Attachment 867632 Details for Bug 1211989

/sbin/apparmor_parser -pq /var/lib/snapd/apparmor/profiles/snap.chromium.hook.configure

snap.chromium.hook.configure_profile_with_includes (text/plain), 73.68 KB, created by dev on 2023-06-17 00:25:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: dev

Created: 2023-06-17 00:25:50 UTC

Size: 73.68 KB

patch

obsolete

>
># vim:syntax=apparmor
>
> 
>
>##included <tunables/global>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006-2009 Novell/SUSE
>#    Copyright (C) 2010-2014 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># All the tunables definitions that should be available to every profile
># should be included here
>
> 
>
>##included <tunables/home>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006-2009 Novell/SUSE
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{HOMEDIRS} is a space-separated list of where user home directories
># are stored, for programs that must enumerate all home directories on a
># system.
>@{HOMEDIRS}=/home/
>
>
># @{HOME} is a space-separated list of all user home directories. While
># it doesn't refer to a specific home directory (AppArmor doesn't
># enforce discretionary access controls) it can be used as if it did
># refer to a specific home directory
>@{HOME}=@{HOMEDIRS}/*/ /root/
>
>
># Also, include files in tunables/home.d for site-specific adjustments to
># @{HOMEDIRS}.
> 
>
>##included <tunables/home.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following is a space-separated list of where additional user home
># directories are stored, each must have a trailing '/'. Directories added
># here are appended to @{HOMEDIRS}.  See tunables/home for details. Eg:
>#@{HOMEDIRS}+=/srv/nfs/home/ /mnt/home/
>
>
> 
>
>##included <tunables/multiarch>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{multiarch} is the set of patterns matching multi-arch library
># install prefixes.
>@{multiarch}=*-linux-gnu*
>
>
># Also, include files in tunables/multiarch.d for site and packaging
># specific adjustments to @{multiarch}.
> 
>
>##included <tunables/multiarch.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following is a space-separated list of where additional multipath
># prefixes are stored, each should not have a trailing '/'. Directories
># added here are appended to @{multiarch}. See tunables/mutliarch for details. Eg:
>#@{multiarch}+=*-freebsd* s390-hurd-zomg
>
>
> 
>
>##included <tunables/proc>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{PROC} is the location where procfs is mounted.
>@{PROC}=/proc/
>
>
> 
>
>##included <tunables/alias>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># Alias rules can be used to rewrite paths and are done after variable
># resolution. For example, if '/usr' is on removable media:
># alias /usr/ -> /mnt/usr/,
>#
># Or if mysql databases are stored in /home:
># alias /var/lib/mysql/ -> /home/mysql/,
>
> 
>
>##included <tunables/kernelvars>
>#    Copyright (C) 2012 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># This file should contain declarations to kernel vars or variables
># that will become kernel vars at some point
>
># until kernel vars are implemented
># and until the parser supports nested groupings like
>#   @{pid}=[1-9]{[0-9]{[0-9]{[0-9]{[0-9]{[0-9],},},},},}
># use
>@{pid}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]}
>
>
>#same pattern as @{pid} for now
>@{tid}=@{pid}
>
>
>#A pattern for pids that can appear
>@{pids}=@{pid}
>
>
># Placeholder for user id until kernel var is implemented to match
># current user of the confined application.
># Values are 0...4,294,967,295 (32-bit unsigned, 10 digits).
>@{uid}={[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]}
>
>
>#same pattern as @{uid} for now
>@{uids}=@{uid}
>
>
># until kernel var is implemented
>@{sys}=/sys/
>
>
> 
>
>##included <tunables/xdg-user-dirs>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2014 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># Define the common set of XDG user directories (usually defined in
># /etc/xdg/user-dirs.defaults)
>@{XDG_DESKTOP_DIR}="Desktop"
>
>@{XDG_DOWNLOAD_DIR}="Downloads"
>
>@{XDG_TEMPLATES_DIR}="Templates"
>
>@{XDG_PUBLICSHARE_DIR}="Public"
>
>@{XDG_DOCUMENTS_DIR}="Documents"
>
>@{XDG_MUSIC_DIR}="Music"
>
>@{XDG_PICTURES_DIR}="Pictures"
>
>@{XDG_VIDEOS_DIR}="Videos"
>
>
># Also, include files in tunables/xdg-user-dirs.d for site-specific adjustments
># to the various XDG directories
> 
>
>##included <tunables/xdg-user-dirs.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2014 Canonical Ltd.
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following may be used to add additional entries such as for
># translations. See tunables/xdg-user-dirs for details. Eg:
>#@{XDG_MUSIC_DIR}+="Musique"
>
>#@{XDG_DESKTOP_DIR}+=""
>#@{XDG_DOWNLOAD_DIR}+=""
>#@{XDG_TEMPLATES_DIR}+=""
>#@{XDG_PUBLICSHARE_DIR}+=""
>#@{XDG_DOCUMENTS_DIR}+=""
>#@{XDG_MUSIC_DIR}+=""
>#@{XDG_PICTURES_DIR}+=""
>#@{XDG_VIDEOS_DIR}+=""
>
>
> 
>
>##included <tunables/share>
>@{flatpak_exports_root} = {flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}
>
>
># System-wide directories with behaviour analogous to /usr/share
># in patterns like the freedesktop.org basedir spec. These are
># owned by root or a system user, appear in XDG_DATA_DIRS, and
># are the parent directory for `applications`, `themes`,
># `dbus-1/services`, etc.
>@{system_share_dirs} = /{usr,usr/local,var/lib/@{flatpak_exports_root}}/share
>
>
># Per-user/personal directories with behaviour analogous to
># ~/.local/share in patterns like the freedesktop.org basedir spec.
># These are owned by the user running an application, appear in
># XDG_DATA_DIRS or XDG_DATA_HOME, and are the parent directory
># for the same subdirectories as @{system_share_dirs}
>@{user_share_dirs} = @{HOME}/.local{,/share/@{flatpak_exports_root}}/share
>
>
> 
>
>##included <tunables/etc>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2020 Christian Boltz
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{etc_ro} contains a space-separated list of the system configuration directories.
># Traditionally this means /etc/, but when using a read-only / filesystem and/or
># with the goal of having only user-modified config files in /etc/, directories
># like /usr/etc/ get introduced for storing the default config.
>
># @{etc_ro} contains directories with configuration files, including read-only directories.
># Do not use @{etc_ro} in rules that allow write access.
>@{etc_ro}=/etc/ /usr/etc/
>
>
># @{etc_rw} contains directories where writing to configuration files is allowed.
># @{etc_rw} should always be a subset of @{etc_ro}.
>#
># Only use @{etc_rw} if the profile allows writing to a configuration file.
># For rules that only allows read access, use @{etc_ro}.
>@{etc_rw}=/etc/
>
>
># Also, include files in tunables/etc.d/ for site-specific adjustments to
># @{etc_ro} and @{etc_rw}.
> 
>
>##included <tunables/etc.d>
>
>
> 
>
>##included <tunables/run>
>@{run}=/run/ /var/run/
>
>
>
>
> 
>
>##included "/var/lib/snapd/apparmor/snap-tuning"
>
>
># snapd supports the concept of 'parallel installs' where snaps with the same
># name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz
># may all be installed on the system. To support this, SNAP_NAME is set to the
># name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg
># 'foo_bar'). The profile name and most rules therefore reference
># SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime
># environment so the snap doesn't have to be aware of the distinction (eg,
># SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with
># SNAP_NAME so the security policy will allow writing to both locations (since
># they are equivalent).
>
># This is a snap name without the instance key
>@{SNAP_NAME}="chromium"
>
># This is a snap name with instance key
>@{SNAP_INSTANCE_NAME}="chromium"
>
>@{SNAP_INSTANCE_DESKTOP}="chromium"
>
>@{SNAP_COMMAND_NAME}="hook.configure"
>
>@{SNAP_REVISION}="2475"
>
>@{PROFILE_DBUS}="snap_2echromium_2ehook_2econfigure"
>
>@{INSTALL_DIR}="/{,var/lib/snapd/}snap"
>
>
>profile "snap.chromium.hook.configure" (attach_disconnected,mediate_deleted) {
>   
>
>##included <abstractions/base>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>   
>
>##included <abstractions/crypto>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009-2011 Canonical Ltd.
>#    Copyright (C) 2021 Christian Boltz
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  @{etc_ro}/gcrypt/hwf.deny r,
>  @{etc_ro}/gcrypt/random.conf r,
>  @{PROC}/sys/crypto/fips_enabled r,
>
>  # libgcrypt reads some flags from /proc
>  @{PROC}/sys/crypto/* r,
>
>  # crypto policies used by various libraries
>  /etc/crypto-policies/*/*.txt r,
>  /usr/share/crypto-policies/*/*.txt r,
>
>   
>
>##included <abstractions/crypto.d>
>
>
>
>  # (Note that the ldd profile has inlined this file; if you make
>  # modifications here, please consider including them in the ldd
>  # profile as well.)
