allows writing to a configuration file.
># For rules that only allows read access, use @{etc_ro}.
>@{etc_rw}=/etc/
>
>
># Also, include files in tunables/etc.d/ for site-specific adjustments to
># @{etc_ro} and @{etc_rw}.
> 
>
>##failed include <tunables/etc.d>
>
>
> 
>
>##included <tunables/run>
>@{run}=/run/ /var/run/
>
>
>
>
> 
>
>##included "/var/lib/snapd/apparmor/snap-tuning"
>
>
># snapd supports the concept of 'parallel installs' where snaps with the same
># name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz
># may all be installed on the system. To support this, SNAP_NAME is set to the
># name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg
># 'foo_bar'). The profile name and most rules therefore reference
># SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime
># environment so the snap doesn't have to be aware of the distinction (eg,
># SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with
># SNAP_NAME so the security policy will allow writing to both locations (since
># they are equivalent).
>
># This is a snap name without the instance key
>@{SNAP_NAME}="acestreamplayer"
>
># This is a snap name with instance key
>@{SNAP_INSTANCE_NAME}="acestreamplayer"
>
>@{SNAP_INSTANCE_DESKTOP}="acestreamplayer"
>
>@{SNAP_COMMAND_NAME}="engine"
>
>@{SNAP_REVISION}="15"
>
>@{PROFILE_DBUS}="snap_2eacestreamplayer_2eengine"
>
>@{INSTALL_DIR}="/{,var/lib/snapd/}snap"
>
>
>profile "snap.acestreamplayer.engine" (attach_disconnected,mediate_deleted) {
>   
>
>##included <abstractions/base>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>   
>
>##included <abstractions/crypto>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#    Copyright (C) 2021 Christian Boltz
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  @{etc_ro}/gcrypt/hwf.deny r,
>  @{etc_ro}/gcrypt/random.conf r,
>  @{PROC}/sys/crypto/fips_enabled r,
>
>  # libgcrypt reads some flags from /proc
>  @{PROC}/sys/crypto/* r,
>
>  # crypto policies used by various libraries
>  /etc/crypto-policies/*/*.txt r,
>  /usr/share/crypto-policies/*/*.txt r,
>
>   
>
>##failed include <abstractions/crypto.d>
>
>
>
>  # (Note that the ldd profile has inlined this file; if you make
>  # modifications here, please consider including them in the ldd
>  # profile as well.)
>
>  # The __canary_death_handler function writes a time-stamped log
>  # message to /dev/log for logging by syslogd. So, /dev/log, timezones,
>  # and localisations of date should be available EVERYWHERE, so
>  # StackGuard, FormatGuard, etc., alerts can be properly logged.
>  /dev/log                       w,
>  /dev/random                    r,
>  /dev/urandom                   r,
>  # Allow access to the uuidd daemon (this daemon is a thin wrapper around
>  # time and getrandom()/{,u}random and, when available, runs under an
>  # unprivilged, dedicated user).
>  @{run}/uuidd/request           r,
>  @{etc_ro}/locale/**          r,
>  @{etc_ro}/locale.alias       r,
>  @{etc_ro}/localtime          r,
>  /usr/share/locale-bundle/**    r,
>  /usr/share/locale-langpack/**  r,
>  /usr/share/locale/**           r,
>  /usr/share/**/locale/**        r,
>  /usr/share/zoneinfo{,-icu}/    r,
>  /usr/share/zoneinfo{,-icu}/**  r,
>  /usr/share/X11/locale/**       r,
>  @{run}/systemd/journal/dev-log w,
>  # systemd native journal API (see sd_journal_print(4))
>  @{run}/systemd/journal/socket  w,
>  # Nested containers and anything using systemd-cat need this. 'r' shouldn't
>  # be required but applications fail without it. journald doesn't leak
>  # anything when reading so this is ok.
>  @{run}/systemd/journal/stdout  rw,
>
>  /usr/lib{,32,64}/locale/**             mr,
>  /usr/lib{,32,64}/gconv/*.so            mr,
>  /usr/lib{,32,64}/gconv/gconv-modules*  mr,
>  /usr/lib/@{multiarch}/gconv/*.so           mr,
>  /usr/lib/@{multiarch}/gconv/gconv-modules* mr,
>
>  # used by glibc when binding to ephemeral ports
>  @{etc_ro}/bindresvport.blacklist    r,
>
>  # ld.so.cache and ld are used to load shared libraries; they are best
>  # available everywhere
>  @{etc_ro}/ld.so.cache               mr,
>  @{etc_ro}/ld.so.conf                r,
>  @{etc_ro}/ld.so.conf.d/{,*.conf}    r,
>  @{etc_ro}/ld.so.preload             r,
>  @{etc_ro}/ld-musl-*.path            r,
>  /{usr/,}lib{,32,64}/ld{,32,64}-*.so   mr,
>  /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so    mr,
>  /{usr/,}lib/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
>  /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
>  /opt/*-linux-uclibc/lib/ld-uClibc*so* mr,
>
>  # we might as well allow everything to use common libraries
>  /{usr/,}lib{,32,64}/**                r,
>  /{usr/,}lib{,32,64}/**.so*       mr,
>  /{usr/,}lib/@{multiarch}/**            r,
>  /{usr/,}lib/@{multiarch}/**.so*   mr,
>  /{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so*    mr,
>  /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so*    mr,
>
>  # FIPS-140-2 versions of some crypto libraries need to access their
>  # associated integrity verification file, or they will abort.
>  /{usr/,}lib{,32,64}/.lib*.so*.hmac      r,
>  /{usr/,}lib/@{multiarch}/.lib*.so*.hmac r,
>
>  # /dev/null is pretty harmless and frequently used
>  /dev/null                      rw,
>  # as is /dev/zero
>  /dev/zero                      rw,
>  # recent glibc uses /dev/full in preference to /dev/null for programs
>  # that don't have open fds at exec()
>  /dev/full                      rw,
>
>  # Sometimes used to determine kernel/user interfaces to use
>  @{PROC}/sys/kernel/version     r,
>  # Depending on which glibc routine uses this file, base may not be the
>  # best place -- but many profiles require it, and it is quite harmless.
>  @{PROC}/sys/kernel/ngroups_max r,
>
>  # glibc's sysconf(3) routine to determine free memory, etc
>  @{PROC}/meminfo                r,
>  @{PROC}/stat                   r,
>  @{PROC}/cpuinfo                r,
>  @{sys}/devices/system/cpu/       r,
>  @{sys}/devices/system/cpu/online r,
>  @{sys}/devices/system/cpu/possible r,
>
>  # glibc's *printf protections read the maps file
>  @{PROC}/@{pid}/{maps,auxv,status} r,
>
>  # some applications will display license information
>  /usr/share/common-licenses/**  r,
>
>  # glibc statvfs
>  @{PROC}/filesystems            r,
>
>  # glibc malloc (man 5 proc)
>  @{PROC}/sys/vm/overcommit_memory r,
>
>  # Allow determining the highest valid capability of the running kernel
>  @{PROC}/sys/kernel/cap_last_cap r,
>
>  # Allow other processes to read our /proc entries, futexes, perf tracing and
>  # kcmp for now (they will need 'read' in the first place). Administrators can
>  # override with:
>  #   deny ptrace (readby) ...
>  ptrace (readby),
>
>  # Allow other processes to trace us by default (they will need 'trace' in
>  # the first place). Administrators can override with:
>  #   deny ptrace (tracedby) ...
>  ptrace (tracedby),
>
>  # Allow us to ptrace read ourselves
>  ptrace (read) peer=@{profile_name},
>
>  # Allow unconfined processes to send us signals by default
>  signal (receive) peer=unconfined,
>
>  # Allow us to signal ourselves
>  signal peer=@{profile_name},
>
>  # Checking for PID existence is quite common so add it by default for now
>  signal (receive, send) set=("exists"),
>
>  # Allow us to create and use abstract and anonymous sockets
>  unix peer=(label=@{profile_name}),
>
>  # Allow unconfined processes to us via unix sockets
>  unix (receive) peer=(label=unconfined),
>
>  # Allow us to create abstract and anonymous sockets
>  unix (create),
>
>  # Allow us to getattr, getopt, setop and shutdown on unix sockets
>  unix (getattr, getopt, setopt, shutdown),
>
>  # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked
>  # filesystems generally. This does not appreciably decrease security with
>  # Ubuntu profiles because the user is expected to have access to files owned
>  # by him/her. Exceptions to this are explicit in the profiles. While this rule
>  # grants access to those exceptions, the intended privacy is maintained due to
>  # the encrypted contents of the files in this directory. Files in this
>  # directory will also use filename encryption by default, so the files are
>  # further protected. Also, with the use of 'owner', this rule properly
>  # prevents access to the files from processes running under a different uid.
>
>  # encrypted ~/.Private and old-style encrypted $HOME
>  owner @{HOME}/.Private/ r,
>  owner @{HOME}/.Private/** mrixwlk,
>  # new-style encrypted $HOME
>  owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
>  owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,
>
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/base.d>
>
>
>   
>
>##included <abstractions/consoles>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2005 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>
>  # there are three common ways to refer to consoles
>  /dev/console rw,
>  /dev/tty     rw,
>  # this next entry is a tad unfortunate; /dev/tty will always be
>  # associated with the controlling terminal by the kernel, but if a
>  # program uses the /dev/pts/ interface, it actually has access to
>  # -all- xterm, sshd, etc, terminals on the system.
>  /dev/pts/[0-9]*   rw,
>  /dev/pts/         r,
>
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/consoles.d>
>
>
>   
>
>##included <abstractions/openssl>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /etc/ssl/openssl.cnf r,
>  /etc/ssl/openssl-*.cnf r,
>  /etc/ssl/{engdef,engines}.d/ r,
>  /etc/ssl/{engdef,engines}.d/*.cnf r,
>  /usr/share/ssl/openssl.cnf r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/openssl.d>
>
>
>
>  # While in later versions of the base abstraction, include this explicitly
>  # for series 16 and cross-distro
>  /etc/ld.so.preload r,
>
>  # The base abstraction doesn't yet have this
>  /etc/sysconfig/clock r,
>  owner @{PROC}/@{pid}/maps k,
>
>  # /proc/XXXX/map_files contains the same info than /proc/XXXX/maps, but
>  # in a format that is simpler to manage, because it doesn't require to
>  # parse the text data inside a file, but just reading the contents of
>  # a directory.
>  # Reading /proc/XXXX/maps is already allowed in the base template
>  # via <abstractions/base>. Also, only the owner can read it, and the
>  # kernel limits access to it by requiring 'ptrace' enabled, so allowing
>  # to access /proc/XXXX/map_files can be considered secure too.
>  owner @{PROC}/@{pid}/map_files/ r,
>
>  # While the base abstraction has rules for encryptfs encrypted home and
>  # private directories, it is missing rules for directory read on the toplevel
>  # directory of the mount (LP: #1848919)
>  owner @{HOME}/.Private/ r,
>  owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
>
>  # for python apps/services
>   
>
>##included <abstractions/python>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2006 Novell/SUSE
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so,so.*[0-9]} mr,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth}       r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.dist-info/{METADATA,namespace_packages.txt} r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.VERSION r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.egg-info/PKG-INFO r,
>  /usr/{local/,}lib{,32,64}/python3.{1,}[0-9]/lib-dynload/*.so            mr,
>
>  # Site-wide configuration
>  /etc/python{2.[4-7],3.[0-9],3.1[0-9]}/** r,
>
>  # shared python paths
>  /usr/share/{pyshared,pycentral,python-support}/**      r,
>  /{var,usr}/lib/{pyshared,pycentral,python-support}/**  r,
>  /usr/lib/{pyshared,pycentral,python-support}/**.so     mr,
>  /var/lib/{pyshared,pycentral,python-support}/**.pyc    mr,
>  /usr/lib/python3/dist-packages/**.so          mr,
>
>  # wx paths
>  /usr/lib/wx/python/*.pth r,
>
>  # python build configuration and headers
>  /usr/include/python{2.[4-7],3.[0-9],3.1[0-9]}*/pyconfig.h r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/python.d>
>
>
>  /etc/python3.[0-9]*/**                                r,
>
>  # explicitly deny noisy denials to read-only filesystems (see LP: #1496895
>  # for details)
>  deny /usr/lib/python3*/{,**/}__pycache__/ w,
>  deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w,
>  # bind mount used here (see 'parallel installs', above)
>  deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/             w,
>  deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w,
>
>  # for perl apps/services
>   
>
>##included <abstractions/perl>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # a few files typically required for perl scripts
>  /usr/bin/perl                  rmix,
>  /usr/bin/perl[0-9].[0-9].[0-9] rmix,
>
>  /usr/lib{,32,64}/perl5/**                    r,
>  /usr/lib{,32,64}/perl{,5}/**.so*             mr,
>  /usr/lib/@{multiarch}/perl{,5,-base}/**            r,
>  /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,
>
>  /usr/share/perl/**             r,
>  /usr/share/perl5/**            r,
>  /etc/perl/**                   r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/perl.d>
>
>
>  # Missing from perl abstraction
>  /usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr,
>
>  # Note: the following dangerous accesses should not be allowed in most
>  # policy, but we cannot explicitly deny since other trusted interfaces might
>  # add them.
