summaryrefslogtreecommitdiffstats
path: root/sysui/desktop/apparmor/program.soffice.bin
blob: 212eb7c62b15531847533ee1e648372d2285214e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
# ------------------------------------------------------------------
#
#    Copyright (C) 2016 Canonical Ltd.
#    Copyright (C) 2018 Software in the Public Interest, Inc.
#
#    This Source Code Form is subject to the terms of the Mozilla Public
#    License, v. 2.0. If a copy of the MPL was not distributed with this
#    file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
#    Authors: Jonathan Davies <jonathan.davies@canonical.com>
#             Bryan Quigley <bryan.quigley@canonical.com>
#             Rene Engelhard <rene@debian.org>
#
# ------------------------------------------------------------------

# This profile should enable the average LibreOffice user to get their 
# work done while blocking some advanced usage
# Namely not tested and likely not working : embedded plugins,
# Using the LibreOffice SDK and other development tasks
# Everything else should be working

#Defines all common supported file formats
#Some obscure ones we're excluded (mostly input)

#Generic
#.txt
@{libreoffice_ext} = [tT][xX][tT]
#All the open document format
@{libreoffice_ext} += {,f,F}[oO][dDtT][tTsSpPbBgGfF]
#.xml and xsl
@{libreoffice_ext} += [xX][mMsS][lL]
#.pdf
@{libreoffice_ext} += [pP][dD][fF]
#Unified office format
@{libreoffice_ext} += [uU][oO][fFtTsSpP]
#(x)htm(l)
@{libreoffice_ext} += {,x,X}[hH][tT][mM]{,l,L}
#.epub
@{libreoffice_ext} += [eE][pP][uU][bB]
#.ps (printing to file)
@{libreoffice_ext} += [pP][sS]

#Images
@{libreoffice_ext} += [jJ][pP][gG]
@{libreoffice_ext} += [jJ][pP][eE][gG]
@{libreoffice_ext} += [pP][nN][gG]
@{libreoffice_ext} += [sS][vV][gG]
@{libreoffice_ext} += [sS][vV][gG][zZ]99251
@{libreoffice_ext} += [tT][iI][fF]
@{libreoffice_ext} += [tT][iI][fF][fF]

#Writer
@{libreoffice_ext} += [dD][oO][cCtT]{,x,X}
@{libreoffice_ext} += [rR][tT][fF]

#Calc
@{libreoffice_ext} += [xX][lL][sStT]{,x,X,m,M}
@{libreoffice_ext} += [xX][lL][wW]
#.dif dbf
@{libreoffice_ext} += [dD][iIbB][fF]
#.tsv .csv
@{libreoffice_ext} += [cCtT][sS][vV]
@{libreoffice_ext} += [sS][lL][kK]

#Impress/Draw
@{libreoffice_ext} += [pP][pP][tTsS]{,x,X}
@{libreoffice_ext} += [pP][oO][tT]{,m,M}
#Photoshop
@{libreoffice_ext} += [pP][sS][dD]

#Math
@{libreoffice_ext} += [mM][mM][lL]

@{libo_user_dirs} = @{HOME} /mnt /media

#include <tunables/global>

profile libreoffice-soffice INSTDIR-program/soffice.bin {
  #include <abstractions/private-files>

  #include <abstractions/audio>
  #include <abstractions/bash>
  #include <abstractions/cups-client>
  #include <abstractions/dbus>
  #include <abstractions/dbus-session>
  #include <abstractions/dbus-accessibility>
  #include <abstractions/ibus>
  #include <abstractions/nameservice>
  #include <abstractions/gnome>
# GnuPG1 only...
# #include <abstractions/gnupg>
  #include <abstractions/python>
  #include <abstractions/p11-kit>

  #List directories for file browser
  /                                     r,
  /**/                                  r,

  owner @{libo_user_dirs}/**/           rw,  #allow creating directories that we own
  owner @{libo_user_dirs}/**~lock.*     rw,  #lock file support
  owner @{libo_user_dirs}/**.@{libreoffice_ext} rwk,  #Open files rw with the right exts
  owner @{libo_user_dirs}/{,**/}lu??????????{,?}.tmp rwk, #Temporary file used when saving
  owner @{libo_user_dirs}/{,**/}.directory r, #Read directory settings on KDE