>
>  # The __canary_death_handler function writes a time-stamped log
>  # message to /dev/log for logging by syslogd. So, /dev/log, timezones,
>  # and localisations of date should be available EVERYWHERE, so
>  # StackGuard, FormatGuard, etc., alerts can be properly logged.
>  /dev/log                       w,
>  /dev/random                    r,
>  /dev/urandom                   r,
>  # Allow access to the uuidd daemon (this daemon is a thin wrapper around
>  # time and getrandom()/{,u}random and, when available, runs under an
>  # unprivilged, dedicated user).
>  @{run}/uuidd/request           r,
>  @{etc_ro}/locale/**          r,
>  @{etc_ro}/locale.alias       r,
>  @{etc_ro}/localtime          r,
>  /usr/share/locale-bundle/**    r,
>  /usr/share/locale-langpack/**  r,
>  /usr/share/locale/**           r,
>  /usr/share/**/locale/**        r,
>  /usr/share/zoneinfo{,-icu}/    r,
>  /usr/share/zoneinfo{,-icu}/**  r,
>  /usr/share/X11/locale/**       r,
>  @{run}/systemd/journal/dev-log w,
>  # systemd native journal API (see sd_journal_print(4))
>  @{run}/systemd/journal/socket  w,
>  # Nested containers and anything using systemd-cat need this. 'r' shouldn't
>  # be required but applications fail without it. journald doesn't leak
>  # anything when reading so this is ok.
>  @{run}/systemd/journal/stdout  rw,
>
>  /usr/lib{,32,64}/locale/**             mr,
>  /usr/lib{,32,64}/gconv/*.so            mr,
>  /usr/lib{,32,64}/gconv/gconv-modules*  mr,
>  /usr/lib/@{multiarch}/gconv/*.so           mr,
>  /usr/lib/@{multiarch}/gconv/gconv-modules* mr,
>
>  # used by glibc when binding to ephemeral ports
>  @{etc_ro}/bindresvport.blacklist    r,
>
>  # ld.so.cache and ld are used to load shared libraries; they are best
>  # available everywhere
>  @{etc_ro}/ld.so.cache               mr,
>  @{etc_ro}/ld.so.conf                r,
>  @{etc_ro}/ld.so.conf.d/{,*.conf}    r,
>  @{etc_ro}/ld.so.preload             r,
>  /{usr/,}lib{,32,64}/ld{,32,64}-*.so   mr,
>  /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so    mr,
>  /{usr/,}lib/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
>  /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
>  /opt/*-linux-uclibc/lib/ld-uClibc*so* mr,
>
>  # we might as well allow everything to use common libraries
>  /{usr/,}lib{,32,64}/**                r,
>  /{usr/,}lib{,32,64}/**.so*       mr,
>  /{usr/,}lib/@{multiarch}/**            r,
>  /{usr/,}lib/@{multiarch}/**.so*   mr,
>  /{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so*    mr,
>  /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so*    mr,
>
>  # FIPS-140-2 versions of some crypto libraries need to access their
>  # associated integrity verification file, or they will abort.
>  /{usr/,}lib{,32,64}/.lib*.so*.hmac      r,
>  /{usr/,}lib/@{multiarch}/.lib*.so*.hmac r,
>
>  # /dev/null is pretty harmless and frequently used
>  /dev/null                      rw,
>  # as is /dev/zero
>  /dev/zero                      rw,
>  # recent glibc uses /dev/full in preference to /dev/null for programs
>  # that don't have open fds at exec()
>  /dev/full                      rw,
>
>  # Sometimes used to determine kernel/user interfaces to use
>  @{PROC}/sys/kernel/version     r,
>  # Depending on which glibc routine uses this file, base may not be the
>  # best place -- but many profiles require it, and it is quite harmless.
>  @{PROC}/sys/kernel/ngroups_max r,
>
>  # glibc's sysconf(3) routine to determine free memory, etc
>  @{PROC}/meminfo                r,
>  @{PROC}/stat                   r,
>  @{PROC}/cpuinfo                r,
>  @{sys}/devices/system/cpu/       r,
>  @{sys}/devices/system/cpu/online r,
>  @{sys}/devices/system/cpu/possible r,
>
>  # glibc's *printf protections read the maps file
>  @{PROC}/@{pid}/{maps,auxv,status} r,
>
>  # some applications will display license information
>  /usr/share/common-licenses/**  r,
>
>  # glibc statvfs
>  @{PROC}/filesystems            r,
>
>  # glibc malloc (man 5 proc)
>  @{PROC}/sys/vm/overcommit_memory r,
>
>  # Allow determining the highest valid capability of the running kernel
>  @{PROC}/sys/kernel/cap_last_cap r,
>
>  # Allow other processes to read our /proc entries, futexes, perf tracing and
>  # kcmp for now (they will need 'read' in the first place). Administrators can
>  # override with:
>  #   deny ptrace (readby) ...
>  ptrace (readby),
>
>  # Allow other processes to trace us by default (they will need 'trace' in
>  # the first place). Administrators can override with:
>  #   deny ptrace (tracedby) ...
>  ptrace (tracedby),
>
>  # Allow us to ptrace read ourselves
>  ptrace (read) peer=@{profile_name},
>
>  # Allow unconfined processes to send us signals by default
>  signal (receive) peer=unconfined,
>
>  # Allow us to signal ourselves
>  signal peer=@{profile_name},
>
>  # Checking for PID existence is quite common so add it by default for now
>  signal (receive, send) set=("exists"),
>
>  # Allow us to create and use abstract and anonymous sockets
>  unix peer=(label=@{profile_name}),
>
>  # Allow unconfined processes to us via unix sockets
>  unix (receive) peer=(label=unconfined),
>
>  # Allow us to create abstract and anonymous sockets
>  unix (create),
>
>  # Allow us to getattr, getopt, setop and shutdown on unix sockets
>  unix (getattr, getopt, setopt, shutdown),
>
>  # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked
>  # filesystems generally. This does not appreciably decrease security with
>  # Ubuntu profiles because the user is expected to have access to files owned
>  # by him/her. Exceptions to this are explicit in the profiles. While this rule
>  # grants access to those exceptions, the intended privacy is maintained due to
>  # the encrypted contents of the files in this directory. Files in this
>  # directory will also use filename encryption by default, so the files are
>  # further protected. Also, with the use of 'owner', this rule properly
>  # prevents access to the files from processes running under a different uid.
>
>  # encrypted ~/.Private and old-style encrypted $HOME
>  owner @{HOME}/.Private/ r,
>  owner @{HOME}/.Private/** mrixwlk,
>  # new-style encrypted $HOME
>  owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
>  owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,
>
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/base.d>
>
>
>   
>
>##included <abstractions/consoles>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2005 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>
>  # there are three common ways to refer to consoles
>  /dev/console rw,
>  /dev/tty     rw,
>  # this next entry is a tad unfortunate; /dev/tty will always be
>  # associated with the controlling terminal by the kernel, but if a
>  # program uses the /dev/pts/ interface, it actually has access to
>  # -all- xterm, sshd, etc, terminals on the system.
>  /dev/pts/[0-9]*   rw,
>  /dev/pts/         r,
>
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/consoles.d>
>
>
>   
>
>##included <abstractions/openssl>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /etc/ssl/openssl.cnf r,
>  /etc/ssl/openssl-*.cnf r,
>  /etc/ssl/{engdef,engines}.d/ r,
>  /etc/ssl/{engdef,engines}.d/*.cnf r,
>  /usr/share/ssl/openssl.cnf r,
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/openssl.d>
>
>
>
>  # While in later versions of the base abstraction, include this explicitly
>  # for series 16 and cross-distro
>  /etc/ld.so.preload r,
>
>  # The base abstraction doesn't yet have this
>  /etc/sysconfig/clock r,
>  owner @{PROC}/@{pid}/maps k,
>
>  # /proc/XXXX/map_files contains the same info than /proc/XXXX/maps, but
>  # in a format that is simpler to manage, because it doesn't require to
>  # parse the text data inside a file, but just reading the contents of
>  # a directory.
>  # Reading /proc/XXXX/maps is already allowed in the base template
>  # via <abstractions/base>. Also, only the owner can read it, and the
>  # kernel limits access to it by requiring 'ptrace' enabled, so allowing
>  # to access /proc/XXXX/map_files can be considered secure too.