>  # Explicitly deny ptrace for now since it can be abused to break out of the
>  # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
>  #audit deny ptrace (trace),
>
>  # Explicitly deny capability mknod so apps can't create devices
>  #audit deny capability mknod,
>
>  # Explicitly deny mount, remount and umount so apps can't modify things in
>  # their namespace
>  #audit deny mount,
>  #audit deny remount,
>  #audit deny umount,
>
>  # End dangerous accesses
>
>  # Note: this potentially allows snaps to DoS other snaps via resource
>  # exhaustion but we can't sensibly mediate this today. In the future we may
>  # employ cgroup limits, AppArmor rlimit mlock rules or something else.
>  capability ipc_lock,
>
>  # for bash 'binaries' (do *not* use abstractions/bash)
>  # user-specific bash files
>  /etc/bash.bashrc r,
>  /etc/inputrc r,
>  /etc/environment r,
>  /etc/profile r,
>
>  # user/group/seat lookups
>  /etc/{passwd,group,nsswitch.conf} r,  # very common
>  /var/lib/extrausers/{passwd,group} r,
>  /run/systemd/users/[0-9]* r,
>  /etc/default/nss r,
>
>  # libnss-systemd (subset from nameservice abstraction)
>  #
>  #   https://systemd.io/USER_GROUP_API/
>  #   https://systemd.io/USER_RECORD/
>  #   https://www.freedesktop.org/software/systemd/man/nss-systemd.html
>  #
>  # Allow User/Group lookups via common VarLink socket APIs. Applications need
>  # to either consult all of them or the io.systemd.Multiplexer frontend.
>  /run/systemd/userdb/ r,
>  /run/systemd/userdb/io.systemd.Multiplexer rw,
>  /run/systemd/userdb/io.systemd.DynamicUser rw,        # systemd-exec users
>  /run/systemd/userdb/io.systemd.Home rw,               # systemd-home dirs
>  /run/systemd/userdb/io.systemd.NameServiceSwitch rw,  # UNIX/glibc NSS
>  /run/systemd/userdb/io.systemd.Machine rw,            # systemd-machined
>
>  /etc/libnl-3/{classid,pktloc} r,      # apps that use libnl
>
>  # For snappy reexec on 4.8+ kernels
>  /usr/lib/snapd/snap-exec m,
>
>  # For gdb support
>  /usr/lib/snapd/snap-gdb-shim ixr,
>  /usr/lib/snapd/snap-gdbserver-shim ixr,
>
>  # For in-snap tab completion
>  /etc/bash_completion.d/{,*} r,
>  /usr/lib/snapd/etelpmoc.sh ixr,               # marshaller (see complete.sh for out-of-snap unmarshal)
>  /usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here
>
>  # uptime
>  @{PROC}/uptime r,
>  @{PROC}/loadavg r,
>
>  # Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib
>  # which is allowed by the base abstraction, but on 14.04 it is an actual file
>  # so need to add it here. Also allow read locks on the file.
>  /etc/os-release rk,
>  /usr/lib/os-release k,
>
>  # systemd native journal API (see sd_journal_print(4)). This should be in
>  # AppArmor's base abstraction, but until it is, include here. We include
>  # the base journal path as well as the journal namespace pattern path. Each
>  # journal namespace for quota groups will be prefixed with 'snap-'.
>  /run/systemd/journal{,.snap-*}/socket w,
>  /run/systemd/journal{,.snap-*}/stdout rw, # 'r' shouldn't be needed, but journald
>                                            # doesn't leak anything so allow
>
>  # snapctl and its requirements
>  /usr/bin/snapctl ixr,
>  /usr/lib/snapd/snapctl ixr,
>  @{PROC}/sys/net/core/somaxconn r,
>  /run/snapd-snap.socket rw,
>
>  # Note: for now, don't explicitly deny this noisy denial so --devmode isn't
>  # broken but eventually we may conditionally deny this since it is an
>  # information leak.
>  #deny /{,var/}run/utmp r,
>
>  # java
>  @{PROC}/@{pid}/ r,
>  @{PROC}/@{pid}/fd/ r,
>  owner @{PROC}/@{pid}/auxv r,
>  @{PROC}/sys/vm/zone_reclaim_mode r,
>  /etc/lsb-release r,
>  /sys/devices/**/read_ahead_kb r,
>  /sys/devices/system/cpu/** r,
>  /sys/devices/system/node/node[0-9]*/* r,
>  /sys/kernel/mm/transparent_hugepage/enabled r,
>  /sys/kernel/mm/transparent_hugepage/defrag r,
>  # NOTE: this leaks running process but java seems to want it (even though it
>  # seems to operate ok without it) and SDL apps crash without it. Allow owner
>  # match until AppArmor kernel var is available to solve this properly (see
>  # LP: #1546825 for details). comm is a subset of cmdline, so allow it too.
>  owner @{PROC}/@{pid}/cmdline r,
>  owner @{PROC}/@{pid}/comm r,
>
>  # Per man(5) proc, the kernel enforces that a thread may only modify its comm
>  # value or those in its thread group.
>  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
>
>  # Allow reading and writing to our file descriptors in /proc which, for
>  # example, allow access to /dev/std{in,out,err} which are all symlinks to
>  # /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE)
>  # linkat() temporary file technique, allow all fds. Importantly, access to
>  # another task's fd via this proc interface is mediated via 'ptrace (read)'
>  # (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so
>  # this rule by itself doesn't allow opening another snap's fds via proc.
>  owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw,
>
>  # Miscellaneous accesses
>  /dev/{,u}random w,
>  /etc/machine-id r,
>  /etc/mime.types r,
>  @{PROC}/ r,
>  @{PROC}/version r,
>  @{PROC}/version_signature r,
>  /etc/{,writable/}hostname r,
>  /etc/{,writable/}localtime r,
>  /etc/{,writable/}mailname r,
>  /etc/{,writable/}timezone r,
>  owner @{PROC}/@{pid}/cgroup rk,
>  @{PROC}/@{pid}/cpuset r,
>  @{PROC}/@{pid}/io r,
>  owner @{PROC}/@{pid}/limits r,
>  owner @{PROC}/@{pid}/loginuid r,
>  @{PROC}/@{pid}/smaps r,
>  @{PROC}/@{pid}/stat r,
>  @{PROC}/@{pid}/statm r,
>  @{PROC}/@{pid}/status r,
>  @{PROC}/@{pid}/task/ r,
>  @{PROC}/@{pid}/task/[0-9]*/smaps r,
>  @{PROC}/@{pid}/task/[0-9]*/stat r,
>  @{PROC}/@{pid}/task/[0-9]*/statm r,
>  @{PROC}/@{pid}/task/[0-9]*/status r,
>  @{PROC}/sys/fs/pipe-max-size r,
>  @{PROC}/sys/kernel/hostname r,
>  @{PROC}/sys/kernel/osrelease r,
>  @{PROC}/sys/kernel/ostype r,
>  @{PROC}/sys/kernel/pid_max r,
>  @{PROC}/sys/kernel/yama/ptrace_scope r,
>  @{PROC}/sys/kernel/shmmax r,
>  # Allow apps to introspect the level of dbus mediation AppArmor implements.
>  /sys/kernel/security/apparmor/features/dbus/mask r,
>  @{PROC}/sys/fs/file-max r,
>  @{PROC}/sys/fs/file-nr r,
>  @{PROC}/sys/fs/inotify/max_* r,
>  @{PROC}/sys/kernel/pid_max r,
>  @{PROC}/sys/kernel/random/boot_id r,
>  @{PROC}/sys/kernel/random/entropy_avail r,
>  @{PROC}/sys/kernel/random/uuid r,
>  @{PROC}/sys/kernel/cap_last_cap r,
>  # Allow access to the uuidd daemon (this daemon is a thin wrapper around
>  # time and getrandom()/{,u}random and, when available, runs under an
>  # unprivilged, dedicated user).
>  /run/uuidd/request rw,
>  /sys/devices/virtual/tty/{console,tty*}/active r,
>  /sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r,
>  /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r,
>  /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.stat r,
>  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r,
>  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r,
>  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r,
>  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r,
>  /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
>  /sys/module/apparmor/parameters/enabled r,
>  /{,usr/}lib/ r,
>
>  # Reads of oom_adj and oom_score_adj are safe
>  owner @{PROC}/@{pid}/oom_{,score_}adj r,
>
>  # Note: for now, don't explicitly deny write access so --devmode isn't broken
>  # but eventually we may conditionally deny this since it allows the process
>  # to increase the oom heuristic of other processes (make them more likely to
>  # be killed). Once AppArmor kernel var is available to solve this properly,
>  # this can safely be allowed since non-root processes won't be able to
>  # decrease the value and root processes will only be able to with
>  # 'capability sys_resource,' which we deny be default.
>  # deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
>
>  # Eases hardware assignment (doesn't give anything away)
>  /etc/udev/udev.conf r,
>  /sys/       r,
>  /sys/bus/   r,
>  /sys/class/ r,
>
>  # this leaks interface names and stats, but not in a way that is traceable
>  # to the user/device
>  @{PROC}/net/dev r,
>  @{PROC}/@{pid}/net/dev r,
>
>  # Read-only of this snap
>  /var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r,
>
>  # Read-only of snapd restart state for snapctl specifically
>  /var/lib/snapd/maintenance.json r,
>
>  # Read-only for the install directory
>  # bind mount used here (see 'parallel installs', above)
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/                   r,
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/    r,
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/**  mrklix,
>
>  # Read-only install directory for other revisions to help with bugs like
>  # LP: #1616650 and LP: #1655992
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**  mrkix,
>
>  # Read-only home area for other versions
>  # bind mount *not* used here (see 'parallel installs', above)
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/                  r,
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/**                mrkix,
>
>  # Experimental snap folder changes
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/                    r,
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/**                  mrkix,
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/common/**           wl,
>
>  owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/                          r,
>  owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/**                        mrkixwl,
>
>  # Writable home area for this version.
>  # bind mount *not* used here (see 'parallel installs', above)
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl,
>
>  # Read-only system area for other versions
>  # bind mount used here (see 'parallel installs', above)
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/   r,
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
>
>  # Writable system area only for this version
>  # bind mount used here (see 'parallel installs', above)
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl,
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl,
>
>  # The ubuntu-core-launcher creates an app-specific private restricted /tmp
>  # and will fail to launch the app if something goes wrong. As such, we can
>  # simply allow full access to /tmp.
>  /tmp/   r,
>  /tmp/** mrwlkix,
>
>  # App-specific access to files and directories in /dev/shm. We allow file
>  # access in /dev/shm for shm_open() and files in subdirectories for open()
>  # bind mount *not* used here (see 'parallel installs', above)
>  /{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix,
>  # Also allow app-specific access for sem_open()
>  /{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk,
>
>  # Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
>  # bind mount *not* used here (see 'parallel installs', above)
>  owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/   rw,
>  owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
>
>  # Allow apps from the same package to communicate with each other via an
>  # abstract or anonymous socket
>  unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**",
>  unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
>
>  # Allow apps from the same package to communicate with each other via DBus.
>  # Note: this does not grant access to the DBus sockets of well known buses
>  # (will still need to use an appropriate interface for that).
>  dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
>  # In addition to the above, dbus-run-session attempts reading these files
>  # from the snap base runtime.
>  /usr/share/dbus-1/services/{,*} r,
>  /usr/share/dbus-1/system-services/{,*} r,
>  # Allow apps to perform DBus introspection on org.freedesktop.DBus for both
>  # the system and session buses.
