sysui/desktop/apparmor/program.soffice.bin

   1 # ------------------------------------------------------------------
   2 #
   3 #    Copyright (C) 2015 Canonical Ltd.
   4 #
   5 #    This Source Code Form is subject to the terms of the Mozilla Public
   6 #    License, v. 2.0. If a copy of the MPL was not distributed with this
   7 #    file, You can obtain one at http://mozilla.org/MPL/2.0/.
   8 #
   9 #    Authors: Jonathan Davies <jonathan.davies@canonical.com>
  10 #             Bryan Quigley <bryan.quigley@canonical.com>
  11 #
  12 # ------------------------------------------------------------------
  13
  14 # This profile should enable the average LibreOffice user to get their
  15 # work done while blocking some advanced usage
  16 # Namely not tested and likely not working : embedded plugins,
  17 # Using the LibreOffice SDK and other development tasks
  18 # Everything else should be working
  19
  20 #Defines all common supported file formats
  21 #Some obscure ones we're excluded (mostly input)
  22
  23 #Generic
  24 @{libreoffice_ext} = [tT][xX][tT]  #.txt
  25 @{libreoffice_ext} += {,f,F}[oO][dDtT][tTsSpPbBgGfF]  #All the open document format
  26 @{libreoffice_ext} += [xX][mMsS][lL]  #.xml and xsl
  27 @{libreoffice_ext} += [pP][dD][fF]  #.pdf
  28 @{libreoffice_ext} += [uU][oO][fFtTsSpP]  #Unified office format
  29 @{libreoffice_ext} += {,x,X}[hH][tT][mM]{,l,L}  #(x)htm(l)
  30
  31 #Images
  32 @{libreoffice_ext} += [jJ][pP][gG]
  33 @{libreoffice_ext} += [jJ][pP][eE][gG]
  34 @{libreoffice_ext} += [pP][nN][gG]
  35 @{libreoffice_ext} += [sS][vV][gG]
  36 @{libreoffice_ext} += [sS][vV][gG][zZ]
  37 @{libreoffice_ext} += [tT][iI][fF]
  38 @{libreoffice_ext} += [tT][iI][fF][fF]
  39
  40 #Writer
  41 @{libreoffice_ext} += [dD][oO][cCtT]{,x,X}
  42 @{libreoffice_ext} += [rR][tT][fF]
  43
  44 #Calc
  45 @{libreoffice_ext} += [xX][lL][sSwWtT]{,x,X}
  46 @{libreoffice_ext} += [dD][iIbB][fF]  #.dif dbf
  47 @{libreoffice_ext} += [cCtT][sS][vV]  #.tsv .csv
  48 @{libreoffice_ext} += [sS][lL][kK]
  49
  50 #Impress/Draw
  51 @{libreoffice_ext} += [pP][pP][tTsS]{,x,X}
  52 @{libreoffice_ext} += [pP][oO][tT]{,m,M}
  53 @{libreoffice_ext} += [sS][wW][fF]
  54 @{libreoffice_ext} += [pP][sS][dD]  #Photoshop
  55
  56 #Math
  57 @{libreoffice_ext} += [mM][mM][lL]
  58
  59 @{libo_user_dirs} = @{HOME} /mnt /media
  60
  61 #include <tunables/global>
  62
  63 profile libreoffice-soffice INSTDIR-program/soffice.bin {
  64   #include <abstractions/private-files-strict>
  65
  66   #include <abstractions/audio>
  67   #include <abstractions/bash>
  68   #include <abstractions/cups-client>
  69   #include <abstractions/dbus>
  70   #include <abstractions/dbus-session>
  71   #include <abstractions/dbus-accessibility>
  72   #include <abstractions/ibus>
  73   #include <abstractions/nameservice>
  74   #include <abstractions/gnome>
  75   #include <abstractions/python>
  76   #include <abstractions/p11-kit>
  77
  78   #List directories for file browser
  79   /                                     r,
  80   /**/                                  r,
  81
  82   owner @{libo_user_dirs}/**/           rw,  #allow creating directories that we own