>  owner @{PROC}/@{pid}/map_files/ r,
>
>  # While the base abstraction has rules for encryptfs encrypted home and
>  # private directories, it is missing rules for directory read on the toplevel
>  # directory of the mount (LP: #1848919)
>  owner @{HOME}/.Private/ r,
>  owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
>
>  # for python apps/services
>   
>
>##included <abstractions/python>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2006 Novell/SUSE
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so,so.*[0-9]} mr,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth}       r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.dist-info/{METADATA,namespace_packages.txt} r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.VERSION r,
>  /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.egg-info/PKG-INFO r,
>  /usr/{local/,}lib{,32,64}/python3.{1,}[0-9]/lib-dynload/*.so            mr,
>
>  # Site-wide configuration
>  /etc/python{2.[4-7],3.[0-9],3.1[0-9]}/** r,
>
>  # shared python paths
>  /usr/share/{pyshared,pycentral,python-support}/**      r,
>  /{var,usr}/lib/{pyshared,pycentral,python-support}/**  r,
>  /usr/lib/{pyshared,pycentral,python-support}/**.so     mr,
>  /var/lib/{pyshared,pycentral,python-support}/**.pyc    mr,
>  /usr/lib/python3/dist-packages/**.so          mr,
>
>  # wx paths
>  /usr/lib/wx/python/*.pth r,
>
>  # python build configuration and headers
>  /usr/include/python{2.[4-7],3.[0-9],3.1[0-9]}*/pyconfig.h r,
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/python.d>
>
>
>  /etc/python3.[0-9]*/**                                r,
>
>  # explicitly deny noisy denials to read-only filesystems (see LP: #1496895
>  # for details)
>  deny /usr/lib/python3*/{,**/}__pycache__/ w,
>  deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w,
>  # bind mount used here (see 'parallel installs', above)
>  deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/             w,
>  deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w,
>
>  # for perl apps/services
>   
>
>##included <abstractions/perl>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # a few files typically required for perl scripts
>  /usr/bin/perl                  rmix,
>  /usr/bin/perl[0-9].[0-9].[0-9] rmix,
>
>  /usr/lib{,32,64}/perl5/**                    r,
>  /usr/lib{,32,64}/perl{,5}/**.so*             mr,
>  /usr/lib/@{multiarch}/perl{,5,-base}/**            r,
>  /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,
>
>  /usr/share/perl/**             r,
>  /usr/share/perl5/**            r,
>  /etc/perl/**                   r,
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/perl.d>
>
>
>  # Missing from perl abstraction
>  /usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr,
>
>  # Note: the following dangerous accesses should not be allowed in most
>  # policy, but we cannot explicitly deny since other trusted interfaces might
>  # add them.
>  # Explicitly deny ptrace for now since it can be abused to break out of the
>  # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
>  #audit deny ptrace (trace),
>
>  # Explicitly deny capability mknod so apps can't create devices
>  #audit deny capability mknod,
>
>  # Explicitly deny mount, remount and umount so apps can't modify things in
>  # their namespace
>  #audit deny mount,
>  #audit deny remount,
>  #audit deny umount,
>
>  # End dangerous accesses
>
>  # Note: this potentially allows snaps to DoS other snaps via resource
>  # exhaustion but we can't sensibly mediate this today. In the future we may
>  # employ cgroup limits, AppArmor rlimit mlock rules or something else.
>  capability ipc_lock,
>
>  # for bash 'binaries' (do *not* use abstractions/bash)
>  # user-specific bash files
>  /etc/bash.bashrc r,
>  /etc/inputrc r,
>  /etc/environment r,
>  /etc/profile r,
>
>  # user/group/seat lookups
>  /etc/{passwd,group,nsswitch.conf} r,  # very common
>  /var/lib/extrausers/{passwd,group} r,
>  /run/systemd/users/[0-9]* r,
>  /etc/default/nss r,
>
>  # libnss-systemd (subset from nameservice abstraction)
>  #
>  #   https://systemd.io/USER_GROUP_API/
>  #   https://systemd.io/USER_RECORD/
>  #   https://www.freedesktop.org/software/systemd/man/nss-systemd.html
>  #
>  # Allow User/Group lookups via common VarLink socket APIs. Applications need
>  # to either consult all of them or the io.systemd.Multiplexer frontend.
>  /run/systemd/userdb/ r,
>  /run/systemd/userdb/io.systemd.Multiplexer rw,
>  /run/systemd/userdb/io.systemd.DynamicUser rw,        # systemd-exec users
>  /run/systemd/userdb/io.systemd.Home rw,               # systemd-home dirs
>  /run/systemd/userdb/io.systemd.NameServiceSwitch rw,  # UNIX/glibc NSS
>  /run/systemd/userdb/io.systemd.Machine rw,            # systemd-machined
>
>  /etc/libnl-3/{classid,pktloc} r,      # apps that use libnl
>
>  # For snappy reexec on 4.8+ kernels
>  /usr/lib/snapd/snap-exec m,
>
>  # For gdb support
>  /usr/lib/snapd/snap-gdb-shim ixr,
>  /usr/lib/snapd/snap-gdbserver-shim ixr,
>
>  # For in-snap tab completion
>  /etc/bash_completion.d/{,*} r,
>  /usr/lib/snapd/etelpmoc.sh ixr,               # marshaller (see complete.sh for out-of-snap unmarshal)
>  /usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here
>
>  # uptime
>  @{PROC}/uptime r,
>  @{PROC}/loadavg r,
>
>  # Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib
>  # which is allowed by the base abstraction, but on 14.04 it is an actual file
>  # so need to add it here. Also allow read locks on the file.
>  /etc/os-release rk,
>  /usr/lib/os-release k,
>
>  # systemd native journal API (see sd_journal_print(4)). This should be in
>  # AppArmor's base abstraction, but until it is, include here. We include
>  # the base journal path as well as the journal namespace pattern path. Each
>  # journal namespace for quota groups will be prefixed with 'snap-'.
>  /run/systemd/journal{,.snap-*}/socket w,
>  /run/systemd/journal{,.snap-*}/stdout rw, # 'r' shouldn't be needed, but journald
>                                            # doesn't leak anything so allow
>
>  # snapctl and its requirements
>  /usr/bin/snapctl ixr,
>  /usr/lib/snapd/snapctl ixr,
>  @{PROC}/sys/net/core/somaxconn r,
>  /run/snapd-snap.socket rw,
>
>  # Note: for now, don't explicitly deny this noisy denial so --devmode isn't
>  # broken but eventually we may conditionally deny this since it is an
>  # information leak.
>  #deny /{,var/}run/utmp r,
>
>  # java
>  @{PROC}/@{pid}/ r,
>  @{PROC}/@{pid}/fd/ r,
>  owner @{PROC}/@{pid}/auxv r,
>  @{PROC}/sys/vm/zone_reclaim_mode r,
>  /etc/lsb-release r,
>  /sys/devices/**/read_ahead_kb r,
>  /sys/devices/system/cpu/** r,
>  /sys/devices/system/node/node[0-9]*/* r,
>  /sys/kernel/mm/transparent_hugepage/enabled r,
>  /sys/kernel/mm/transparent_hugepage/defrag r,
>  # NOTE: this leaks running process but java seems to want it (even though it
>  # seems to operate ok without it) and SDL apps crash without it. Allow owner
>  # match until AppArmor kernel var is available to solve this properly (see
>  # LP: #1546825 for details). comm is a subset of cmdline, so allow it too.
>  owner @{PROC}/@{pid}/cmdline r,
>  owner @{PROC}/@{pid}/comm r,
>
>  # Per man(5) proc, the kernel enforces that a thread may only modify its comm
>  # value or those in its thread group.
>  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
>
>  # Allow reading and writing to our file descriptors in /proc which, for
>  # example, allow access to /dev/std{in,out,err} which are all symlinks to
>  # /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE)
>  # linkat() temporary file technique, allow all fds. Importantly, access to
>  # another task's fd via this proc interface is mediated via 'ptrace (read)'
>  # (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so
>  # this rule by itself doesn't allow opening another snap's fds via proc.
>  owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw,
>
>  # Miscellaneous accesses
>  /dev/{,u}random w,
>  /etc/machine-id r,
>  /etc/mime.types r,
>  @{PROC}/ r,
>  @{PROC}/version r,
>  @{PROC}/version_signature r,
>  /etc/{,writable/}hostname r,
>  /etc/{,writable/}localtime r,
>  /etc/{,writable/}mailname r,
>  /etc/{,writable/}timezone r,
>  owner @{PROC}/@{pid}/cgroup rk,
>  @{PROC}/@{pid}/cpuset r,
>  @{PROC}/@{pid}/io r,
>  owner @{PROC}/@{pid}/limits r,
>  owner @{PROC}/@{pid}/loginuid r,
>  @{PROC}/@{pid}/smaps r,
>  @{PROC}/@{pid}/stat r,
>  @{PROC}/@{pid}/statm r,
>  @{PROC}/@{pid}/status r,
>  @{PROC}/@{pid}/task/ r,
>  @{PROC}/@{pid}/task/[0-9]*/smaps r,
>  @{PROC}/@{pid}/task/[0-9]*/stat r,
>  @{PROC}/@{pid}/task/[0-9]*/statm r,
>  @{PROC}/@{pid}/task/[0-9]*/status r,
>  @{PROC}/sys/fs/pipe-max-size r,
>  @{PROC}/sys/kernel/hostname r,
>  @{PROC}/sys/kernel/osrelease r,
>  @{PROC}/sys/kernel/ostype r,
>  @{PROC}/sys/kernel/pid_max r,
>  @{PROC}/sys/kernel/yama/ptrace_scope r,
>  @{PROC}/sys/kernel/shmmax r,
>  # Allow apps to introspect the level of dbus mediation AppArmor implements.