>  # Note: this does not grant access to the DBus sockets of these buses, but
>  # we grant it here since it is missing from the dbus abstractions
>  # (LP: #1866168)
>  dbus (send)
>      bus={session,system}
>      path=/org/freedesktop/DBus
>      interface=org.freedesktop.DBus.Introspectable
>      member=Introspect
>      peer=(label=unconfined),
>
>  # Allow apps from the same package to signal each other via signals
>  signal peer=snap.@{SNAP_INSTANCE_NAME}.*,
>
>  # Allow receiving signals from all snaps (and focus on mediating sending of
>  # signals)
>  signal (receive) peer=snap.*,
>
>  # Allow receiving signals from unconfined (eg, systemd)
>  signal (receive) peer=unconfined,
>
>  # for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign'
>  /{,usr/}{,s}bin/udevadm ixr,
>  /etc/udev/udev.conf r,
>  /{,var/}run/udev/tags/snappy-assign/ r,
>  @{PROC}/cmdline r,
>  /sys/devices/**/uevent r,
>
>  # LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above
>  # requires:
>  #   /run/udev/data/* r,
>  # but that reveals too much about the system and cannot be granted to apps
>  # by default at this time.
>
>  # For convenience, allow apps to see what is in /dev even though cgroups
>  # will block most access
>  /dev/ r,
>  /dev/**/ r,
>
>  # Allow setting up pseudoterminal via /dev/pts system. This is safe because
>  # the launcher uses a per-app devpts newinstance.
>  /dev/ptmx rw,
>
>  # Do the same with /sys/devices and /sys/class to help people using hw-assign
>  /sys/devices/ r,
>  /sys/devices/**/ r,
>  /sys/class/ r,
>  /sys/class/**/ r,
>
>  # Allow all snaps to chroot
>  capability sys_chroot,
>
>  # Lttng tracing is very noisy and should not be allowed by confined apps. Can
>  # safely deny for the normal case (LP: #1260491). If/when an lttng-trace
>  # interface is needed, we can rework this.
>  deny /{dev,run,var/run}/shm/lttng-ust-* rw,
>
>  # Allow read-access on /home/ for navigating to other parts of the
>  # filesystem. While this allows enumerating users, this is already allowed
>  # via /etc/passwd and getent.
>  @{HOMEDIRS}/ r,
>
>  # Allow read-access to / for navigating to other parts of the filesystem.
>  / r,
>
>  # Snap-specific run directory. Bind mount *not* used here
>  # (see 'parallel installs', above)
>  /run/snap.@{SNAP_INSTANCE_NAME}/ rw,
>  /run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
>
>  # Snap-specific lock directory and prerequisite navigation permissions.
>  /run/lock/ r,
>  /run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw,
>  /run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
>  
>  
>
>  # Default rules for core base runtimes
>
>  # The base abstraction doesn't yet have this
>  /{,usr/}lib/terminfo/** rk,
>  /usr/share/terminfo/** k,
>  /usr/share/zoneinfo/** k,
>
>  # for python apps/services
>  /usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr,
>  # additional accesses needed for newer pythons in later bases
>  /usr/lib{,32,64}/python3.[0-9]*/**.{pyc,so}           mr,
>  /usr/lib{,32,64}/python3.[0-9]*/**.{egg,py,pth}       r,
>  /usr/lib{,32,64}/python3.[0-9]*/{site,dist}-packages/ r,
>  /usr/lib{,32,64}/python3.[0-9]*/lib-dynload/*.so      mr,
>  /usr/include/python3.[0-9]*/pyconfig.h               r,
>
>  # for perl apps/services
>  /usr/bin/perl{,5*} ixr,
>  # AppArmor <2.12 doesn't have rules for perl-base, so add them here
>  /usr/lib/@{multiarch}/perl{,5,-base}/**            r,
>  /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,
>
>  # for bash 'binaries' (do *not* use abstractions/bash)
>  # user-specific bash files
>  /{,usr/}bin/bash ixr,
>  /{,usr/}bin/dash ixr,
>  /usr/share/terminfo/** r,
>
>  # Common utilities for shell scripts
>  /{,usr/}bin/arch ixr,
>  /{,usr/}bin/{,g,m}awk ixr,
>  /{,usr/}bin/base32 ixr,
>  /{,usr/}bin/base64 ixr,
>  /{,usr/}bin/basename ixr,
>  /{,usr/}bin/bunzip2 ixr,
>  /{,usr/}bin/busctl ixr,
>  /{,usr/}bin/bzcat ixr,
>  /{,usr/}bin/bzdiff ixr,
>  /{,usr/}bin/bzgrep ixr,
>  /{,usr/}bin/bzip2 ixr,
>  /{,usr/}bin/cat ixr,
>  /{,usr/}bin/chgrp ixr,
>  /{,usr/}bin/chmod ixr,
>  /{,usr/}bin/chown ixr,
>  /{,usr/}bin/clear ixr,
>  /{,usr/}bin/cmp ixr,
>  /{,usr/}bin/cp ixr,
>  /{,usr/}bin/cpio ixr,
>  /{,usr/}bin/cut ixr,
>  /{,usr/}bin/date ixr,
>  /{,usr/}bin/dbus-daemon ixr,
>  /{,usr/}bin/dbus-run-session ixr,
>  /{,usr/}bin/dbus-send ixr,
>  /{,usr/}bin/dd ixr,
>  /{,usr/}bin/diff{,3} ixr,
>  /{,usr/}bin/dir ixr,
>  /{,usr/}bin/dirname ixr,
>  /{,usr/}bin/du ixr,
>  /{,usr/}bin/echo ixr,
>  /{,usr/}bin/{,e,f,r}grep ixr,
>  /{,usr/}bin/env ixr,
>  /{,usr/}bin/expr ixr,
>  /{,usr/}bin/false ixr,
>  /{,usr/}bin/find ixr,
>  /{,usr/}bin/flock ixr,
>  /{,usr/}bin/fmt ixr,
>  /{,usr/}bin/fold ixr,
>  /{,usr/}bin/getconf ixr,
>  /{,usr/}bin/getent ixr,
>  /{,usr/}bin/getopt ixr,
>  /{,usr/}bin/groups ixr,
>  /{,usr/}bin/gzip ixr,
>  /{,usr/}bin/head ixr,
>  /{,usr/}bin/hostname ixr,
>  /{,usr/}bin/id ixr,
>  /{,usr/}bin/igawk ixr,
>  /{,usr/}bin/infocmp ixr,
>  /{,usr/}bin/kill ixr,
>  /{,usr/}bin/ldd ixr,
>  /{usr/,}lib{,32,64}/ld{,32,64}-*.so ix,
>  /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so* ix,
>  /{,usr/}bin/less{,file,pipe} ixr,
>  /{,usr/}bin/ln ixr,
>  /{,usr/}bin/line ixr,
>  /{,usr/}bin/link ixr,
>  /{,usr/}bin/locale ixr,
>  /{,usr/}bin/logger ixr,
>  /{,usr/}bin/ls ixr,
>  /{,usr/}bin/md5sum ixr,
>  /{,usr/}bin/mkdir ixr,
>  /{,usr/}bin/mkfifo ixr,
>  /{,usr/}bin/mknod ixr,
>  /{,usr/}bin/mktemp ixr,
>  /{,usr/}bin/more ixr,
>  /{,usr/}bin/mv ixr,
>  /{,usr/}bin/nice ixr,
>  /{,usr/}bin/nohup ixr,
>  /{,usr/}bin/numfmt ixr,
>  /{,usr/}bin/od ixr,
>  /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
>  /{,usr/}bin/paste ixr,
>  /{,usr/}bin/pgrep ixr,
>  /{,usr/}bin/printenv ixr,
>  /{,usr/}bin/printf ixr,
>  /{,usr/}bin/ps ixr,
>  /{,usr/}bin/pwd ixr,
>  /{,usr/}bin/readlink ixr,
>  /{,usr/}bin/realpath ixr,
>  /{,usr/}bin/rev ixr,
>  /{,usr/}bin/rm ixr,
>  /{,usr/}bin/rmdir ixr,
>  /{,usr/}bin/run-parts ixr,
>  /{,usr/}bin/sed ixr,
>  /{,usr/}bin/seq ixr,
>  /{,usr/}bin/sha{1,224,256,384,512}sum ixr,
>  /{,usr/}bin/shuf ixr,
>  /{,usr/}bin/sleep ixr,
>  /{,usr/}bin/sort ixr,
>  /{,usr/}bin/stat ixr,
>  /{,usr/}bin/stdbuf ixr,
>  /{,usr/}bin/stty ixr,
>  /{,usr/}bin/sync ixr,
>  /{,usr/}bin/systemd-cat ixr,
>  /{,usr/}bin/tac ixr,
>  /{,usr/}bin/tail ixr,
>  /{,usr/}bin/tar ixr,
>  /{,usr/}bin/tee ixr,
>  /{,usr/}bin/test ixr,
>  /{,usr/}bin/tempfile ixr,
>  /{,usr/}bin/tset ixr,
>  /{,usr/}bin/touch ixr,
>  /{,usr/}bin/tput ixr,
>  /{,usr/}bin/tr ixr,
>  /{,usr/}bin/true ixr,
>  /{,usr/}bin/tty ixr,
>  /{,usr/}bin/uname ixr,
>  /{,usr/}bin/uniq ixr,
>  /{,usr/}bin/unlink ixr,
>  /{,usr/}bin/unxz ixr,
>  /{,usr/}bin/unzip ixr,
>  /{,usr/}bin/uptime ixr,
>  /{,usr/}bin/vdir ixr,
>  /{,usr/}bin/wc ixr,
>  /{,usr/}bin/which{,.debianutils} ixr,
>  /{,usr/}bin/xargs ixr,
>  /{,usr/}bin/xz ixr,
>  /{,usr/}bin/yes ixr,
>  /{,usr/}bin/zcat ixr,
>  /{,usr/}bin/z{,e,f}grep ixr,
>  /{,usr/}bin/zip ixr,
>  /{,usr/}bin/zipgrep ixr,
>
>  # lsb-release
>  /usr/bin/lsb_release ixr,
>  /usr/bin/ r,
>  /usr/share/distro-info/*.csv r,
>
>  # For printing the cache (we don't allow updating the cache)
>  /{,usr/}sbin/ldconfig{,.real} ixr,
>
>  # Allow all snaps to chroot
>  /{,usr/}sbin/chroot ixr,
>
>
># Allow communicating with pulseaudio service
>/{run,dev}/shm/pulse-shm-* mrwk,
>
>owner /{,var/}run/pulse/ r,
>owner /{,var/}run/pulse/native rwk,
>owner /{,var/}run/pulse/pid r,
>owner /{,var/}run/user/[0-9]*/ r,
>owner /{,var/}run/user/[0-9]*/pulse/ rw,
>
>/run/udev/data/c116:[0-9]* r,
>/run/udev/data/+sound:card[0-9]* r,
>
>
># Allow communicating with pulseaudio service for playback and, on some
># distributions, recording.
>/{run,dev}/shm/pulse-shm-* mrwk,
>
>owner /{,var/}run/pulse/ r,
>owner /{,var/}run/pulse/native rwk,
>owner /{,var/}run/pulse/pid r,
>owner /{,var/}run/user/[0-9]*/ r,
>owner /{,var/}run/user/[0-9]*/pulse/ rw,
>
>/run/udev/data/c116:[0-9]* r,
>/run/udev/data/+sound:card[0-9]* r,
>
>
># Allow communicating with pulseaudio service on the desktop in classic distro.
># Only on desktop do we need access to /etc/pulse for any PulseAudio client
># to read available client side configuration settings. On an Ubuntu Core
># device those things will be stored inside the snap directory.
>/etc/pulse/ r,
>/etc/pulse/** r,
>owner @{HOME}/.pulse-cookie rk,
>owner @{HOME}/.config/pulse/cookie rk,
>owner /{,var/}run/user/*/pulse/ rwk,
>owner /{,var/}run/user/*/pulse/native rwk,
>owner /{,var/}run/user/*/pulse/pid r,
>
>
># Description: Can access Unity7. Note, Unity 7 runs on X and requires access
># to various DBus services and this environment does not prevent eavesdropping
># or apps interfering with one another.