  # Settings
  /etc/libreoffice/                     r,
  /etc/libreoffice/**                   r,

  /etc/cups/ppd/*.ppd                   r,
  /etc/xml/catalog                      r, #exporting to .xhtml, for libxml2
  /proc/*/status                        r,

  owner @{HOME}/.config/libreoffice{,dev}/** rwk,
  owner @{HOME}/.config/soffice.binrc rwl -> @{HOME}/.config/#[0-9]*,
  owner @{HOME}/.config/soffice.binrc.* rwl -> @{HOME}/.config/#[0-9]*,
  owner @{HOME}/.config/soffice.binrc.lock rwk,
  owner @{HOME}/.cache/fontconfig/**    rw,
  owner @{HOME}/.config/gtk-???/bookmarks r,  #Make bookmarks work
  owner /tmp/psp[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]* rw, #/tmp/psp1534203998 (printing to file)

  owner /{,var/}run/user/*/dconf/user   rw,
  owner @{HOME}/.config/dconf/user      r,

  # allow schema to be read
  /usr/share/glib-*/schemas/            r,
  /usr/share/glib-*/schemas/**          r,

  # bluetooth send to
  network bluetooth,

  /{usr/,}bin/sh                        rmix,
  /{usr/,}bin/bash                      rmix,
  /{usr/,}bin/dash                      rmix,
  /{usr/,}bin/rm                        rmix, #deleting /tmp/psp1534203998 (printing to file)
  /usr/bin/bluetooth-sendto             rmPUx,
  /usr/bin/lpr                          rmPUx,
  /usr/bin/paperconf                    rmix,
  /usr/bin/gpgconf                      rmix,
  /usr/bin/gpg                          rmCx -> gpg,
  /usr/bin/gpgsm                        rmCx -> gpg,
  /usr/bin/gpa                          rix,
  /usr/bin/seahorse                     rix,
  /usr/bin/kgpg                         rix,
  /usr/bin/kleopatra                    rix,

  /dev/tty                              rw,

  /usr/lib{,32,64}/@{multiarch}/gstreamer???/gstreamer-???/gst-plugin-scanner   rmPUx,
  owner @{HOME}/.cache/gstreamer-???/**                                 rw,
  unix peer=(addr=@/tmp/.ICE-unix/* label=unconfined),  #Gstreamer doesn't work without this

  /usr/lib{,32,64}/jvm/                         r,
  /usr/lib{,32,64}/jvm/**                       r,
  /usr/lib{,32,64}/jvm/**/jre/bin/java          mix,
  /usr/lib{,32,64}/jvm/**/bin/java              mix,
  INSTDIR-**                        rw,
  INSTDIR-**.so                     m,
  INSTDIR-program/soffice.bin       mix,
  INSTDIR-program/xpdfimport        px,
  INSTDIR-program/senddoc           px,
  /usr/bin/xdg-open                 rPUx,

  /usr/share/java/**.jar                r,
  /usr/share/hunspell/                  r,
  /usr/share/hunspell/**                r,
  /usr/share/hyphen/                    r,
  /usr/share/hyphen/**                  r,
  /usr/share/mythes/                    r,
  /usr/share/mythes/**                  r,
  /usr/share/liblangtag/                r,
  /usr/share/liblangtag/**              r,
  /usr/share/libreoffice/               r,
  /usr/share/libreoffice/**             r,
  /usr/share/yelp-xsl/xslt/mallard/**   r,
  /usr/share/libexttextcat/*            r,
  /usr/share/icu/**                     r,
  /usr/share/locale-bundle/*            r,

  /var/spool/libreoffice/               r,
  /var/spool/libreoffice/**             rw,
  /var/cache/fontconfig/                rw,