>  /sys/kernel/security/apparmor/features/dbus/mask r,
>  @{PROC}/sys/fs/file-max r,
>  @{PROC}/sys/fs/file-nr r,
>  @{PROC}/sys/fs/inotify/max_* r,
>  @{PROC}/sys/kernel/pid_max r,
>  @{PROC}/sys/kernel/random/boot_id r,
>  @{PROC}/sys/kernel/random/entropy_avail r,
>  @{PROC}/sys/kernel/random/uuid r,
>  @{PROC}/sys/kernel/cap_last_cap r,
>  # Allow access to the uuidd daemon (this daemon is a thin wrapper around
>  # time and getrandom()/{,u}random and, when available, runs under an
>  # unprivilged, dedicated user).
>  /run/uuidd/request rw,
>  /sys/devices/virtual/tty/{console,tty*}/active r,
>  /sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r,
>  /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r,
>  /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.stat r,
>  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r,
>  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r,
>  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r,
>  /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r,
>  /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
>  /sys/module/apparmor/parameters/enabled r,
>  /{,usr/}lib/ r,
>
>  # Reads of oom_adj and oom_score_adj are safe
>  owner @{PROC}/@{pid}/oom_{,score_}adj r,
>
>  # Note: for now, don't explicitly deny write access so --devmode isn't broken
>  # but eventually we may conditionally deny this since it allows the process
>  # to increase the oom heuristic of other processes (make them more likely to
>  # be killed). Once AppArmor kernel var is available to solve this properly,
>  # this can safely be allowed since non-root processes won't be able to
>  # decrease the value and root processes will only be able to with
>  # 'capability sys_resource,' which we deny be default.
>  # deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
>
>  # Eases hardware assignment (doesn't give anything away)
>  /etc/udev/udev.conf r,
>  /sys/       r,
>  /sys/bus/   r,
>  /sys/class/ r,
>
>  # this leaks interface names and stats, but not in a way that is traceable
>  # to the user/device
>  @{PROC}/net/dev r,
>  @{PROC}/@{pid}/net/dev r,
>
>  # Read-only of this snap
>  /var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r,
>
>  # Read-only of snapd restart state for snapctl specifically
>  /var/lib/snapd/maintenance.json r,
>
>  # Read-only for the install directory
>  # bind mount used here (see 'parallel installs', above)
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/                   r,
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/    r,
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/**  mrklix,
>
>  # Read-only install directory for other revisions to help with bugs like
>  # LP: #1616650 and LP: #1655992
>  @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**  mrkix,
>
>  # Read-only home area for other versions
>  # bind mount *not* used here (see 'parallel installs', above)
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/                  r,
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/**                mrkix,
>
>  # Experimental snap folder changes
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/                    r,
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/**                  mrkix,
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
>  owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/common/**           wl,
>
>  owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/                          r,
>  owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/**                        mrkixwl,
>
>  # Writable home area for this version.
>  # bind mount *not* used here (see 'parallel installs', above)
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
>  owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl,
>
>  # Read-only system area for other versions
>  # bind mount used here (see 'parallel installs', above)
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/   r,
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
>
>  # Writable system area only for this version
>  # bind mount used here (see 'parallel installs', above)
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl,
>  /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl,
>
>  # The ubuntu-core-launcher creates an app-specific private restricted /tmp
>  # and will fail to launch the app if something goes wrong. As such, we can
>  # simply allow full access to /tmp.
>  /tmp/   r,
>  /tmp/** mrwlkix,
>
>  # App-specific access to files and directories in /dev/shm. We allow file
>  # access in /dev/shm for shm_open() and files in subdirectories for open()
>  # bind mount *not* used here (see 'parallel installs', above)
>  /{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix,
>  # Also allow app-specific access for sem_open()
>  /{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk,
>
>  # Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
>  # bind mount *not* used here (see 'parallel installs', above)
>  owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/   rw,
>  owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
>
>  # Allow apps from the same package to communicate with each other via an
>  # abstract or anonymous socket
>  unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**",
>  unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
>
>  # Allow apps from the same package to communicate with each other via DBus.
>  # Note: this does not grant access to the DBus sockets of well known buses
>  # (will still need to use an appropriate interface for that).
>  dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
>  # In addition to the above, dbus-run-session attempts reading these files
>  # from the snap base runtime.
>  /usr/share/dbus-1/services/{,*} r,
>  /usr/share/dbus-1/system-services/{,*} r,
>  # Allow apps to perform DBus introspection on org.freedesktop.DBus for both
>  # the system and session buses.
>  # Note: this does not grant access to the DBus sockets of these buses, but
>  # we grant it here since it is missing from the dbus abstractions
>  # (LP: #1866168)
>  dbus (send)
>      bus={session,system}
>      path=/org/freedesktop/DBus
>      interface=org.freedesktop.DBus.Introspectable
>      member=Introspect
>      peer=(label=unconfined),
>
>  # Allow apps from the same package to signal each other via signals
>  signal peer=snap.@{SNAP_INSTANCE_NAME}.*,
>
>  # Allow receiving signals from all snaps (and focus on mediating sending of
>  # signals)
>  signal (receive) peer=snap.*,
>
>  # Allow receiving signals from unconfined (eg, systemd)
>  signal (receive) peer=unconfined,
>
>  # for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign'
>  /{,usr/}{,s}bin/udevadm ixr,
>  /etc/udev/udev.conf r,
>  /{,var/}run/udev/tags/snappy-assign/ r,
>  @{PROC}/cmdline r,
>  /sys/devices/**/uevent r,
>
>  # LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above
>  # requires:
>  #   /run/udev/data/* r,
>  # but that reveals too much about the system and cannot be granted to apps
>  # by default at this time.
>
>  # For convenience, allow apps to see what is in /dev even though cgroups
>  # will block most access
>  /dev/ r,
>  /dev/**/ r,
>
>  # Allow setting up pseudoterminal via /dev/pts system. This is safe because
>  # the launcher uses a per-app devpts newinstance.
>  /dev/ptmx rw,
>
>  # Do the same with /sys/devices and /sys/class to help people using hw-assign
>  /sys/devices/ r,
>  /sys/devices/**/ r,
>  /sys/class/ r,
>  /sys/class/**/ r,
>
>  # Allow all snaps to chroot
>  capability sys_chroot,
>
>  # Lttng tracing is very noisy and should not be allowed by confined apps. Can
>  # safely deny for the normal case (LP: #1260491). If/when an lttng-trace
>  # interface is needed, we can rework this.
>  deny /{dev,run,var/run}/shm/lttng-ust-* rw,
>
>  # Allow read-access on /home/ for navigating to other parts of the
>  # filesystem. While this allows enumerating users, this is already allowed
>  # via /etc/passwd and getent.
>  @{HOMEDIRS}/ r,
>
>  # Allow read-access to / for navigating to other parts of the filesystem.
>  / r,
>
>  # Snap-specific run directory. Bind mount *not* used here
>  # (see 'parallel installs', above)
>  /run/snap.@{SNAP_INSTANCE_NAME}/ rw,
>  /run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
>
>  # Snap-specific lock directory and prerequisite navigation permissions.
