usr.lib.tor-controlport-filter

## Copyright (C) 2015 - 2017 Patrick Schleizer <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

#include <tunables/global>

## The attach_disconnected flag prevents a denied
## message on /dev/null -> disconnected path.

/usr/lib/tor-controlport-filter flags=(attach_disconnected) {
  #include <abstractions/base>
  #include <abstractions/python>

  ## This script doesn't really need to read the interpreter that's running it.
  deny /usr/bin/python{2,3}.[0-7]* r,

  /etc/tor-controlport-filter.d/ r,
  /etc/tor-controlport-filter.d/* r,
  /usr/local/etc/tor-controlport-filter.d/ r,
  /usr/local/etc/tor-controlport-filter.d/* r,

  /run/tor/control.authcookie r,

  /tmp/* rwk,
  /var/tmp/* rwk,

  /usr/lib/ r,
  /usr/lib/tor-controlport-filter r,

  @{PROC}/[0-9]*/status r,
  @{PROC}/[0-9]*/mounts r,
}