# vim:syntax=apparmor

#include <tunables/global>

/usr/bin/pidgin {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/dbus>
  #include <abstractions/dbus-session>
  #include <abstractions/dconf>
  #include <abstractions/enchant>
  #include <abstractions/gnome>
  #include <abstractions/ibus>
  #include <abstractions/launchpad-integration>
  #include <abstractions/nameservice>
  #include <abstractions/private-files-strict>
  #include <abstractions/ssl_certs>
  #include <abstractions/ubuntu-browsers>
  #include <abstractions/user-download>

  deny capability sys_ptrace,

  owner @{HOME}/.gstreamer*/ rw,
  owner @{HOME}/.gstreamer*/** rw,
  owner @{HOME}/.purple/ rw,
  owner @{HOME}/.purple/** rwk,
  owner @{HOME}/.cache/dconf/user rw,

  /bin/dash rix,
  /bin/which rix,

  /usr/bin/gconftool-2 rPix,
  /usr/bin/gnome-open rmix,
  /usr/bin/gsettings rix,
  /usr/bin/gvfs-open rmix,
  /usr/bin/pidgin r,
  /usr/bin/xdg-open rmix,

  /usr/share/glib-2.0/schemas/gschemas.compiled r,

  /usr/lib/frei0r-1/*.so rm,
  /usr/lib/@{multiarch}/libvisual-*/**.so rm,
  /usr/lib/pidgin/*.so rm,
  /usr/lib/purple*/*.so rm,

  /usr/share/purple/ca-certs/ r,
  /usr/share/purple/ca-certs/** r,
  /usr/share/tcltk/** r,
  /usr/share/themes/ r,

  owner @{PROC}/[0-9]*/auxv r,
  owner @{PROC}/[0-9]*/fd/ r,

  # For sound notifications
  owner /tmp/orcexec.* mr,
  # ... if /tmp is mounted noexec
  owner @{HOME}/orcexec.* mr,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.pidgin>
}
