# vim:syntax=apparmor

#include <tunables/global>

/usr/bin/pidgin {
  #include <abstractions/audio>
  #include <abstractions/aspell>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/consoles>
  #include <abstractions/dbus>
  #include <abstractions/dbus-session>
  #include <abstractions/fonts>
  #include <abstractions/freedesktop.org>
  #include <abstractions/gnome>
  #include <abstractions/launchpad-integration>
  #include <abstractions/nameservice>
  #include <abstractions/private-files-strict>
  #include <abstractions/ubuntu-browsers>
  #include <abstractions/ubuntu-console-browsers>
  #include <abstractions/user-download>
  #include <abstractions/user-tmp>
  #include <abstractions/ibus>
  #include <abstractions/X>

  deny capability sys_ptrace,

  deny @{HOME}/.bash* rw,
  deny @{HOME}/.cshrc rw,
  deny @{HOME}/.profile rw,
  deny @{HOME}/.zshrc rw,

  owner @{HOME}/.cache/dconf/user rw,
  owner @{HOME}/.config/dconf/user r,
  owner @{HOME}/.config/enchant/ rw,
  owner @{HOME}/.config/enchant/* rwk,
  owner @{HOME}/.local/share/icons/ r,
  owner @{HOME}/.local/share/mime/* r,
  owner @{HOME}/.gnome2/nautilus-sendto/** rw,
  owner @{HOME}/.gstreamer*/ rw,
  owner @{HOME}/.gstreamer*/** rw,
  owner @{HOME}/.pulse/ rw,
  owner @{HOME}/.pulse/** rw,
  owner @{HOME}/.pulse-cookie rwk,
  owner @{HOME}/.purple/ rw,
  owner @{HOME}/.purple/** rwk,

  /bin/dash rix,

  /{dev,run}/shm/ r,
  /{dev,run}/shm/* rw,

  /etc/ r,
  /etc/pulse/client.conf r,
  /etc/ssl/certs/ r,
  /etc/ssl/certs/** r,
  /etc/ssl/certs/ssl-cert-snakeoil.pem r,

  owner /tmp/orbit-*/* w,
  owner /tmp/pulse-*/* w,

  /usr/bin/gconftool-2 rix,
  /usr/bin/gnome-default-applications-properties ix,
  /usr/bin/gnome-network-preferences ix,
  /usr/bin/gnome-open rmix,
  /usr/bin/gsettings rix,
  /usr/bin/pidgin r,
  /usr/bin/xdg-open rmix,
  /bin/which rix,
  /usr/bin/gvfs-open rmix,

  /usr/share/glib-2.0/schemas/gschemas.compiled r,

  /usr/lib/ r,
  /usr/lib/frei0r-1/*.so rm,
  /usr/lib/libvisual-*/**.so rm,
  /usr/lib/pidgin/*.so rm,
  /usr/lib/purple*/*.so rm,

  /usr/share/ca-certificates/*/** r,
  /usr/share/enchant/enchant.ordering r,
  /usr/share/locale-langpack/** rm,
  /usr/share/purple/ca-certs/ r,
  /usr/share/purple/ca-certs/** r,
  /usr/share/myspell/dicts/ r,
  /usr/share/myspell/dicts/** r,
  /usr/share/tcltk/** r,

  /usr/share/themes/ r,
  /usr/share/themes/** r,

  /usr/share/hunspell/ r,
  /usr/share/hunspell/** r,

  deny @{PROC}/** r,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.pidgin>
}