  #Likely moving to abstractions in the future
  owner @{HOME}/.icons/*/cursors/*      r,
  /etc/fstab r, # Solid::DeviceNotifier::instance() TODO: deny?
  /sys/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r, # for libdrm
  /usr/share/*-fonts/conf.avail/*.conf  r,
  /usr/share/fonts-config/conf.avail/*.conf r,
  /{,var/}run/udev/data/+usb:* r, # Solid::Device::listFromQuery()
  /{,var/}run/udev/data/{c,b}*:* r, # Solid::Device::description(), Solid::Device::listFromQuery()
  @{PROC}/sys/kernel/random/boot_id r, # KRecentDocument::add() -> QSysInfo::bootUniqueId()

  #To avoid "Unable to create io-slave." for file dialog
  owner /{,var/}run/user/[0-9]*/#[0-9]* rw,
  #For KIO IO::Slave::createSlave()
  owner /{,var/}run/user/[0-9]*/soffice.bin*.slave-socket wl ->  /{,var/}run/user/[0-9]*/#[0-9]*,

  owner @{HOME}/.mozilla/firefox/profiles.ini r,
  owner @{HOME}/.mozilla/firefox/*/secmod.db r,
  # firefox < 58
  owner @{HOME}/.mozilla/firefox/*/cert8.db r,
  # firefox >= 58
  owner @{HOME}/.mozilla/firefox/*/cert9.db r,

  owner @{HOME}/.local/share/user-places.xbel r,

  # there is abstractions/gnupg but that's just for gpg1...
  profile gpg {
    #include <abstractions/base>

   /usr/bin/gpgconf rm,
   /usr/bin/gpg rm,
   /usr/bin/gpgsm rm,

    owner @{HOME}/.gnupg/* r,
    owner @{HOME}/.gnupg/random_seed rk,
  }

  # probably should become a subprofile like gpg above, but then it doesn't
  # work either as it tries to access stuff only allowed above...
  owner @{HOME}/.config/kdeglobals r,
  /usr/lib/libreoffice/program/lo_kde5filepicker rPUx,
  /usr/share/qt5/translations/* r,
  /usr/lib/*/qt5/plugins/** rm,
  /usr/share/plasma/look-and-feel/**/contents/defaults r,

  # TODO: remove when rules are available in abstractions/kde
  owner @{HOME}/.cache/ksycoca5_??_* r, # KDE System Configuration Cache
  owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget
  owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget
  owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent()
  owner @{HOME}/.config/klanguageoverridesrc r, # per-application languages, for KDEPrivate::initializeLanguages() from libKF5XmlGui.so
  owner @{HOME}/.config/trashrc r, # user by KFileWidget
  /usr/share/knotifications5/*.notifyrc r, # KNotification::sendEvent

  # TODO: remove when rules are available in abstractions/kde-write-icon-cache or similar
  owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader

  # TODO: remove when rules are available in abstractions/kdeframeworks5 or similar
  /usr/share/kservices5/*.protocol r,

  # TODO: use qt5-settings-write abstraction when it is available
  owner @{HOME}/.config/#[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9] rw,
  owner @{HOME}/.config/QtProject.conf rw,
  owner @{HOME}/.config/QtProject.conf.?????? l -> @{HOME}/.config/#[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],
  owner @{HOME}/.config/QtProject.conf.?????? rw, # for temporary files like QtProject.conf.Aqrgeb
  owner @{HOME}/.config/QtProject.conf.lock rwk,

  # TODO: use qt5-compose-cache-write abstraction when it is available
  owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r,

  # TODO: use recent-documents-write abstraction when it is available
  owner @{HOME}/.local/share/RecentDocuments/** r,
  owner @{HOME}/.local/share/RecentDocuments/*.desktop rwl -> @{HOME}/.local/share/RecentDocuments/#[0-9]*,
  owner @{HOME}/.local/share/RecentDocuments/#[0-9]* rw,
  owner @{HOME}/.local/share/RecentDocuments/*.lock rwk,

  # TODO: use kde-globals-write abstraction when it is available
  owner @{HOME}/.config/kdeglobals rw,
  owner @{HOME}/.config/kdeglobals.* rwl -> @{HOME}/.config/#[0-9]*,
  owner @{HOME}/.config/kdeglobals.lock rwk,
}