>  /run/lock/ r,
>  /run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw,
>  /run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
>  
>  
>
>  # Default rules for core base runtimes
>
>  # The base abstraction doesn't yet have this
>  /{,usr/}lib/terminfo/** rk,
>  /usr/share/terminfo/** k,
>  /usr/share/zoneinfo/** k,
>
>  # for python apps/services
>  /usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr,
>  # additional accesses needed for newer pythons in later bases
>  /usr/lib{,32,64}/python3.[0-9]*/**.{pyc,so}           mr,
>  /usr/lib{,32,64}/python3.[0-9]*/**.{egg,py,pth}       r,
>  /usr/lib{,32,64}/python3.[0-9]*/{site,dist}-packages/ r,
>  /usr/lib{,32,64}/python3.[0-9]*/lib-dynload/*.so      mr,
>  /usr/include/python3.[0-9]*/pyconfig.h               r,
>
>  # for perl apps/services
>  /usr/bin/perl{,5*} ixr,
>  # AppArmor <2.12 doesn't have rules for perl-base, so add them here
>  /usr/lib/@{multiarch}/perl{,5,-base}/**            r,
>  /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,
>
>  # for bash 'binaries' (do *not* use abstractions/bash)
>  # user-specific bash files
>  /{,usr/}bin/bash ixr,
>  /{,usr/}bin/dash ixr,
>  /usr/share/terminfo/** r,
>
>  # Common utilities for shell scripts
>  /{,usr/}bin/arch ixr,
>  /{,usr/}bin/{,g,m}awk ixr,
>  /{,usr/}bin/base32 ixr,
>  /{,usr/}bin/base64 ixr,
>  /{,usr/}bin/basename ixr,
>  /{,usr/}bin/bunzip2 ixr,
>  /{,usr/}bin/busctl ixr,
>  /{,usr/}bin/bzcat ixr,
>  /{,usr/}bin/bzdiff ixr,
>  /{,usr/}bin/bzgrep ixr,
>  /{,usr/}bin/bzip2 ixr,
>  /{,usr/}bin/cat ixr,
>  /{,usr/}bin/chgrp ixr,
>  /{,usr/}bin/chmod ixr,
>  /{,usr/}bin/chown ixr,
>  /{,usr/}bin/clear ixr,
>  /{,usr/}bin/cmp ixr,
>  /{,usr/}bin/cp ixr,
>  /{,usr/}bin/cpio ixr,
>  /{,usr/}bin/cut ixr,
>  /{,usr/}bin/date ixr,
>  /{,usr/}bin/dbus-daemon ixr,
>  /{,usr/}bin/dbus-run-session ixr,
>  /{,usr/}bin/dbus-send ixr,
>  /{,usr/}bin/dd ixr,
>  /{,usr/}bin/diff{,3} ixr,
>  /{,usr/}bin/dir ixr,
>  /{,usr/}bin/dirname ixr,
>  /{,usr/}bin/du ixr,
>  /{,usr/}bin/echo ixr,
>  /{,usr/}bin/{,e,f,r}grep ixr,
>  /{,usr/}bin/env ixr,
>  /{,usr/}bin/expr ixr,
>  /{,usr/}bin/false ixr,
>  /{,usr/}bin/find ixr,
>  /{,usr/}bin/flock ixr,
>  /{,usr/}bin/fmt ixr,
>  /{,usr/}bin/fold ixr,
>  /{,usr/}bin/getconf ixr,
>  /{,usr/}bin/getent ixr,
>  /{,usr/}bin/getopt ixr,
>  /{,usr/}bin/groups ixr,
>  /{,usr/}bin/gzip ixr,
>  /{,usr/}bin/head ixr,
>  /{,usr/}bin/hostname ixr,
>  /{,usr/}bin/id ixr,
>  /{,usr/}bin/igawk ixr,
>  /{,usr/}bin/infocmp ixr,
>  /{,usr/}bin/kill ixr,
>  /{,usr/}bin/ldd ixr,
>  /{usr/,}lib{,32,64}/ld{,32,64}-*.so ix,
>  /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so* ix,
>  /{,usr/}bin/less{,file,pipe} ixr,
>  /{,usr/}bin/ln ixr,
>  /{,usr/}bin/line ixr,
>  /{,usr/}bin/link ixr,
>  /{,usr/}bin/locale ixr,
>  /{,usr/}bin/logger ixr,
>  /{,usr/}bin/ls ixr,
>  /{,usr/}bin/md5sum ixr,
>  /{,usr/}bin/mkdir ixr,
>  /{,usr/}bin/mkfifo ixr,
>  /{,usr/}bin/mknod ixr,
>  /{,usr/}bin/mktemp ixr,
>  /{,usr/}bin/more ixr,
>  /{,usr/}bin/mv ixr,
>  /{,usr/}bin/nice ixr,
>  /{,usr/}bin/nohup ixr,
>  /{,usr/}bin/numfmt ixr,
>  /{,usr/}bin/od ixr,
>  /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
>  /{,usr/}bin/paste ixr,
>  /{,usr/}bin/pgrep ixr,
>  /{,usr/}bin/printenv ixr,
>  /{,usr/}bin/printf ixr,
>  /{,usr/}bin/ps ixr,
>  /{,usr/}bin/pwd ixr,
>  /{,usr/}bin/readlink ixr,
>  /{,usr/}bin/realpath ixr,
>  /{,usr/}bin/rev ixr,
>  /{,usr/}bin/rm ixr,
>  /{,usr/}bin/rmdir ixr,
>  /{,usr/}bin/run-parts ixr,
>  /{,usr/}bin/sed ixr,
>  /{,usr/}bin/seq ixr,
>  /{,usr/}bin/sha{1,224,256,384,512}sum ixr,
>  /{,usr/}bin/shuf ixr,
>  /{,usr/}bin/sleep ixr,
>  /{,usr/}bin/sort ixr,
>  /{,usr/}bin/stat ixr,
>  /{,usr/}bin/stdbuf ixr,
>  /{,usr/}bin/stty ixr,
>  /{,usr/}bin/sync ixr,
>  /{,usr/}bin/systemd-cat ixr,
>  /{,usr/}bin/tac ixr,
>  /{,usr/}bin/tail ixr,
>  /{,usr/}bin/tar ixr,
>  /{,usr/}bin/tee ixr,
>  /{,usr/}bin/test ixr,
>  /{,usr/}bin/tempfile ixr,
>  /{,usr/}bin/tset ixr,
>  /{,usr/}bin/touch ixr,
>  /{,usr/}bin/tput ixr,
>  /{,usr/}bin/tr ixr,
>  /{,usr/}bin/true ixr,
>  /{,usr/}bin/tty ixr,
>  /{,usr/}bin/uname ixr,
>  /{,usr/}bin/uniq ixr,
>  /{,usr/}bin/unlink ixr,
>  /{,usr/}bin/unxz ixr,
>  /{,usr/}bin/unzip ixr,
>  /{,usr/}bin/uptime ixr,
>  /{,usr/}bin/vdir ixr,
>  /{,usr/}bin/wc ixr,
>  /{,usr/}bin/which{,.debianutils} ixr,
>  /{,usr/}bin/xargs ixr,
>  /{,usr/}bin/xz ixr,
>  /{,usr/}bin/yes ixr,
>  /{,usr/}bin/zcat ixr,
>  /{,usr/}bin/z{,e,f}grep ixr,
>  /{,usr/}bin/zip ixr,
>  /{,usr/}bin/zipgrep ixr,
>
>  # lsb-release
>  /usr/bin/lsb_release ixr,
>  /usr/bin/ r,
>  /usr/share/distro-info/*.csv r,
>
>  # For printing the cache (we don't allow updating the cache)
>  /{,usr/}sbin/ldconfig{,.real} ixr,
>
>  # Allow all snaps to chroot
>  /{,usr/}sbin/chroot ixr,
>
>
># Description: Can access basic graphical desktop resources. To be used with
># other interfaces (eg, wayland).