  83   owner @{libo_user_dirs}/**~lock.*     rw,  #lock file support
  84   owner @{libo_user_dirs}/**.@{libreoffice_ext} rwk,  #Open files rw with the right exts
  85
  86   # Settings
  87   /etc/libreoffice/                     r,
  88   /etc/libreoffice/**                   r,
  89
  90   /etc/cups/ppd/*.ppd                   r,
  91   /proc/*/status                        r,
  92
  93   owner @{HOME}/.config/libreoffice{,dev}/** rwk,
  94   owner @{HOME}/.cache/fontconfig/**    rw,
  95   owner @{HOME}/.config/gtk-???/bookmarks r,  #Make bookmarks work
  96   owner @{HOME}/.recently-used          rwk,
  97
  98   owner /{,var/}run/user/*/dconf/user   rw,
  99   owner @{HOME}/.config/dconf/user      r,
 100
 101   # allow schema to be read
 102   /usr/share/glib-*/schemas/            r,
 103   /usr/share/glib-*/schemas/**          r,
 104
 105   # bluetooth send to
 106   network bluetooth,
 107
 108   /bin/sh                               rmix,
 109   /bin/bash                             rmix,
 110   /bin/dash                             rmix,
 111   /usr/bin/bluetooth-sendto             rmPUx,
 112   /usr/bin/lpr                          rmPUx,
 113   /usr/bin/paperconf                    rmix,
 114
 115   /dev/tty                              rw,
 116
 117   /usr/lib{,32,64}/@{multiarch}/gstreamer???/gstreamer-???/gst-plugin-scanner   rmPUx,
 118   owner @{HOME}/.cache/gstreamer-???/**                                 rw,
 119   unix peer=(addr=@/tmp/.ICE-unix/* label=unconfined),  #Gstreamer doesn't work without this
 120
 121   /usr/lib{,32,64}/jvm/                         r,
 122   /usr/lib{,32,64}/jvm/**                       r,
 123   INSTDIR-**                        ra,
 124   INSTDIR-**.so                     rm,
 125   INSTDIR-program/gnome-open-url    rmPUx,  #This doesn't seem to be used on my install
 126   INSTDIR-program/soffice.bin       rmix,
 127   INSTDIR-program/xpdfimport        rPx,
 128   INSTDIR-program/open-url          rPx,
 129   INSTDIR-program/senddoc           rPx,
 130   /usr/lib{,32,64}/ure/                         r,
 131   /usr/lib{,32,64}/ure/**                       rm,
 132
 133   /usr/share/java/**.jar                r,
 134   /usr/share/hunspell/                  r,
 135   /usr/share/hunspell/**                r,
 136   /usr/share/hyphen/                    r,
 137   /usr/share/hyphen/**                  r,
 138   /usr/share/mythes/                    r,
 139   /usr/share/mythes/**                  r,
 140   /usr/share/liblangtag/                r,
 141   /usr/share/liblangtag/**              r,
 142   /usr/share/libreoffice/               r,
 143   /usr/share/libreoffice/**             r,
 144   /usr/share/yelp-xsl/xslt/mallard/**   r,
 145   /usr/share/libexttextcat/*            r,
 146   /usr/share/icu/**                     r,
 147   /usr/share/locale-bundle/*            r,
 148
 149   /var/spool/libreoffice/               r,
 150   /var/spool/libreoffice/**             rw,
 151   /var/cache/fontconfig/                rw,
 152
 153   #Likely moving to abstractions in the future
 154   owner @{HOME}/.icons/*/cursors/*      r,
 155   /usr/share/*-fonts/conf.avail/*.conf  r,
 156   /usr/share/fonts-config/conf.avail/*.conf r,
 157 }