>
> 
>
>##included <abstractions/dbus-strict>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2009-2013 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  @{run}/dbus/system_bus_socket rw,
>
>  dbus send
>       bus=system
>       path=/org/freedesktop/DBus
>       interface=org.freedesktop.DBus
>       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
>       peer=(name=org.freedesktop.DBus),
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/dbus-strict.d>
>
>
> 
>
>##included <abstractions/dbus-session-strict>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011-2013 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # unique per-machine identifier
>  /etc/machine-id r,
>  /var/lib/dbus/machine-id r,
>
>  unix (connect, receive, send)
>       type=stream
>       peer=(addr="@/tmp/dbus-*"),
>
>  # dbus with systemd and --enable-user-session
>  owner @{run}/user/[0-9]*/bus rw,
>
>  dbus send
>       bus=session
>       path=/org/freedesktop/DBus
>       interface=org.freedesktop.DBus
>       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
>       peer=(name=org.freedesktop.DBus),
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/dbus-session-strict.d>
>
>
>
># Allow finding the DBus session bus id (eg, via dbus_bus_get_id())
>dbus (send)
>     bus=session
>     path=/org/freedesktop/DBus
>     interface=org.freedesktop.DBus
>     member=GetId
>     peer=(name=org.freedesktop.DBus, label=unconfined),
>
> 
>
>##included <abstractions/X>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>   
>
>##included <abstractions/dri-common>
># vim:syntax=apparmor
>
>  abi <abi/3.0>,
>
># This file contains common DRI-specific rules useful for GUI applications
># (needed by libdrm and similar).
>
>  /usr/lib{,32,64}/dri/**         mr,
>  /usr/lib/@{multiarch}/dri/**    mr,
>  /usr/lib/fglrx/dri/**           mr,
>  /dev/dri/                       r,
>  /dev/dri/**                     rw,
>  /etc/drirc                      r,
>  /usr/share/drirc.d/{,*.conf}    r,
>  owner @{HOME}/.drirc            r,
>
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/dri-common.d>
>
>
>
>
>  # .ICEauthority files required for X authentication, per user
>  owner @{HOME}/.ICEauthority r,
>  owner @{run}/user/*/ICEauthority r,
>
>  # .Xauthority files required for X connections, per user
>  owner @{HOME}/.Xauthority r,
>  owner @{HOME}/.local/share/sddm/.Xauthority r,
>  owner @{run}/gdm{,3}/*/database r,
>  owner @{run}/lightdm/authority/[0-9]* r,
>  owner @{run}/lightdm/*/xauthority r,
>  owner @{run}/user/*/gdm/Xauthority r,
>  owner @{run}/user/*/X11/Xauthority r,
>  owner @{run}/user/*/xauth_* r,
>
>  # the unix socket to use to connect to the display
>  /tmp/.X11-unix/* rw,
>  unix (connect, receive, send)
>       type=stream
>       peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
>  unix (connect, receive, send)
>       type=stream
>       peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
>
>  /usr/include/X11/               r,
>  /usr/include/X11/**             r,
>
>  # The X tree changes and is large -- grant read access to the whole thing
>  /usr/X11R6/**                   r,
>  /usr/share/X11/                 r,
>  /usr/share/X11/**               r,
>  /usr/X11R6/**.so*               mr,
>
>  # EGL
>  /usr/lib/@{multiarch}/egl/*.so* mr,
>
>  # Xcompose
>  owner @{HOME}/.XCompose         r,
>  /var/cache/libx11/compose/*     r,
>  deny /var/cache/libx11/compose/* wlk,
>
>  # mouse themes
>  /etc/X11/cursors/               r,
>  /etc/X11/cursors/**             r,
>
>  # Xwayland
>  owner @{run}/user/*/.mutter-Xwaylandauth.* r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/X.d>
>
>
>
> 
>
>##included <abstractions/fonts>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /usr/share/AbiSuite/fonts/**          r,
>
>  /usr/lib/xorg/modules/fonts/**.so*    mr,
>
>  /usr/share/fonts/{,**}                r,
>  /usr/share/fonts-*/{,**}              r,
>
>  /etc/fonts/**                         r,
>  # Debian, openSUSE paths are different
>  /usr/share/{fontconfig,fonts-config,*-fonts}/conf.avail/{,**} r,
>  /usr/share/ghostscript/fonts/{,**}    r,
>
>  /opt/kde3/share/fonts/**              r,
>
>  /usr/lib{,32,64}/openoffice/share/fonts/**    r,
>
>  /var/cache/fonts/**                   r,
>  /var/cache/fontconfig/**              mr,
>  /var/lib/defoma/**                    mr,
>
>  /usr/share/a2ps/fonts/**              r,
>  /usr/share/xfce/fonts/**              r,
>  /usr/share/ghostscript/fonts/**       r,
>  /usr/share/javascript/*/fonts/**      r,
>  /usr/share/texmf/{,*/}fonts/**        r,
>  /usr/share/texlive/texmf-dist/fonts/** r,
>  /var/lib/ghostscript/**               r,
>
>  owner @{HOME}/.fonts.conf             r,
>  owner @{HOME}/.fonts/                 r,
>  owner @{HOME}/.fonts/**               r,
>  owner @{HOME}/.local/share/fonts/     r,
>  owner @{HOME}/.local/share/fonts/**   r,
>  owner @{HOME}/.fonts.cache-2          mr,
>  owner @{HOME}/.{,cache/}fontconfig/   rw,
>  owner @{HOME}/.{,cache/}fontconfig/** mrl,
>  owner @{HOME}/.fonts.conf.d/          r,
>  owner @{HOME}/.fonts.conf.d/**        r,
>  owner @{HOME}/.config/fontconfig/     r,
>  owner @{HOME}/.config/fontconfig/**   r,
>  owner @{HOME}/.Fontmatrix/Activated/  r,
>  owner @{HOME}/.Fontmatrix/Activated/** r,
>
>  /usr/local/share/fonts/               r,
>  /usr/local/share/fonts/**             r,
>
>  # poppler CMap tables
>  /usr/share/poppler/cMap/**            r,
>
>  # data files for LibThai
>  /usr/share/libthai/thbrk.tri          r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/fonts.d>
>
>
>owner @{HOME}/.local/share/fonts/{,**} r,
>/var/cache/fontconfig/   r,
>/var/cache/fontconfig/** mr,
>
># subset of gnome abstraction
>/etc/gnome/defaults.list r,
>
>/etc/gtk-*/*                               r,
>/usr/lib{,32,64}/gtk-*/**                  mr,
>/usr/lib{,32,64}/gdk-pixbuf-*/**           mr,
>/usr/lib/@{multiarch}/gtk-*/**             mr,
>/usr/lib/@{multiarch}/gdk-pixbuf-*/**      mr,
>
>/etc/pango/*                               r,
>/usr/lib{,32,64}/pango/**                  mr,
>/usr/lib/@{multiarch}/pango/**             mr,
>
>/usr/share/icons/                          r,
>/usr/share/icons/**                        r,
>/usr/share/icons/*/index.theme             rk,
>/usr/share/pixmaps/                        r,
>/usr/share/pixmaps/**                      r,
>
># The snapcraft desktop part may look for schema files in various locations, so
># allow reading system installed schemas.
>/usr/share/glib*/schemas/{,*}              r,
>
># Snappy's 'xdg-open' talks to the snapd-xdg-open service which currently works
># only in environments supporting dbus-send (eg, X11). In the future once
># snappy's xdg-open supports all snaps images, this access may move to another
># interface. This is duplicated from desktop for compatibility with existing
># snaps.
>/usr/bin/xdg-open ixr,
># While /usr/share/applications comes from the base runtime of the snap, it
># has some things that snaps actually need, so allow access to those and deny
># access to the others. This is duplicated from desktop for compatibility with
># existing snaps.
>/usr/share/applications/ r,
>/usr/share/applications/mimeapps.list r,
>/usr/share/applications/xdg-open.desktop r,
># silence noisy denials from desktop files in core* snaps that aren't usable by
># snaps
>deny /usr/share/applications/python*.desktop r,
>deny /usr/share/applications/vim.desktop r,
>deny /usr/share/applications/snap-handle-link.desktop r,  # core16
>
># This allow access to the first version of the snapd-xdg-open
># version which was shipped outside of snapd
>dbus (send)
>    bus=session
>    path=/
>    interface=com.canonical.SafeLauncher
>    member=OpenURL
>    peer=(label=unconfined),
># ... and this allows access to the new xdg-open service which
># is now part of snapd itself.
>dbus (send)
>    bus=session
>    path=/io/snapcraft/Launcher
>    interface=io.snapcraft.Launcher
>    member={OpenURL,OpenFile}
>    peer=(label=unconfined),
>
># Allow use of snapd's internal 'xdg-settings'
>/usr/bin/xdg-settings ixr,
>dbus (send)
>    bus=session
>    path=/io/snapcraft/Settings
>    interface=io.snapcraft.Settings
>    member={Check,CheckSub,Get,GetSub,Set,SetSub}
>    peer=(label=unconfined),
>
># input methods (ibus)
># subset of ibus abstraction
>/usr/lib/@{multiarch}/gtk-2.0/[0-9]*/immodules/im-ibus.so mr,
>owner @{HOME}/.config/ibus/      r,
>owner @{HOME}/.config/ibus/bus/  r,
>owner @{HOME}/.config/ibus/bus/* r,
>
># allow communicating with ibus-daemon (this allows sniffing key events)
>unix (connect, receive, send)
>     type=stream
>     peer=(addr="@/tmp/ibus/dbus-*"),
>
># abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache)
># This should use this, but due to LP: #1856738 we cannot
>#unix (connect, receive, send)
>#    type=stream
>#    peer=(addr="@@{HOME}/.cache/ibus/dbus-*"),
>unix (connect, receive, send)
>     type=stream
>     peer=(addr="@/home/*/.cache/ibus/dbus-*"),
>
>
># input methods (mozc)
># allow communicating with mozc server (TODO: investigate if allows sniffing)
>unix (connect, receive, send)
>     type=stream
>     peer=(addr="@tmp/.mozc.*"),
>
>
># input methods (fcitx)
># allow communicating with fcitx dbus service
>dbus send
>    bus=fcitx
>    path=/org/freedesktop/DBus
>    interface=org.freedesktop.DBus
>    member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
>    peer=(name=org.freedesktop.DBus),
>
>owner @{HOME}/.config/fcitx/dbus/* r,
>
># allow creating an input context
>dbus send
>    bus={fcitx,session}
>    path=/inputmethod
>    interface=org.fcitx.Fcitx.InputMethod
>    member=CreateIC*
>    peer=(label=unconfined),
>
># allow setting up and tearing down the input context
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="{Close,Destroy,Enable}IC"
>    peer=(label=unconfined),
>
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member=Reset
>    peer=(label=unconfined),
>
># allow service to send us signals
>dbus receive
>    bus=fcitx
>    peer=(label=unconfined),
>
>dbus receive
>    bus=session
>    interface=org.fcitx.Fcitx.*
>    peer=(label=unconfined),
>
># use the input context
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="Focus{In,Out}"
>    peer=(label=unconfined),
>
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="{CommitPreedit,Set*}"
>    peer=(label=unconfined),
>
># this is an information leak and allows key and mouse sniffing. If the input
># context path were tied to the process' security label, this would not be an
># issue.
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="{MouseEvent,ProcessKeyEvent}"
>    peer=(label=unconfined),
>
># this method does not exist with the sunpinyin backend (at least), so allow
># it for other input methods. This may consitute an information leak (which,
># again, could be avoided if the path were tied to the process' security
># label).
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.freedesktop.DBus.Properties
>    member=GetAll
>    peer=(label=unconfined),
>
># Needed by QtSystems on X to detect mouse and keyboard. Note, the 'netlink
># raw' rule is not finely mediated by apparmor so we mediate with seccomp arg
># filtering.