>
> 
>
>##included <abstractions/dbus-strict>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2009-2013 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  @{run}/dbus/system_bus_socket rw,
>
>  dbus send
>       bus=system
>       path=/org/freedesktop/DBus
>       interface=org.freedesktop.DBus
>       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
>       peer=(name=org.freedesktop.DBus),
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/dbus-strict.d>
>
>
> 
>
>##included <abstractions/dbus-session-strict>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011-2013 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  # unique per-machine identifier
>  /etc/machine-id r,
>  /var/lib/dbus/machine-id r,
>
>  unix (connect, receive, send)
>       type=stream
>       peer=(addr="@/tmp/dbus-*"),
>
>  # dbus with systemd and --enable-user-session
>  owner @{run}/user/[0-9]*/bus rw,
>
>  dbus send
>       bus=session
>       path=/org/freedesktop/DBus
>       interface=org.freedesktop.DBus
>       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
>       peer=(name=org.freedesktop.DBus),
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/dbus-session-strict.d>
>
>
>
># Allow finding the DBus session bus id (eg, via dbus_bus_get_id())
>dbus (send)
>     bus=session
>     path=/org/freedesktop/DBus
>     interface=org.freedesktop.DBus
>     member=GetId
>     peer=(name=org.freedesktop.DBus, label=unconfined),
>
> 
>
>##included <abstractions/fonts>
># vim:syntax=apparmor
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2002-2009 Novell/SUSE
>#    Copyright (C) 2009 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
>  abi <abi/3.0>,
>
>  /usr/share/AbiSuite/fonts/**          r,
>
>  /usr/lib/xorg/modules/fonts/**.so*    mr,
>
>  /usr/share/fonts/{,**}                r,
>  /usr/share/fonts-*/{,**}              r,
>
>  /etc/fonts/**                         r,
>  # Debian, openSUSE paths are different
>  /usr/share/{fontconfig,fonts-config,*-fonts}/conf.avail/{,**} r,
>  /usr/share/ghostscript/fonts/{,**}    r,
>
>  /opt/kde3/share/fonts/**              r,
>
>  /usr/lib{,32,64}/openoffice/share/fonts/**    r,
>
>  /var/cache/fonts/**                   r,
>  /var/cache/fontconfig/**              mr,
>  /var/lib/defoma/**                    mr,
>
>  /usr/share/a2ps/fonts/**              r,
>  /usr/share/xfce/fonts/**              r,
>  /usr/share/ghostscript/fonts/**       r,
>  /usr/share/javascript/*/fonts/**      r,
>  /usr/share/texmf/{,*/}fonts/**        r,
>  /usr/share/texlive/texmf-dist/fonts/** r,
>  /var/lib/ghostscript/**               r,
>
>  owner @{HOME}/.fonts.conf             r,
>  owner @{HOME}/.fonts/                 r,
>  owner @{HOME}/.fonts/**               r,
>  owner @{HOME}/.local/share/fonts/     r,
>  owner @{HOME}/.local/share/fonts/**   r,
>  owner @{HOME}/.fonts.cache-2          mr,
>  owner @{HOME}/.{,cache/}fontconfig/   rw,
>  owner @{HOME}/.{,cache/}fontconfig/** mrl,
>  owner @{HOME}/.fonts.conf.d/          r,
>  owner @{HOME}/.fonts.conf.d/**        r,
>  owner @{HOME}/.config/fontconfig/     r,
>  owner @{HOME}/.config/fontconfig/**   r,
>  owner @{HOME}/.Fontmatrix/Activated/  r,
>  owner @{HOME}/.Fontmatrix/Activated/** r,
>
>  /usr/local/share/fonts/               r,
>  /usr/local/share/fonts/**             r,
>
>  # poppler CMap tables
>  /usr/share/poppler/cMap/**            r,
>
>  # data files for LibThai
>  /usr/share/libthai/thbrk.tri          r,
>
>  # Include additions to the abstraction
>   
>
>##included <abstractions/fonts.d>
>
>
>owner @{HOME}/.local/share/fonts/{,**} r,
>/var/cache/fontconfig/   r,
>/var/cache/fontconfig/** mr,
># some applications are known to mmap fonts
>/usr/{,local/}share/fonts/** m,
>
># subset of gnome abstraction
>/etc/gtk-3.0/settings.ini r,
>owner @{HOME}/.config/gtk-3.0/settings.ini r,
>owner @{HOME}/.config/gtk-3.0/*.css r,
># Note: this leaks directory names that wouldn't otherwise be known to the snap
>owner @{HOME}/.config/gtk-3.0/bookmarks r,
>
>/usr/share/icons/                          r,
>/usr/share/icons/**                        r,
>/usr/share/icons/*/index.theme             rk,
>/usr/share/pixmaps/                        r,
>/usr/share/pixmaps/**                      r,
>/usr/share/unity/icons/**                  r,
>/usr/share/thumbnailer/icons/**            r,
>/usr/share/themes/**                       r,
>
># The snapcraft desktop part may look for schema files in various locations, so
># allow reading system installed schemas.
>/usr/share/glib*/schemas/{,*}              r,
>/usr/share/gnome/glib*/schemas/{,*}        r,
>/usr/share/ubuntu/glib*/schemas/{,*}       r,
>
># subset of freedesktop.org
>owner @{HOME}/.local/share/mime/**   r,
>owner @{HOME}/.config/user-dirs.* r,
>
>/etc/xdg/user-dirs.conf r,
>/etc/xdg/user-dirs.defaults r,
>
># gmenu
>dbus (send)
>     bus=session
>     interface=org.gtk.Actions
>     member=Changed
>     peer=(label=unconfined),
>
># notifications
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.Notifications
>    member={ActionInvoked,NotificationClosed,NotificationReplied}
>    peer=(label=unconfined),
>
># KDE Plasma's Inhibited property indicating "do not disturb" mode
># https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
>dbus (send)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member="Get{,All}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path=/org/freedesktop/Notifications
>    interface=org.freedesktop.DBus.Properties
>    member=PropertiesChanged
>    peer=(label=unconfined),
>
># DesktopAppInfo Launched
>dbus (send)
>    bus=session
>    path=/org/gtk/gio/DesktopAppInfo
>    interface=org.gtk.gio.DesktopAppInfo
>    member=Launched
>    peer=(label=unconfined),
>
># Allow requesting interest in receiving media key events. This tells Gnome
># settings that our application should be notified when key events we are
># interested in are pressed, and allows us to receive those events.
>dbus (receive, send)
>  bus=session
>  interface=org.gnome.SettingsDaemon.MediaKeys
>  path=/org/gnome/SettingsDaemon/MediaKeys
>  peer=(label=unconfined),
>dbus (send)
>  bus=session
>  interface=org.freedesktop.DBus.Properties
>  path=/org/gnome/SettingsDaemon/MediaKeys
>  member="Get{,All}"
>  peer=(label=unconfined),
>
># Allow accessing the GNOME crypto services prompt APIs as used by
># applications using libgcr (such as pinentry-gnome3) for secure pin
># entry to unlock GPG keys etc. See:
># https://developer.gnome.org/gcr/unstable/GcrPrompt.html
># https://developer.gnome.org/gcr/unstable/GcrSecretExchange.html
>dbus (send)
>    bus=session
>    path=/org/gnome/keyring/Prompter
>    interface=org.gnome.keyring.internal.Prompter
>    member="{BeginPrompting,PerformPrompt,StopPrompting}"
>    peer=(label=unconfined),
>
># While the DBus path is not snap-specific, by the time an application
># registers the prompt path via DBus, Gcr will check that it isn't
># already in use and send the client an error if it is. See:
># https://github.com/snapcore/snapd/pull/7673#issuecomment-592229711
>dbus (receive)
>    bus=session
>    path=/org/gnome/keyring/Prompt/p[0-9]*
>    interface=org.gnome.keyring.internal.Prompter.Callback
>    member="{PromptReady,PromptDone}"
>    peer=(label=unconfined),
>
># Allow use of snapd's internal 'xdg-open'
>/usr/bin/xdg-open ixr,
># While /usr/share/applications comes from the base runtime of the snap, it
># has some things that snaps actually need, so allow access to those and deny
># access to the others
>/usr/share/applications/ r,
>/usr/share/applications/mimeapps.list r,
>/usr/share/applications/xdg-open.desktop r,
># silence noisy denials from desktop files in core* snaps that aren't usable by
># snaps
>deny /usr/share/applications/python*.desktop r,
>deny /usr/share/applications/vim.desktop r,
>deny /usr/share/applications/snap-handle-link.desktop r,  # core16
>
>dbus (send)
>    bus=session
>    path=/
>    interface=com.canonical.SafeLauncher
>    member=OpenURL
>    peer=(label=unconfined),
># ... and this allows access to the new xdg-open service which
># is now part of snapd itself.
>dbus (send)
>    bus=session
>    path=/io/snapcraft/Launcher
>    interface=io.snapcraft.Launcher
>    member={OpenURL,OpenFile}
>    peer=(label=unconfined),
>
># Allow checking status, activating and locking the screensaver
># gnome/kde/freedesktop.org
>dbus (send)
>    bus=session
>    path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
>    interface="org.{freedesktop,gnome}.ScreenSaver"
>    member="{GetActive,GetActiveTime,Lock,SetActive}"
>    peer=(label=unconfined),
>
>dbus (receive)
>    bus=session
>    path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
>    interface="org.{freedesktop,gnome}.ScreenSaver"
>    member=ActiveChanged
>    peer=(label=unconfined),
>
># Allow unconfined to introspect us
>dbus (receive)
>    bus=session
>    interface=org.freedesktop.DBus.Introspectable
>    member=Introspect
>    peer=(label=unconfined),
>
># Allow use of snapd's internal 'xdg-settings'
>/usr/bin/xdg-settings ixr,
>dbus (send)
>    bus=session
>    path=/io/snapcraft/Settings
>    interface=io.snapcraft.Settings
>    member={Check,CheckSub,Get,GetSub,Set,SetSub}
>    peer=(label=unconfined),
>
># Allow access to xdg-document-portal file system.  Access control is
># handled by bind mounting a snap-specific sub-tree to this location
># (ie, this is /run/user/<uid>/doc/by-app/snap.@{SNAP_INSTANCE_NAME}
># on the host).
>owner /run/user/[0-9]*/doc/{,*/} r,
># Allow rw access without owner match to the documents themselves since
># the user guided the access and can specify anything DAC allows.
