diff --git a/profiles/apparmor.d/qpdf b/profiles/apparmor.d/qpdf new file mode 100644 index 000000000..db9f97540 --- /dev/null +++ b/profiles/apparmor.d/qpdf @@ -0,0 +1,42 @@ +abi , + +include + +profile qpdf /usr/bin/qpdf { + include + + /usr/bin/qpdf mr, + + # common file formats for qpdf are included: .pdf, .json and .qdf + # user's home directories + owner @{HOME}/[^.]**.[qQpP][dD][fF] rw, + owner @{HOME}/[^.]**.[jJ][sS][oO][nN] rw, + # allow less common .in and .out files within user's directories + owner @{HOME}/[^.]**.[iI][nN] rw, + owner @{HOME}/[^.]**.[oO][uU][tT] rw, + + # tmp directories + owner /tmp/**.[qQpP][dD][fF] rw, + owner /tmp/**.[jJ][sS][oO][nN] rw, + owner /var/tmp/**.[qQpP][dD][fF] rw, + owner /var/tmp/**.[jJ][sS][oO][nN] rw, + + # mounts + owner /mnt/**.[qQpP][dD][fF] rw, + owner /mnt/**.[jJ][sS][oO][nN] rw, + owner /media/**.[qQpP][dD][fF] rw, + owner /media/**.[jJ][sS][oO][nN] rw, + /mnt/**.[qQpP][dD][fF] r, + /mnt/**.[jJ][sS][oO][nN] r, + /media/**.[qQpP][dD][fF] r, + /media/**.[jJ][sS][oO][nN] r, + + # system locations + /usr/**.[qQpP][dD][fF] r, + /usr/**.[jJ][sS][oO][nN] r, + /opt/**.[qQpP][dD][fF] r, + /opt/**.[jJ][sS][oO][nN] r, + + include if exists +} +