>network netlink raw,
>/run/udev/data/c13:[0-9]* r,
>/run/udev/data/+input:* r,
>
># subset of freedesktop.org
>/usr/share/mime/**                   r,
>owner @{HOME}/.local/share/mime/**   r,
>owner @{HOME}/.config/user-dirs.* r,
>
>/etc/xdg/user-dirs.conf r,
>/etc/xdg/user-dirs.defaults r,
>
># gtk settings (subset of gnome abstraction)
>owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini r,
>owner @{HOME}/.config/gtk-3.0/settings.ini r,
># Note: this leaks directory names that wouldn't otherwise be known to the snap
>owner @{HOME}/.config/gtk-3.0/bookmarks r,
>
># accessibility
> 
>
>##included <abstractions/dbus-accessibility-strict>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2013 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  dbus send
>       bus=accessibility
>       path=/org/freedesktop/DBus
>       interface=org.freedesktop.DBus
>       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
>       peer=(name=org.freedesktop.DBus),
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/dbus-accessibility-strict.d>
>
>
>dbus (send)
>    bus=session
>    path=/org/a11y/bus
>    interface=org.a11y.Bus
>    member=GetAddress
>    peer=(label=unconfined),
>dbus (send)
>    bus=session
>    path=/org/a11y/bus
>    interface=org.freedesktop.DBus.Properties
>    member=Get{,All}
>    peer=(label=unconfined),
>
># unfortunate, but org.a11y.atspi is not designed for separation
>dbus (receive, send)
>    bus=accessibility
>    path=/org/a11y/atspi/**
>    peer=(label=unconfined),
>
># org.freedesktop.Accounts
>dbus (send)
>    bus=system
>    path=/org/freedesktop/Accounts
>    interface=org.freedesktop.DBus.Introspectable
>    member=Introspect
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=system
>    path=/org/freedesktop/Accounts
>    interface=org.freedesktop.Accounts
>    member=FindUserById
>    peer=(label=unconfined),
>
># Get() is an information leak
># TODO: verify what it is leaking
>dbus (receive, send)
>    bus=system
>    path=/org/freedesktop/Accounts/User[0-9]*
>    interface=org.freedesktop.DBus.Properties
>    member={Get,PropertiesChanged}
>    peer=(label=unconfined),
>
># gmenu
># Note: the gmenu DBus api was not designed for application isolation and apps
># may specify anything as their 'path'. For example, these work in the many
># cases:
># - /org/gtk/Application/anonymous{,/**}
># - /com/canonical/unity/gtk/window/[0-9]*
># but libreoffice does:
># - /org/libreoffice{,/**}
># As such, cannot mediate by DBus path so we'll be as strict as we can in the
># other mediated parts
>dbus (send)
>    bus=session
>    interface=org.gtk.Actions
>    member=Changed
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    interface=org.gtk.Actions
>    member={Activate,DescribeAll,SetState}
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    interface=org.gtk.Menus
>    member={Start,End}
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    interface=org.gtk.Menus
>    member=Changed
>    peer=(label=unconfined),
>
># Ubuntu menus
>dbus (send)
>    bus=session
>    path="/com/ubuntu/MenuRegistrar"
>    interface="com.ubuntu.MenuRegistrar"
>    member="{Register,Unregister}{App,Surface}Menu"
>    peer=(label=unconfined),
>
># url helper
>dbus (send)
>    bus=session
>    interface=com.canonical.SafeLauncher.OpenURL
>    peer=(label=unconfined),
># new url helper (part of snap userd)
>dbus (send)
>    bus=session
>    interface=io.snapcraft.Launcher.OpenURL
>    peer=(label=unconfined),
>
># dbusmenu
>dbus (send)
>    bus=session
>    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
>    interface=com.canonical.dbusmenu
>    member="{LayoutUpdated,ItemsPropertiesUpdated}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
>    interface="{com.canonical.dbusmenu,org.freedesktop.DBus.Properties}"
>    member=Get*
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
>    interface=com.canonical.dbusmenu
>    member="{AboutTo*,Event*}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
>    interface=org.freedesktop.DBus.Introspectable
>    member=Introspect
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/com/canonical/dbusmenu
>    interface=org.freedesktop.DBus.Properties
>    member=Get*
>    peer=(label=unconfined),
>
># app-indicators
>dbus (send)
>    bus=session
>    path=/StatusNotifierWatcher
>    interface=org.freedesktop.DBus.Introspectable
>    member=Introspect
>    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/org/freedesktop/DBus
>    interface=org.freedesktop.DBus
>    member="{GetConnectionUnixProcessID,RequestName,ReleaseName}"
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
>dbus (bind)
>    bus=session
>    name=org.kde.StatusNotifierItem-[0-9]*,
>
>dbus (send)
>    bus=session
>    path=/StatusNotifierWatcher
>    interface=org.freedesktop.DBus.Properties
>    member=Get
>    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/{StatusNotifierWatcher,org/ayatana/NotificationItem/*}
>    interface=org.kde.StatusNotifierWatcher
>    member=RegisterStatusNotifierItem
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
>    interface=org.kde.StatusNotifierItem
>    member="New{AttentionIcon,Icon,IconThemePath,OverlayIcon,Status,Title,ToolTip}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
>    interface=org.kde.StatusNotifierItem
>    member={Activate,ContextMenu,Scroll,SecondaryActivate,ProvideXdgActivationToken,XAyatanaSecondaryActivate}
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/{StatusNotifierItem/menu,org/ayatana/NotificationItem/*/Menu}
>    interface=com.canonical.dbusmenu
>    member="{LayoutUpdated,ItemsPropertiesUpdated}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/{StatusNotifierItem,StatusNotifierItem/menu,org/ayatana/NotificationItem/**}
>    interface={org.freedesktop.DBus.Properties,com.canonical.dbusmenu}
>    member={Get*,AboutTo*,Event*}
>    peer=(label=unconfined),
>
># notifications
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member={ActionInvoked,NotificationClosed,NotificationReplied}
>    peer=(label=unconfined),
>
># KDE Plasma's Inhibited property indicating "do not disturb" mode
># https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member="Get{,All}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member=PropertiesChanged
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/org/ayatana/NotificationItem/*
>    interface=org.kde.StatusNotifierItem
>    member=XAyatanaNew*
>    peer=(label=unconfined),
>
># unity launcher
>dbus (send)
>    bus=session
>    path=/com/canonical/unity/launcherentry/[0-9]*
>    interface=com.canonical.Unity.LauncherEntry
>    member=Update
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/com/canonical/unity/launcherentry/[0-9]*
>    interface=com.canonical.dbusmenu
>    member="{LayoutUpdated,ItemsPropertiesUpdated}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/com/canonical/unity/launcherentry/[0-9]*
>    interface="{com.canonical.dbusmenu,org.freedesktop.DBus.Properties}"
>    member=Get*
>    peer=(label=unconfined),
>
># Support applications which use the unity messaging menu, xdg-mime, etc
># This leaks the names of snaps with desktop files
>/var/lib/snapd/desktop/applications/ r,
># Allowing reading only our desktop files (required by (at least) the unity
># messaging menu).
># parallel-installs: this leaks read access to desktop files owned by keyed
># instances of @{SNAP_NAME} to @{SNAP_NAME} snap
>/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,
># Explicitly deny access to other snap's desktop files
>deny /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,
>deny /var/lib/snapd/desktop/applications/[^a]* r,
>deny /var/lib/snapd/desktop/applications/a[^c]* r,
>deny /var/lib/snapd/desktop/applications/ac[^e]* r,
>deny /var/lib/snapd/desktop/applications/ace[^s]* r,
>deny /var/lib/snapd/desktop/applications/aces[^t]* r,
>deny /var/lib/snapd/desktop/applications/acest[^r]* r,
>deny /var/lib/snapd/desktop/applications/acestr[^e]* r,
>deny /var/lib/snapd/desktop/applications/acestre[^a]* r,
>deny /var/lib/snapd/desktop/applications/acestrea[^m]* r,
>deny /var/lib/snapd/desktop/applications/acestream[^p]* r,
>deny /var/lib/snapd/desktop/applications/acestreamp[^l]* r,
>deny /var/lib/snapd/desktop/applications/acestreampl[^a]* r,
>deny /var/lib/snapd/desktop/applications/acestreampla[^y]* r,
>deny /var/lib/snapd/desktop/applications/acestreamplay[^e]* r,
>deny /var/lib/snapd/desktop/applications/acestreamplaye[^r]* r,
>
># Snaps are unable to use the data in mimeinfo.cache (since they can't execute
># the returned desktop file themselves). unity messaging menu doesn't require
># mimeinfo.cache and xdg-mime will fallback to reading the desktop files
># directly to look for MimeType. Since reading the snap's own desktop files is
># allowed, we can safely deny access to this file (and xdg-mime will either
># return one of the snap's mimetypes, or none).
>deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,
>
># then allow talking to Unity DBus service
>dbus (send)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/com/canonical/indicator/messages/service
>    member=GetAll
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/com/canonical/indicator/messages/service
>    interface=com.canonical.indicator.messages.service
>    member={Register,Unregister}Application
>    peer=(label=unconfined),
>
># When @{SNAP_NAME} == @{SNAP_INSTANCE_NAME}, this rule
># allows the snap to access parallel installs of this snap.
>dbus (receive)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/com/canonical/indicator/messages/acestreamplayer_*_desktop
>    member=GetAll
>    peer=(label=unconfined),
>
># When @{SNAP_NAME} == @{SNAP_INSTANCE_NAME}, this rule
># allows the snap to access parallel installs of this snap.
>dbus (receive, send)
>    bus=session
>    interface=com.canonical.indicator.messages.application
>    path=/com/canonical/indicator/messages/acestreamplayer_*_desktop
>    peer=(label=unconfined),
>
># This rule is meant to be covered by abstractions/dbus-session-strict but
># the unity launcher code has a typo that uses /org/freedesktop/dbus as the
># path instead of /org/freedesktop/DBus, so we need to all it here.
>dbus (send)
>    bus=session
>    path=/org/freedesktop/dbus
>    interface=org.freedesktop.DBus
>    member=NameHasOwner
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
># appmenu
>dbus (send)
>    bus=session
>    path=/org/freedesktop/DBus
>    interface=org.freedesktop.DBus
>    member=ListNames
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/com/canonical/AppMenu/Registrar
>    interface=com.canonical.AppMenu.Registrar
>    member="{RegisterWindow,UnregisterWindow}"
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/com/canonical/AppMenu/Registrar
>    interface=com.canonical.dbusmenu
>    member=UnregisterWindow
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/com/canonical/menu/[0-9]*
>    interface="{org.freedesktop.DBus.Properties,com.canonical.dbusmenu}"
>    member="{GetAll,GetLayout}"
>    peer=(label=unconfined),
>
># Allow requesting interest in receiving media key events. This tells Gnome
># settings that our application should be notified when key events we are
># interested in are pressed, and allows us to receive those events.
>dbus (receive, send)
>  bus=session
>  interface=org.gnome.SettingsDaemon.MediaKeys
>  path=/org/gnome/SettingsDaemon/MediaKeys
>  peer=(label=unconfined),
>dbus (send)
>  bus=session
>  interface=org.freedesktop.DBus.Properties
>  path=/org/gnome/SettingsDaemon/MediaKeys
>  member="Get{,All}"
>  peer=(label=unconfined),
>
># Allow checking status, activating and locking the screensaver
># mate
>dbus (send)
>    bus=session
>    path="/{,org/mate/}ScreenSaver"
>    interface=org.mate.ScreenSaver
>    member="{GetActive,GetActiveTime,Lock,SetActive}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path="/{,org/mate/}ScreenSaver"
>    interface=org.mate.ScreenSaver
>    member=ActiveChanged
>    peer=(label=unconfined),
>
># Unity
>dbus (send)
>  bus=session
>  interface=com.canonical.Unity.Session
>  path=/com/canonical/Unity/Session
>  member="{ActivateScreenSaver,IsLocked,Lock}"
>  peer=(label=unconfined),
>
># Allow unconfined to introspect us
>dbus (receive)
>    bus=session
>    interface=org.freedesktop.DBus.Introspectable
>    member=Introspect
>    peer=(label=unconfined),
>
># gtk2/gvfs gtk_show_uri()
>dbus (send)
>    bus=session
>    path=/org/gtk/vfs/mounttracker
>    interface=org.gtk.vfs.MountTracker
>    member=ListMountableInfo,
>dbus (send)
>    bus=session
>    path=/org/gtk/vfs/mounttracker
>    interface=org.gtk.vfs.MountTracker
>    member=LookupMount,
>
>
># Description: Can access basic graphical desktop resources. To be used with
># other interfaces (eg, wayland).
>
> 
>
>##skipped duplicate include <abstractions/dbus-strict>
>
> 
>
>##skipped duplicate include <abstractions/dbus-session-strict>
>
>
># Allow finding the DBus session bus id (eg, via dbus_bus_get_id())
>dbus (send)
>     bus=session
>     path=/org/freedesktop/DBus
>     interface=org.freedesktop.DBus
>     member=GetId
>     peer=(name=org.freedesktop.DBus, label=unconfined),
>
> 
>
>##skipped duplicate include <abstractions/fonts>
>
>owner @{HOME}/.local/share/fonts/{,**} r,
>/var/cache/fontconfig/   r,
>/var/cache/fontconfig/** mr,
># some applications are known to mmap fonts
>/usr/{,local/}share/fonts/** m,
>
># subset of gnome abstraction
>/etc/gtk-3.0/settings.ini r,
>owner @{HOME}/.config/gtk-3.0/settings.ini r,
>owner @{HOME}/.config/gtk-3.0/*.css r,
># Note: this leaks directory names that wouldn't otherwise be known to the snap
>owner @{HOME}/.config/gtk-3.0/bookmarks r,
>
>/usr/share/icons/                          r,
>/usr/share/icons/**                        r,
>/usr/share/icons/*/index.theme             rk,
>/usr/share/pixmaps/                        r,
>/usr/share/pixmaps/**                      r,
>/usr/share/unity/icons/**                  r,
>/usr/share/thumbnailer/icons/**            r,
>/usr/share/themes/**                       r,
>
># The snapcraft desktop part may look for schema files in various locations, so
># allow reading system installed schemas.