>/run/user/[0-9]*/doc/*/** rw,
>
># Allow access to xdg-desktop-portal and xdg-document-portal
>dbus (receive, send)
>    bus=session
>    interface=org.freedesktop.portal.*
>    path=/org/freedesktop/portal/{desktop,documents}{,/**}
>    peer=(label=unconfined),
>
>dbus (receive, send)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/org/freedesktop/portal/{desktop,documents}{,/**}
>    peer=(label=unconfined),
>
># The portals service is normally running and newer versions of
># xdg-desktop-portal include AssumedAppArmor=unconfined. Since older
># systems don't have this and because gtkfilechoosernativeportal.c relies on
># service activation, allow sends to peer=(name=org.freedesktop.portal.{Desktop,Documents})
># for service activation.
>dbus (send)
>    bus=session
>    interface=org.freedesktop.portal.*
>    path=/org/freedesktop/portal/desktop{,/**}
>    peer=(name=org.freedesktop.portal.Desktop),
>dbus (send)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/org/freedesktop/portal/desktop{,/**}
>    peer=(name=org.freedesktop.portal.Desktop),
>dbus (send)
>    bus=session
>    interface=org.freedesktop.portal.*
>    path=/org/freedesktop/portal/documents{,/**}
>    peer=(name=org.freedesktop.portal.Documents),
>dbus (send)
>    bus=session
>    interface=org.freedesktop.DBus.Properties
>    path=/org/freedesktop/portal/documents{,/**}
>    peer=(name=org.freedesktop.portal.Documents),
>
># These accesses are noisy and applications can't do anything with the found
># icon files, so explicitly deny to silence the denials
>deny /var/lib/snapd/desktop/icons/{,**/} r,
>
># These accesses occur when flatpaks are on the system since it updates
># XDG_DATA_DIRS to contain $HOME/.local/share/flatpak/exports/share. Until
># we have better XDG_DATA_DIRS handling, silence these noisy denials.
># https://github.com/snapcrafters/discord/issues/23#issuecomment-637607843
>deny @{HOME}/.local/share/flatpak/exports/share/** r,
>
># Allow access to the IBus portal (IBUS_USE_PORTAL=1)
>dbus (send)
>      bus=session
>      path=/org/freedesktop/IBus
>      interface=org.freedesktop.IBus.Portal
>      member=CreateInputContext
>      peer=(name=org.freedesktop.portal.IBus),
>
>dbus (send, receive)
>      bus=session
>      path=/org/freedesktop/IBus/InputContext_[0-9]*
>      interface=org.freedesktop.IBus.InputContext
>      peer=(label=unconfined),
>
>
># Description: Can access specific personal files or directories in the 
># users's home directory.
># This is restricted because it gives file access to arbitrary locations.
>owner "@{HOME}/.config/chromium{,/,/**}" rk,
>owner "@{HOME}/.chromium-browser.init{,/,/**}" rk,
>
>
># Description: Can access specific system files or directories.
># This is restricted because it gives file access to arbitrary locations.
>"/etc/chromium-browser/policies{,/,/**}" rk,
>
>
># Description: Can access various APIs needed by modern browsers (eg, Google
># Chrome/Chromium and Mozilla) and file paths they expect. This interface is
># transitional and is only in place while upstream's work to change their paths
># and snappy is updated to properly mediate the APIs.
>
># This allows raising the OOM score of other processes owned by the user.
>owner @{PROC}/@{pid}/oom_score_adj rw,
>
># Chrome/Chromium should be fixed to honor TMPDIR or the snap packaging
># adjusted to use LD_PRELOAD technique from LP: #1577514
>/var/tmp/ r,
>owner /var/tmp/etilqs_* rw,
>
># Chrome/Chromium should be modified to use snap.$SNAP_INSTANCE_NAME.* or
># the snap packaging adjusted to use LD_PRELOAD technique from LP: #1577514
>owner /{dev,run}/shm/{,.}org.chromium.* mrw,
>owner /{dev,run}/shm/{,.}com.google.Chrome.* mrw,
>owner /{dev,run}/shm/{,.}com.microsoft.Edge.* mrw,
>owner /{dev,run}/shm/.io.nwjs.* mrw,
>
># Chrome's Singleton API sometimes causes an ouid/fsuid mismatch denial, so
># for now, allow non-owner read on the singleton socket (LP: #1731012). See
># https://forum.snapcraft.io/t/electron-snap-killed-when-using-app-makesingleinstance-api/2667/20
># parallel-installs: $XDG_RUNTIME_DIR is not remapped, need to use SNAP_INSTANCE_NAME
>/run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/{,.}org.chromium.*/SS r,
>/run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/{,.}com.google.Chrome.*/SS r,
>/run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/{,.}com.microsoft.Edge.*/SS r,
>
># Allow access to Jupyter notebooks. 
># This is temporary and will be reverted once LP: #1959417 is fixed upstream.
>owner @{HOME}/.local/share/jupyter/** rw,
>
># Allow reading platform files
>/run/udev/data/+platform:* r,
>
># miscellaneous accesses
>@{PROC}/vmstat r,
>
># Chromium content api sometimes queries about huge pages. Allow status of
># hugepages and transparent_hugepage, but not the pages themselves.
>/sys/kernel/mm/{hugepages,transparent_hugepage}/{,**} r,
>
># Chromium content api in gnome-shell reads this
>/etc/opt/chrome/{,**} r,
>/etc/chromium/{,**} r,
>
># Chrome/Chromium should be adjusted to not use gconf. It is only used with
># legacy systems that don't have snapd
>deny dbus (send)
>    bus=session
>    interface="org.gnome.GConf.Server",
>
># webbrowser-app/webapp-container tries to read this file to determine if it is
># confined or not, so explicitly deny to avoid noise in the logs.
>deny @{PROC}/@{pid}/attr/{,apparmor/}current r,
>
># This is an information leak but disallowing it leads to developer confusion
># when using the chromium content api file chooser due to a (harmless) glib
># warning and the noisy AppArmor denial.
>owner @{PROC}/@{pid}/mounts r,
>owner @{PROC}/@{pid}/mountinfo r,
>
># Since snapd still uses SECCOMP_RET_KILL, we have added a workaround rule to
># allow mknod on character devices since chromium unconditionally performs
># a mknod() to create the /dev/nvidiactl device, regardless of if it exists or
># not or if the process has CAP_MKNOD or not. Since we don't want to actually
># grant the ability to create character devices, explicitly deny the
># capability. When snapd uses SECCOMP_RET_ERRNO, we can remove this rule.
># https://forum.snapcraft.io/t/call-for-testing-chromium-62-0-3202-62/2569/46
>deny capability mknod,
>
>
># In addition to the bind mount, add any AppArmor rules so that
># snaps may directly access the slot implementation's files
># read-only.
>"/snap/gnome-42-2204/111/**" mrkix,
>
>
># In addition to the bind mount, add any AppArmor rules so that
># snaps may directly access the slot implementation's files
># read-only.
>"/snap/gtk-common-themes/1535/share/icons/default/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Adwaita/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/hicolor/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/HighContrast/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Humanity/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Humanity-Dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/ubuntu-mono-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/ubuntu-mono-light/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/DMZ-Black/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/DMZ-White/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-bark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-blue/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-magenta/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-olive/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-purple/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-red/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-sage/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-viridian/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-bark-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-blue-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-magenta-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-olive-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-purple-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-red-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-sage-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-viridian-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/elementary/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Ambiant-MATE/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Radiant-MATE/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-MATE-light/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-MATE-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-mate/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Yaru-mate-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Maia/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Nokto-Maia/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Papirus-Dark-Maia/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Papirus-Light-Maia/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Papirus-Maia/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/breeze_cursors/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/Breeze_Snow/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/elementary-xfce/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-darker/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-darkest/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/handhelds/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/redglass/**" mrkix,
>"/snap/gtk-common-themes/1535/share/icons/whiteglass/**" mrkix,
>
>
># In addition to the bind mount, add any AppArmor rules so that
># snaps may directly access the slot implementation's files
># read-only.
>"/snap/gtk-common-themes/1535/share/sounds/Yaru/**" mrkix,
>"/snap/gtk-common-themes/1535/share/sounds/freedesktop/**" mrkix,
>
>
># In addition to the bind mount, add any AppArmor rules so that
># snaps may directly access the slot implementation's files
># read-only.
>"/snap/gtk-common-themes/1535/share/themes/Adwaita/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Adwaita-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/HighContrast/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Ambiance/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Radiance/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Arc/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Arc-Dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Arc-Darker/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Breeze/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Breeze-Dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-light/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-bark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-blue/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-olive/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-purple/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-red/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-sage/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-red-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/elementary/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Ambiant-MATE/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Ambiant-MATE-Dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Radiant-MATE/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-mate/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Matcha-aliz/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Matcha-azul/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-aliz/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-azul/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-sea/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Matcha-sea/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Greybird/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Greybird-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Materia/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Materia-compact/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Materia-dark/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Materia-dark-compact/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Materia-light/**" mrkix,
>"/snap/gtk-common-themes/1535/share/themes/Materia-light-compact/**" mrkix,
>
>
># TODO: should this be somewhere else?
>/etc/mailcap r,
>
># While /usr/share/applications comes from the base runtime of the snap, it
># has some things that snaps actually need, so allow access to those and deny
># access to the others. This is duplicated from desktop for compatibility with
># existing snaps.
>/usr/share/applications/ r,
>/usr/share/applications/mimeapps.list r,
>/usr/share/applications/xdg-open.desktop r,
># silence noisy denials from desktop files in core* snaps that aren't usable by
># snaps
>deny /usr/share/applications/python*.desktop r,
>deny /usr/share/applications/vim.desktop r,
>deny /usr/share/applications/snap-handle-link.desktop r,  # core16
>
># Chromium content api unfortunately needs these for normal operation
>owner @{PROC}/@{pid}/fd/[0-9]* w,
>
># Various files in /run/udev/data needed by Chrome Settings. Leaks device
># information.
># input
>/run/udev/data/c1:[0-9]* r,   # /dev/psaux
>/run/udev/data/c10:[0-9]* r,  # /dev/adbmouse
>/run/udev/data/c13:[0-9]* r,  # /dev/input/*
>/run/udev/data/c180:[0-9]* r, # /dev/vrbuttons
>/run/udev/data/c4:[0-9]* r,   # /dev/tty*, /dev/ttyS*
>/run/udev/data/c5:[0-9]* r,   # /dev/tty, /dev/console, etc
>/run/udev/data/c7:[0-9]* r,   # /dev/vcs*
>/run/udev/data/+hid:* r,
>/run/udev/data/+input:input[0-9]* r,
>
># screen
>/run/udev/data/c29:[0-9]* r,  # /dev/fb*
>/run/udev/data/+backlight:* r,
>/run/udev/data/+leds:* r,
>
># sound
>/run/udev/data/c116:[0-9]* r, # alsa
>/run/udev/data/+sound:card[0-9]* r,
>
># miscellaneous
>/run/udev/data/c108:[0-9]* r, # /dev/ppp
>/run/udev/data/c189:[0-9]* r, # USB serial converters
>/run/udev/data/c89:[0-9]* r,  # /dev/i2c-*
>/run/udev/data/c81:[0-9]* r,  # video4linux (/dev/video*, etc)
>/run/udev/data/c202:[0-9]* r, # /dev/cpu/*/msr
>/run/udev/data/c203:[0-9]* r, # /dev/cuse
>/run/udev/data/+acpi:* r,
>/run/udev/data/+hwmon:hwmon[0-9]* r,
>/run/udev/data/+i2c:* r,
>/sys/devices/**/bConfigurationValue r,
>/sys/devices/**/descriptors r,
>/sys/devices/**/manufacturer r,
>/sys/devices/**/product r,
>/sys/devices/**/revision r,
>/sys/devices/**/serial r,
>/sys/devices/**/vendor r,
>/sys/devices/system/node/node[0-9]*/meminfo r,
>
># Allow getting the manufacturer and model of the
># computer where Chrome/chromium is currently running.
># This is going to be used by the upcoming Hardware Platform
># extension API.
># https://chromium.googlesource.com/chromium/src.git/+/84618eee98fdf7548905e883e63e4f693800fcfa
>/sys/devices/virtual/dmi/id/product_name r,
>/sys/devices/virtual/dmi/id/sys_vendor r,
>
># Chromium content api tries to read these. It is an information disclosure
># since these contain the names of snaps. Chromium operates fine without the
># access so just block it.
>deny /sys/devices/virtual/block/loop[0-9]*/loop/backing_file r,
>deny /sys/devices/virtual/block/dm-[0-9]*/dm/name r,
>
># networking
>/run/udev/data/n[0-9]* r,
>/run/udev/data/+bluetooth:hci[0-9]* r,
>/run/udev/data/+rfkill:rfkill[0-9]* r,
>/run/udev/data/c241:[0-9]* r, # /dev/vhost-vsock
>
># storage
>/run/udev/data/b1:[0-9]* r,   # /dev/ram*
>/run/udev/data/b7:[0-9]* r,   # /dev/loop*
>/run/udev/data/b8:[0-9]* r,   # /dev/sd*
>/run/udev/data/b11:[0-9]* r,  # /dev/scd* and sr*
>/run/udev/data/b230:[0-9]* r, # /dev/zvol*
>/run/udev/data/c21:[0-9]* r,  # /dev/sg*
>/run/udev/data/+usb:[0-9]* r,
>
># experimental
>/run/udev/data/b252:[0-9]* r,
>/run/udev/data/b253:[0-9]* r,
>/run/udev/data/b259:[0-9]* r,
>/run/udev/data/c24[0-9]:[0-9]* r,
>/run/udev/data/c25[0-4]:[0-9]* r,
>
>/sys/bus/**/devices/ r,
>
># Google Cloud Print
>unix (bind)
>     type=stream
>     addr="@[0-9A-F]*._service_*",
>
># Policy needed only when using the chrome/chromium setuid sandbox
>capability sys_ptrace,
>ptrace (trace) peer=snap.@{SNAP_INSTANCE_NAME}.**,
>unix (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.**),
>
># If this were going to be allowed to all snaps, then for all the following
># rules we would want to wrap in a 'browser_sandbox' profile, but a limitation
># in AppArmor profile transitions prevents this.
>#
># @{INSTALL_DIR}/@{SNAP_NAME}/@{SNAP_REVISION}/opt/google/chrome{,-beta,-unstable}/chrome-sandbox cx -> browser_sandbox,
># profile browser_sandbox {
>#   ...
>#   # This rule needs to work but generates a parser error
>#   @{INSTALL_DIR}/@{SNAP_NAME}/@{SNAP_REVISION}/opt/google/chrome/chrome px -> snap.@{SNAP_INSTANCE_NAME}.@{SNAP_APP},
>#   @{INSTALL_DIR}/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/opt/google/chrome/chrome px -> snap.@{SNAP_INSTANCE_NAME}.@{SNAP_APP},
>#   ...
># }
>
># Required for dropping into PID namespace. Keep in mind that until the
># process drops this capability it can escape confinement, but once it
># drops CAP_SYS_ADMIN we are ok.
>capability sys_admin,
>
># All of these are for sanely dropping from root and chrooting
>capability chown,
>capability fsetid,
>capability setgid,
>capability setuid,
>capability sys_chroot,
>
># User namespace sandbox
>owner @{PROC}/@{pid}/setgroups rw,
>owner @{PROC}/@{pid}/uid_map rw,
>owner @{PROC}/@{pid}/gid_map rw,
>
># Webkit uses a particular SHM names # LP: 1578217
>owner /{dev,run}/shm/WK2SharedMemory.* mrw,
>
># Chromium content api on (at least) later versions of Ubuntu just use this
>owner /{dev,run}/shm/shmfd-* mrw,
>
># Clearing the PG_Referenced and ACCESSED/YOUNG bits provides a method to
># measure approximately how much memory a process is using via /proc/self/smaps
># (man 5 proc). This access allows the snap to clear references for pids from
># other snaps and the system, so it is limited to snaps that specify:
># allow-sandbox: true.
>owner @{PROC}/@{pid}/clear_refs w,
>
># Allow setting realtime priorities. Clients require RLIMIT_RTTIME in the first
># place and client authorization is done via PolicyKit. Note that setrlimit()
># is allowed by default seccomp policy but requires 'capability sys_resource',
># which we deny be default.
># http://git.0pointer.net/rtkit.git/tree/README
>dbus (send)
>    bus=system
>    path=/org/freedesktop/RealtimeKit1
>    interface=org.freedesktop.DBus.Properties
>    member=Get
>    peer=(name=org.freedesktop.RealtimeKit1, label=unconfined),
>dbus (send)
>    bus=system
>    path=/org/freedesktop/RealtimeKit1
>    interface=org.freedesktop.RealtimeKit1
>    member=MakeThread{HighPriority,Realtime,RealtimeWithPID}
>    peer=(name=org.freedesktop.RealtimeKit1, label=unconfined),
>
># Layout path: /usr/lib/man-db
>"/usr/lib/man-db{,/**}" mrwklix,
># Layout path: /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0
>"/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0{,/**}" mrwklix,
># Layout path: /usr/share/libdrm
>"/usr/share/libdrm{,/**}" mrwklix,
># Layout path: /usr/share/xml/iso-codes
>"/usr/share/xml/iso-codes{,/**}" mrwklix,
>}

Actions: View

Attachments on bug 1211989: 867626 | 867627 | 867630 | 867631 | 867632 | 867633 | 867634 | 867635 | 867652