>/usr/share/glib*/schemas/{,*}              r,
>/usr/share/gnome/glib*/schemas/{,*}        r,
>/usr/share/ubuntu/glib*/schemas/{,*}       r,
>
># subset of freedesktop.org
>owner @{HOME}/.local/share/mime/**   r,
>owner @{HOME}/.config/user-dirs.* r,
>
>/etc/xdg/user-dirs.conf r,
>/etc/xdg/user-dirs.defaults r,
>
># gmenu
>dbus (send)
>     bus=session
>     interface=org.gtk.Actions
>     member=Changed
>     peer=(label=unconfined),
>
># notifications
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member={ActionInvoked,NotificationClosed,NotificationReplied}
>    peer=(label=unconfined),
>
># KDE Plasma's Inhibited property indicating "do not disturb" mode
># https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member="Get{,All}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member=PropertiesChanged
>    peer=(label=unconfined),
>
># DesktopAppInfo Launched
>dbus (send)
>    bus=session
>    path=/org/gtk/gio/DesktopAppInfo
>    interface=org.gtk.gio.DesktopAppInfo
>    member=Launched
>    peer=(label=unconfined),
>
># Allow requesting interest in receiving media key events. This tells Gnome
># settings that our application should be notified when key events we are
># interested in are pressed, and allows us to receive those events.
>dbus (receive, send)
>  bus=session
>  interface=org.gnome.SettingsDaemon.MediaKeys
>  path=/org/gnome/SettingsDaemon/MediaKeys
>  peer=(label=unconfined),
>dbus (send)
>  bus=session
>  interface=org.freedesktop.DBus.Properties
>  path=/org/gnome/SettingsDaemon/MediaKeys
>  member="Get{,All}"
>  peer=(label=unconfined),
>
># Allow accessing the GNOME crypto services prompt APIs as used by
># applications using libgcr (such as pinentry-gnome3) for secure pin
># entry to unlock GPG keys etc. See:
># https://developer.gnome.org/gcr/unstable/GcrPrompt.html
># https://developer.gnome.org/gcr/unstable/GcrSecretExchange.html
>dbus (send)
>    bus=session
>    path=/org/gnome/keyring/Prompter
>    interface=org.gnome.keyring.internal.Prompter
>    member="{BeginPrompting,PerformPrompt,StopPrompting}"
>    peer=(label=unconfined),
>
># While the DBus path is not snap-specific, by the time an application
># registers the prompt path via DBus, Gcr will check that it isn't
># already in use and send the client an error if it is. See:
># https://github.com/snapcore/snapd/pull/7673#issuecomment-592229711
>dbus (receive)
>    bus=session
>    path=/org/gnome/keyring/Prompt/p[0-9]*
>    interface=org.gnome.keyring.internal.Prompter.Callback
>    member="{PromptReady,PromptDone}"
>    peer=(label=unconfined),
>
># Allow use of snapd's internal 'xdg-open'
>/usr/bin/xdg-open ixr,
># While /usr/share/applications comes from the base runtime of the snap, it
># has some things that snaps actually need, so allow access to those and deny
># access to the others
>/usr/share/applications/ r,
>/usr/share/applications/mimeapps.list r,
>/usr/share/applications/xdg-open.desktop r,
># silence noisy denials from desktop files in core* snaps that aren't usable by
># snaps
>deny /usr/share/applications/python*.desktop r,
>deny /usr/share/applications/vim.desktop r,
>deny /usr/share/applications/snap-handle-link.desktop r,  # core16
>
>dbus (send)
>    bus=session
>    path=/
>    interface=com.canonical.SafeLauncher
>    member=OpenURL
>    peer=(label=unconfined),
># ... and this allows access to the new xdg-open service which
># is now part of snapd itself.
>dbus (send)
>    bus=session
>    path=/io/snapcraft/Launcher
>    interface=io.snapcraft.Launcher
>    member={OpenURL,OpenFile}
>    peer=(label=unconfined),
>
># Allow checking status, activating and locking the screensaver
># gnome/kde/freedesktop.org
>dbus (send)
>    bus=session
>    path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
>    interface="org.{freedesktop,gnome}.ScreenSaver"
>    member="{GetActive,GetActiveTime,Lock,SetActive}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
>    interface="org.{freedesktop,gnome}.ScreenSaver"
>    member=ActiveChanged
>    peer=(label=unconfined),
>
># Allow unconfined to introspect us
>dbus (receive)
>    bus=session
>    interface=org.freedesktop.DBus.Introspectable
>    member=Introspect
>    peer=(label=unconfined),
>
># Allow use of snapd's internal 'xdg-settings'
>/usr/bin/xdg-settings ixr,
>dbus (send)
>    bus=session
>    path=/io/snapcraft/Settings
>    interface=io.snapcraft.Settings
>    member={Check,CheckSub,Get,GetSub,Set,SetSub}
>    peer=(label=unconfined),
>
># Allow access to xdg-document-portal file system.  Access control is
># handled by bind mounting a snap-specific sub-tree to this location
># (ie, this is /run/user/<uid>/doc/by-app/snap.@{SNAP_INSTANCE_NAME}
># on the host).
>owner /run/user/[0-9]*/doc/{,*/} r,
># Allow rw access without owner match to the documents themselves since
># the user guided the access and can specify anything DAC allows.
>/run/user/[0-9]*/doc/*/** rw,
>
># Allow access to xdg-desktop-portal and xdg-document-portal
>dbus (receive, send)
>    bus=session
>    interface=org.freedesktop.portal.*
>    path=/org/freedesktop/portal/{desktop,documents}{,/**}
>    peer=(label=unconfined),
>
>dbus (receive, send)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/org/freedesktop/portal/{desktop,documents}{,/**}
>    peer=(label=unconfined),
>
># The portals service is normally running and newer versions of
># xdg-desktop-portal include AssumedAppArmor=unconfined. Since older
># systems don't have this and because gtkfilechoosernativeportal.c relies on
># service activation, allow sends to peer=(name=org.freedesktop.portal.{Desktop,Documents})
># for service activation.
>dbus (send)
>    bus=session
>    interface=org.freedesktop.portal.*
>    path=/org/freedesktop/portal/desktop{,/**}
>    peer=(name=org.freedesktop.portal.Desktop),
>dbus (send)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/org/freedesktop/portal/desktop{,/**}
>    peer=(name=org.freedesktop.portal.Desktop),
>dbus (send)
>    bus=session
>    interface=org.freedesktop.portal.*
>    path=/org/freedesktop/portal/documents{,/**}
>    peer=(name=org.freedesktop.portal.Documents),
>dbus (send)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/org/freedesktop/portal/documents{,/**}
>    peer=(name=org.freedesktop.portal.Documents),
>
># These accesses are noisy and applications can't do anything with the found
># icon files, so explicitly deny to silence the denials
>deny /var/lib/snapd/desktop/icons/{,**/} r,
>
># These accesses occur when flatpaks are on the system since it updates
># XDG_DATA_DIRS to contain $HOME/.local/share/flatpak/exports/share. Until
># we have better XDG_DATA_DIRS handling, silence these noisy denials.
># https://github.com/snapcrafters/discord/issues/23#issuecomment-637607843
>deny @{HOME}/.local/share/flatpak/exports/share/** r,
>
># Allow access to the IBus portal (IBUS_USE_PORTAL=1)
>dbus (send)
>      bus=session
>      path=/org/freedesktop/IBus
>      interface=org.freedesktop.IBus.Portal
>      member=CreateInputContext
>      peer=(name=org.freedesktop.portal.IBus),
>
>dbus (send, receive)
>      bus=session
>      path=/org/freedesktop/IBus/InputContext_[0-9]*
>      interface=org.freedesktop.IBus.InputContext
>      peer=(label=unconfined),
>
>
># Description: Can access common desktop legacy methods. This gives privileged
># access to the user's input.
>
># accessibility (a11y)
> 
>
>##skipped duplicate include <abstractions/dbus-session-strict>
>
>dbus (send)
>    bus=session
>    path=/org/a11y/bus
>    interface=org.a11y.Bus
>    member=GetAddress
>    peer=(label=unconfined),
>
> 
>
>##skipped duplicate include <abstractions/dbus-accessibility-strict>
>
>
># Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
>#   https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
>owner /{,var/}run/user/[0-9]*/at-spi/bus* rw,
>
># Allow access to the socket used by speech-dispatcher
>owner /{,var/}run/user/[0-9]*/speech-dispatcher/speechd.sock rw,
>
># Allow the accessibility services in the user session to send us any events
>dbus (receive)
>    bus=accessibility
>    peer=(label=unconfined),
>
># Allow querying for capabilities and registering
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/accessible/root"
>    interface="org.a11y.atspi.Socket"
>    member="Embed"
>    peer=(name=org.a11y.atspi.Registry, label=unconfined),
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/registry"
>    interface="org.a11y.atspi.Registry"
>    member="GetRegisteredEvents"
>    peer=(name=org.a11y.atspi.Registry, label=unconfined),
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/registry/deviceeventcontroller"
>    interface="org.a11y.atspi.DeviceEventController"
>    member="Get{DeviceEvent,Keystroke}Listeners"
>    peer=(name=org.a11y.atspi.Registry, label=unconfined),
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/registry/deviceeventcontroller"
>    interface="org.a11y.atspi.DeviceEventController"
>    member="NotifyListenersSync"
>    peer=(name=org.a11y.atspi.Registry, label=unconfined),
>
># org.a11y.atspi is not designed for application isolation and these rules
># can be used to send change events for other processes.
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/accessible/root"
>    interface="org.a11y.atspi.Event.Object"
>    member="ChildrenChanged"
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/accessible/root"
>    interface="org.a11y.atspi.Accessible"
>    member="Get*"
>    peer=(label=unconfined),
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/accessible/[0-9]*"
>    interface="org.a11y.atspi.Event.Object"
>    member="{ChildrenChanged,PropertyChange,StateChanged,TextCaretMoved}"
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/accessible/[0-9]*"
>    interface="org.freedesktop.DBus.Properties"
>    member="Get{,All}"
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=accessibility
>    path="/org/a11y/atspi/cache"
>    interface="org.a11y.atspi.Cache"
>    member="{Add,Remove}Accessible"
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
>
># ibus
># subset of ibus abstraction
>/usr/lib/@{multiarch}/gtk-2.0/[0-9]*/immodules/im-ibus.so mr,
>owner @{HOME}/.config/ibus/      r,
>owner @{HOME}/.config/ibus/bus/  r,
>owner @{HOME}/.config/ibus/bus/* r,
>
># allow communicating with ibus-daemon (this allows sniffing key events)
>unix (connect, receive, send)
>    type=stream
>    peer=(addr="@/tmp/ibus/dbus-*"),
>
># abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache)
># This should use this, but due to LP: #1856738 we cannot
>#unix (connect, receive, send)
>#    type=stream
>#    peer=(addr="@@{HOME}/.cache/ibus/dbus-*"),
>unix (connect, receive, send)
>     type=stream
>     peer=(addr="@/home/*/.cache/ibus/dbus-*"),
>
># when running with glib >= 2.75.0, ibus uses a regular socket
>owner @{HOME}/.cache/ibus/dbus-* rw,
>
>
># mozc
># allow communicating with mozc server
>unix (connect, receive, send)
>     type=stream
>     peer=(addr="@tmp/.mozc.*"),
>
>
># fcitx
># allow communicating with fcitx dbus service
>dbus send
>    bus=fcitx
>    path=/org/freedesktop/DBus
>    interface=org.freedesktop.DBus
>    member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
>    peer=(name=org.freedesktop.DBus),
>
>owner @{HOME}/.config/fcitx/dbus/* r,
>
># allow creating an input context
>dbus send
>    bus={fcitx,session}
>    path=/inputmethod
>    interface=org.fcitx.Fcitx.InputMethod
>    member=CreateIC*
>    peer=(label=unconfined),
>
># allow setting up and tearing down the input context
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="{Close,Destroy,Enable}IC"
>    peer=(label=unconfined),
>
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member=Reset
>    peer=(label=unconfined),
>
># allow service to send us signals
>dbus receive
>    bus=fcitx
>    peer=(label=unconfined),
>
>dbus receive
>    bus=session
>    interface=org.fcitx.Fcitx.*
>    peer=(label=unconfined),
>
># use the input context
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="Focus{In,Out}"
>    peer=(label=unconfined),
>
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="{CommitPreedit,Set*}"
>    peer=(label=unconfined),
>
># this is an information leak and allows key and mouse sniffing. If the input
># context path were tied to the process' security label, this would not be an
># issue.
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.fcitx.Fcitx.InputContext
>    member="{MouseEvent,ProcessKeyEvent}"
>    peer=(label=unconfined),
>
># this method does not exist with the sunpinyin backend (at least), so allow
># it for other input methods. This may consitute an information leak (which,
># again, could be avoided if the path were tied to the process' security
># label).
>dbus send
>    bus={fcitx,session}
>    path=/inputcontext_[0-9]*
>    interface=org.freedesktop.DBus.Properties
>    member=GetAll
>    peer=(label=unconfined),
>
># gtk2/gvfs gtk_show_uri()
>dbus (send)
>    bus=session
>    path=/org/gtk/vfs/mounttracker
>    interface=org.gtk.vfs.MountTracker
>    member=ListMountableInfo,
>dbus (send)
>    bus=session
>    path=/org/gtk/vfs/mounttracker
>    interface=org.gtk.vfs.MountTracker
>    member=LookupMount,
>
># Support applications which use the unity messaging menu, xdg-mime, etc
># This leaks the names of snaps with desktop files
>/var/lib/snapd/desktop/applications/ r,
># Allowing reading only our desktop files (required by (at least) the unity
># messaging menu).
># parallel-installs: this leaks read access to desktop files owned by keyed
># instances of @{SNAP_NAME} to @{SNAP_NAME} snap
>/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,
># Explicitly deny access to other snap's desktop files
>deny /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,
>deny /var/lib/snapd/desktop/applications/[^a]* r,
>deny /var/lib/snapd/desktop/applications/a[^c]* r,
>deny /var/lib/snapd/desktop/applications/ac[^e]* r,
>deny /var/lib/snapd/desktop/applications/ace[^s]* r,
>deny /var/lib/snapd/desktop/applications/aces[^t]* r,
>deny /var/lib/snapd/desktop/applications/acest[^r]* r,
>deny /var/lib/snapd/desktop/applications/acestr[^e]* r,
>deny /var/lib/snapd/desktop/applications/acestre[^a]* r,
>deny /var/lib/snapd/desktop/applications/acestrea[^m]* r,
>deny /var/lib/snapd/desktop/applications/acestream[^p]* r,
>deny /var/lib/snapd/desktop/applications/acestreamp[^l]* r,
>deny /var/lib/snapd/desktop/applications/acestreampl[^a]* r,
>deny /var/lib/snapd/desktop/applications/acestreampla[^y]* r,
>deny /var/lib/snapd/desktop/applications/acestreamplay[^e]* r,
>deny /var/lib/snapd/desktop/applications/acestreamplaye[^r]* r,
>
># Snaps are unable to use the data in mimeinfo.cache (since they can't execute
># the returned desktop file themselves). unity messaging menu doesn't require
># mimeinfo.cache and xdg-mime will fallback to reading the desktop files
># directly to look for MimeType. Since reading the snap's own desktop files is
># allowed, we can safely deny access to this file (and xdg-mime will either
># return one of the snap's mimetypes, or none).
>deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,
>
># glib-networking's GLib proxy (different than the portal's proxy service
># org.freedesktop.portal.ProxyResolver). The Lookup API allows specifying
># various URLs (eg, file://, http:// and https://) which will be given to the
># unconfined glib-pacrunner.
>dbus (send)
>    bus=session
>    path=/org/gtk/GLib/PACRunner
>    interface=org.gtk.GLib.PACRunner
>    member=Lookup
>    peer=(label=unconfined),
>
># app-indicators
>dbus (send)
>    bus=session
>    path=/StatusNotifierWatcher
>    interface=org.freedesktop.DBus.Introspectable
>    member=Introspect
>    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/org/freedesktop/DBus
>    interface=org.freedesktop.DBus
>    member="{GetConnectionUnixProcessID,RequestName,ReleaseName}"
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
>dbus (bind)
>    bus=session
>    name=org.kde.StatusNotifierItem-[0-9]*,
>
>dbus (send)
>    bus=session
>    path=/StatusNotifierWatcher
>    interface=org.freedesktop.DBus.Properties
>    member=Get
>    peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/{StatusNotifierWatcher,org/ayatana/NotificationItem/*}
>    interface=org.kde.StatusNotifierWatcher
>    member=RegisterStatusNotifierItem
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
>    interface=org.kde.StatusNotifierItem
>    member="New{AttentionIcon,Icon,IconThemePath,OverlayIcon,Status,Title,ToolTip}"
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
>    interface=org.kde.StatusNotifierItem
>    member={Activate,ContextMenu,Scroll,SecondaryActivate,ProvideXdgActivationToken,XAyatanaSecondaryActivate}
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/{StatusNotifierItem/menu,org/ayatana/NotificationItem/*/Menu}
>    interface=com.canonical.dbusmenu
>    member="{LayoutUpdated,ItemsPropertiesUpdated}"
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/{StatusNotifierItem,StatusNotifierItem/menu,org/ayatana/NotificationItem/**}
>    interface={org.freedesktop.DBus.Properties,com.canonical.dbusmenu}
>    member={Get*,AboutTo*,Event*}
>    peer=(label=unconfined),
>
># notifications
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member={ActionInvoked,NotificationClosed,NotificationReplied}
>    peer=(label=unconfined),
>
># KDE Plasma's Inhibited property indicating "do not disturb" mode
># https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member="Get{,All}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member=PropertiesChanged
>    peer=(label=unconfined),
>
>dbus (send)
>    bus=session
>    path=/org/ayatana/NotificationItem/*
>    interface=org.kde.StatusNotifierItem
>    member=XAyatanaNew*
>    peer=(name=org.freedesktop.DBus, label=unconfined),
>
>
># Description: Can access global gsettings of the user's session. Restricted
># because this gives privileged access to sensitive information stored in
># gsettings and allows adjusting settings of other applications. Future GLib
># will not require plugging the interface and will instead probe if running
># under confinement and use a private data store in $SNAP_USER_DATA).
>
> 
>
>##skipped duplicate include <abstractions/dbus-session-strict>
>
>
> 
>
>##included <abstractions/dconf>
># vim:syntax=apparmor
>
>  abi <abi/3.0>,
>
># permissions for querying dconf settings; granting write access should
># be specified in a specific application's profile.
>
>  /etc/dconf/** r,
>  owner @{run}/user/*/dconf/user r,
>  owner @{HOME}/.config/dconf/user r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/dconf.d>
>
>
>owner /{,var/}run/user/*/dconf/user w,
>owner @{HOME}/.config/dconf/user w,
>dbus (receive, send)
>    bus=session
>    interface="ca.desrt.dconf.Writer"
>    peer=(label=unconfined),
>
>
># Description: Can access non-hidden files in user's $HOME. This is restricted
># because it gives file access to all of the user's $HOME.
>
># Note, @{HOME} is the user's $HOME, not the snap's $HOME
>
># Allow read access to toplevel $HOME for the user
>owner @{HOME}/ r,
>
># Allow read/write access to all files in @{HOME}, except snap application
># data in @{HOME}/snap and toplevel hidden directories in @{HOME}.
>owner @{HOME}/[^s.]**             rwklix,
>owner @{HOME}/s[^n]**             rwklix,
>owner @{HOME}/sn[^a]**            rwklix,
>owner @{HOME}/sna[^p]**           rwklix,
>owner @{HOME}/snap[^/]**          rwklix,
>
># Allow creating a few files not caught above
>owner @{HOME}/{s,sn,sna}{,/} rwklix,
>
># Allow access to @{HOME}/snap/ to allow directory traversals from
># @{HOME}/snap/@{SNAP_INSTANCE_NAME} through @{HOME}/snap to @{HOME}.
># While this leaks snap names, it fixes usability issues for snaps
># that require this transitional interface.
>owner @{HOME}/snap/ r,
>
># Allow access to gvfs mounts for files owned by the user (including hidden
># files; only allow writes to files, not the mount point).
>owner /run/user/[0-9]*/gvfs/{,**} r,
>owner /run/user/[0-9]*/gvfs/*/**  w,
>
># Disallow writes to the well-known directory included in
># the user's PATH on several distributions
>audit deny @{HOME}/bin/{,**} wl,
>
>
># Description: Can access the X server. Restricted because X does not prevent
># eavesdropping or apps interfering with one another.
>
># The X abstraction doesn't check the peer label, but in this case that's
># ok because x11ConnectedSlotAppArmor will limit which clients can connect
># to the slot implementation.
> 
>
>##skipped duplicate include <abstractions/X>
>
> 
>
>##skipped duplicate include <abstractions/fonts>
>
>owner @{HOME}/.local/share/fonts/{,**} r,
>/var/cache/fontconfig/   r,
>/var/cache/fontconfig/** mr,
>
># Allow access to the user specific copy of the xauth file specified
># in the XAUTHORITY environment variable, that "snap run" creates on
># startup.
>owner /run/user/[0-9]*/.Xauthority r,
>
># Allow reading an Xwayland Xauth file
># (see https://gitlab.gnome.org/GNOME/mutter/merge_requests/626)
>owner /run/user/[0-9]*/.mutter-Xwaylandauth.* r,
>owner /run/user/[0-9]*/mutter/Xauthority r,
>
># Allow reading KDE Plasma's Xwayland Xauth file
>owner /run/user/[0-9]*/xauth_* r,
>
>
># Needed by QtSystems on X to detect mouse and keyboard. Note, the 'netlink
># raw' rule is not finely mediated by apparmor so we mediate with seccomp arg
># filtering.
>network netlink raw,
>/run/udev/data/c13:[0-9]* r,
>/run/udev/data/+input:* r,
>
># Deny access to ICE granted by abstractions/X
># See: https://bugs.launchpad.net/snapd/+bug/1901489
>deny owner @{HOME}/.ICEauthority r,
>deny owner /run/user/*/ICEauthority r,
>deny unix (connect, receive, send)
>    type=stream
>    peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
>
>
># Description: Can access the network as a client.
> 
>
>##included <abstractions/nameservice>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # Many programs wish to perform nameservice-like operations, such as
>  # looking up users by name or id, groups by name or id, hosts by name
>  # or IP, etc. These operations may be performed through files, dns,
>  # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
>  @{etc_ro}/group          r,
>  @{etc_ro}/host.conf      r,
>  @{etc_ro}/hosts          r,
>  @{etc_ro}/nsswitch.conf  r,
>  @{etc_ro}/gai.conf       r,
>  @{etc_ro}/passwd         r,
>  @{etc_ro}/protocols      r,
>
>  # libtirpc (used for NIS/YP login) needs this
>  @{etc_ro}/netconfig r,
>
>  # When using libnss-extrausers, the passwd and group files are merged from
>  # an alternate path
>  /var/lib/extrausers/group  r,
>  /var/lib/extrausers/passwd r,
>
>  # When using sssd, the passwd and group files are stored in an alternate path
>  # and the nss plugin also needs to talk to a pipe
>  /var/lib/sss/mc/group   r,
>  /var/lib/sss/mc/initgroups r,
>  /var/lib/sss/mc/passwd  r,
>  /var/lib/sss/pipes/nss  rw,
>
>  @{etc_ro}/resolv.conf r,
>  # On systems where /etc/resolv.conf is managed programmatically, it is
>  # a symlink to @{run}/(whatever program is managing it)/resolv.conf.
>  @{run}/{resolvconf,NetworkManager,systemd/resolve,connman,netconfig}/resolv.conf r,
>  @{etc_ro}/resolvconf/run/resolv.conf  r,
>  @{run}/systemd/resolve/stub-resolv.conf r,
>  /mnt/wsl/resolv.conf r,
>
>  @{etc_ro}/samba/lmhosts  r,
>  @{etc_ro}/services       r,
>  # db backend
>  /var/lib/misc/*.db      r,
>  # The Name Service Cache Daemon can cache lookups, sometimes leading
>  # to vast speed increases when working with network-based lookups.
>  @{run}/.nscd_socket   rw,
>  @{run}/nscd/socket    rw,
>  /{var/db,var/cache,var/lib,var/run,run}/nscd/{passwd,group,services,hosts}    r,
>  # nscd renames and unlinks files in it's operation that clients will
>  # have open
>  @{run}/nscd/db*  rmix,
>
>  # The nss libraries are sometimes used in addition to PAM; make sure
>  # they are available
>  /{usr/,}lib{,32,64}/libnss_*.so*      mr,
>  /{usr/,}lib/@{multiarch}/libnss_*.so*      mr,
>  @{etc_ro}/default/nss               r,
>
>  # avahi-daemon is used for mdns4 resolution
>  @{run}/avahi-daemon/socket rw,
>
>  # libnl-3-200 via libnss-gw-name
>  @{PROC}/@{pid}/net/psched r,
>  @{etc_ro}/libnl-*/classid r,
>
>  # nis
>   
>
>##included <abstractions/nis>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2006 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # NIS rules
>  /var/yp/binding/*           r,
>  # portmapper may ask root processes to do nis/ldap at low ports
>  capability net_bind_service,
>
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/nis.d>
>
>
>
>  # ldap
>   
>
>##included <abstractions/ldapclient>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # files required by LDAP clients (e.g. nss_ldap/pam_ldap)
>  /etc/ldap.conf            r,
>  /etc/ldap.secret          r,
>  /etc/openldap/*           r,
>  /etc/openldap/cacerts/*   r,
>
>  # SASL plugins and config
>  /etc/sasl2/*              r,
>  /usr/lib{,32,64}/sasl2/*  r,
>
>  # local LDAP name service daemon
>  @{run}/nslcd/socket  rw,
>
>   
>
>##included <abstractions/ssl_certs>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2005 Novell/SUSE
>#    Copyright (C) 2010-2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /etc/ca-certificates/{,**} r,
>  /etc/{,libre}ssl/ r,
>  /etc/{,libre}ssl/cert.pem r,
>  /etc/{,libre}ssl/certs/{,**} r,
>  /{etc,usr/share}/pki/bl[ao]cklist/{,*} r,
>  /{etc,usr/share}/pki/trust/{,*} r,
>  /{etc,usr/share}/pki/trust/{bl[oa]cklist,anchors}/{,**} r,
>  /usr/share/ca-certificates/{,**} r,
>  /usr/share/ssl/certs/ca-bundle.crt          r,
>  /usr/local/share/ca-certificates/{,**} r,
>  /var/lib/ca-certificates/{,**} r,
>
>  # acmetool
>  /var/lib/acme/certs/*/chain r,
>  /var/lib/acme/certs/*/cert r,
>
>  # dehydrated
>  /{etc,var/lib}/dehydrated/certs/*/cert*.pem r,
>  /{etc,var/lib}/dehydrated/certs/*/chain*.pem r,
>  /{etc,var/lib}/dehydrated/certs/*/fullchain*.pem r,
>  /{etc,var/lib}/dehydrated/certs/*/ocsp*.der r,
>
>  # certbot
>  /etc/letsencrypt/archive/*/cert*.pem r,
>  /etc/letsencrypt/archive/*/chain*.pem r,
>  /etc/letsencrypt/archive/*/fullchain*.pem r,
>
>  /etc/certbot/archive/*/cert*.pem r,
>  /etc/certbot/archive/*/chain*.pem r,
>  /etc/certbot/archive/*/fullchain*.pem r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/ssl_certs.d>
>
>
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/ldapclient.d>
>
>
>
>  # winbind
>   
>
>##included <abstractions/winbind>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # pam_winbindd
>  /tmp/.winbindd/pipe  rw,
>  /var/lib/samba/winbindd_privileged/pipe rw,
>  @{run}/samba/winbindd_privileged/pipe rw,
>  /etc/samba/smb.conf         r,
>  /etc/samba/dhcp.conf        r,
>  /usr/lib*/samba/valid.dat   r,
>  /usr/lib*/samba/upcase.dat  r,
>  /usr/lib*/samba/lowcase.dat r,
>  /usr/share/samba/codepages/{lowcase,upcase,valid}.dat r,
>
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/winbind.d>
>
>
>
>  # likewise
>   
>
>##included <abstractions/likewise>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /tmp/.lwidentity/pipe       rw,
>  /var/lib/likewise-open/lwidentity_privileged/pipe rw,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/likewise.d>
>
>
>
>  # mdnsd
>   
>
>##included <abstractions/mdns>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2006 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # mdnsd
>  /etc/mdns.allow r,
>  /etc/nss_mdns.conf r,
>  @{run}/mdnsd w,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/mdns.d>
>
>
>
>  # kerberos
>   
>
>##included <abstractions/kerberosclient>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # files required by kerberos client programs
>  /usr/lib{,32,64}/krb5/plugins/libkrb5/ r,
>  /usr/lib{,32,64}/krb5/plugins/libkrb5/* mr,
>  /usr/lib/@{multiarch}/krb5/plugins/libkrb5/ r,
>  /usr/lib/@{multiarch}/krb5/plugins/libkrb5/* mr,
>
>  /usr/lib{,32,64}/krb5/plugins/preauth/ r,
>  /usr/lib{,32,64}/krb5/plugins/preauth/* mr,
>  /usr/lib/@{multiarch}/krb5/plugins/preauth/ r,
>  /usr/lib/@{multiarch}/krb5/plugins/preauth/* mr,
>
>  /usr/lib{,32,64}/krb5/plugins/authdata/ r,
>  /usr/lib{,32,64}/krb5/plugins/authdata/* mr,
>  /usr/lib/@{multiarch}/krb5/plugins/authdata/ r,
>  /usr/lib/@{multiarch}/krb5/plugins/authdata/* mr,
>
>  /etc/krb5.keytab            rk,
>  /etc/krb5.conf              r,
>  /etc/krb5.conf.d/           r,
>  /etc/krb5.conf.d/*          r,
>
>  # config files found via strings on libs
>  /etc/krb.conf               r,
>  /etc/krb.realms             r,
>  /etc/srvtab                 r,
>
>  # credential caches
>  /tmp/krb5cc* r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/kerberosclient.d>
>
>
>
>  #libnss-systemd
>   
>
>##included <abstractions/nss-systemd>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
># libnss-systemd
>  #
>  #   https://systemd.io/USER_GROUP_API/
>  #   https://systemd.io/USER_RECORD/
>  #   https://www.freedesktop.org/software/systemd/man/nss-systemd.html
>  #
>  # Allow User/Group lookups via common VarLink socket APIs. Applications need
>  # to either consult all of them or the io.systemd.Multiplexer frontend.
>  @{run}/systemd/userdb/ r,
>  @{run}/systemd/userdb/io.systemd.Multiplexer rw,
>  @{run}/systemd/userdb/io.systemd.DynamicUser rw,        # systemd-exec users
>  @{run}/systemd/userdb/io.systemd.Home rw,               # systemd-home dirs
>  @{run}/systemd/userdb/io.systemd.NameServiceSwitch rw,  # UNIX/glibc NSS
>  @{run}/systemd/userdb/io.systemd.Machine rw,            # systemd-machined
>
>  @{PROC}/sys/kernel/random/boot_id r,
>
>   
>
>##failed include <abstractions/nss-systemd.d>
>
>
>
>  # Also allow lookups for systemd-exec's DynamicUsers via D-Bus
>  #   https://www.freedesktop.org/software/systemd/man/systemd.exec.html
>  dbus send
>       bus=system
>       path="/org/freedesktop/systemd1"
>       interface="org.freedesktop.systemd1.Manager"
>       member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
>       peer=(name="org.freedesktop.systemd1"),
>
>  # TCP/UDP network access
>  network inet  stream,
>  network inet6 stream,
>  network inet  dgram,
>  network inet6 dgram,
>
>  # TODO: adjust when support finer-grained netlink rules
>  # Netlink raw needed for nscd
>  network netlink raw,
>
>  # interface details
>  @{PROC}/@{pid}/net/route r,
>
>  # Include additions to the abstraction
>   
>
>##failed include <abstractions/nameservice.d>
>
>
>/run/systemd/resolve/stub-resolv.conf rk,
>/etc/mdns.allow r,     # not yet included in the mdns abstraction
>network netlink dgram, # not yet included in the nameservice abstraction
>
># systemd-resolved (not yet included in nameservice abstraction)
>#
># Allow access to the safe members of the systemd-resolved D-Bus API:
>#
>#   https://www.freedesktop.org/wiki/Software/systemd/resolved/
>#
># This API may be used directly over the D-Bus system bus or it may be used
># indirectly via the nss-resolve plugin:
>#
>#   https://www.freedesktop.org/software/systemd/man/nss-resolve.html
>#
> 
>
>##skipped duplicate include <abstractions/dbus-strict>
>
>dbus send
>     bus=system
>     path="/org/freedesktop/resolve1"
>     interface="org.freedesktop.resolve1.Manager"
>     member="Resolve{Address,Hostname,Record,Service}"
>     peer=(name="org.freedesktop.resolve1"),
>
># libnss-systemd (D-Bus portion from nameservice abstraction)
># Also allow lookups for systemd-exec's DynamicUsers via D-Bus
>#   https://www.freedesktop.org/software/systemd/man/systemd.exec.html
>dbus send
>     bus=system
>     path="/org/freedesktop/systemd1"
>     interface="org.freedesktop.systemd1.Manager"
>     member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
>     peer=(name="org.freedesktop.systemd1"),
>
> 
>
>##skipped duplicate include <abstractions/ssl_certs>
>
>
>@{PROC}/sys/net/core/somaxconn r,
>@{PROC}/sys/net/ipv4/tcp_fastopen r,
>
># Allow using netcat as client
>/{,usr/}bin/nc{,.openbsd} ixr,
>
>
># Description: Can access the network as a server.
> 
>
>##skipped duplicate include <abstractions/nameservice>
>
>/run/systemd/resolve/stub-resolv.conf rk,
>network netlink dgram, # not yet included in the nameservice abstraction
>
># systemd-resolved (not yet included in nameservice abstraction)
>#
># Allow access to the safe members of the systemd-resolved D-Bus API:
>#
>#   https://www.freedesktop.org/wiki/Software/systemd/resolved/
>#
># This API may be used directly over the D-Bus system bus or it may be used
># indirectly via the nss-resolve plugin:
>#
>#   https://www.freedesktop.org/software/systemd/man/nss-resolve.html
>#
> 
>
>##skipped duplicate include <abstractions/dbus-strict>
>
>dbus send
>     bus=system
>     path="/org/freedesktop/resolve1"
>     interface="org.freedesktop.resolve1.Manager"
>     member="Resolve{Address,Hostname,Record,Service}"
>     peer=(name="org.freedesktop.resolve1"),
>
> 
>
>##skipped duplicate include <abstractions/ssl_certs>
>
>
># These probably shouldn't be something that apps should use, but this offers
># no information disclosure since the files are in the read-only part of the
># system.
>/etc/hosts.deny r,
>/etc/hosts.allow r,
>
>@{PROC}/sys/net/core/somaxconn r,
>@{PROC}/sys/net/ipv4/ip_local_port_range r,
>
># LP: #1496906: java apps need these for some reason and they leak the IPv6 IP
># addresses and routes. Until we find another way to handle them (see the bug
># for some options), we need to allow them to avoid developer confusion.
>@{PROC}/@{pid}/net/if_inet6 r,
>@{PROC}/@{pid}/net/ipv6_route r,
>
># java apps attempt this, presumably to handle interface changes, but a
># corresponding seccomp socket rule is required to use netlink. When
># fine-grained netlink mediation is implemented (LP: #1669552), we can perhaps
># allow 'read' with NETLINK_ROUTE, but for now we omit it here and don't
># explicitly deny this noisy denial so --devmode isn't broken. LP: #1499897
>#deny network netlink dgram,
>
>
># Only on desktop do we need access to /etc/pulse for any PulseAudio client
># to read available client side configuration settings. On an Ubuntu Core
># device those things will be stored inside the snap directory.
>/etc/pulse/ r,
>/etc/pulse/** r,
>owner @{HOME}/.pulse-cookie rk,
>owner @{HOME}/.config/pulse/cookie rk,
>owner /{,var/}run/user/*/pulse/ rwk,
>owner /{,var/}run/user/*/pulse/native rwk,
>owner /{,var/}run/user/*/pulse/pid r,
>
>}

Actions: View

Attachments on bug 1211989: 867626 | 867627 | 867630 | 867631 | 867632 | 867633 | 867634 | 867635 | 867652