gnome-shell

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = /{usr/,}bin/gnome-shell
profile gnome-shell @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/app-launcher-user>
  include <abstractions/audio>
  include <abstractions/dbus-accessibility-strict>
  include <abstractions/dbus-network-manager-strict>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
  include <abstractions/dri-common>
  include <abstractions/dri-enumerate>
  include <abstractions/fontconfig-cache-write>
  include <abstractions/gnome>
  include <abstractions/gstreamer>
  include <abstractions/ibus>
  include <abstractions/mesa>
  include <abstractions/nameservice-strict>
  include <abstractions/opencl-intel>
  include <abstractions/opencl-mesa>
  include <abstractions/opencl-nvidia>
  include <abstractions/p11-kit>
  include <abstractions/ssl_certs>
  include <abstractions/thumbnails-cache-read>
  include <abstractions/video>
  include <abstractions/vulkan>
  include <abstractions/X-strict>

  capability sys_nice,
  capability sys_ptrace,

  network inet stream,
  network inet6 stream,
  network inet dgram,
  network inet6 dgram,
  network netlink raw,

  ptrace (read),

  signal (receive) set=(term, hup) peer=gdm*,
  signal (send),

  unix (send,receive) type=stream addr=none peer=(label=gnome-extension-ding),
  unix (send,receive) type=stream addr=none peer=(label=xkbcomp),
  unix (send,receive) type=stream addr=none peer=(label=xwayland),
  unix (send, receive, connect) type=stream peer=(addr="@/var/lib/gdm{3,}/.cache/ibus/dbus-*", label=ibus-daemon),

  dbus send bus=session path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
       member={RequestName,ReleaseName,ListNames}
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

  dbus send bus=session path=/ interface=org.freedesktop.DBus
       member=ListNames
       peer=(name=org.freedesktop.DBus label=dbus-daemon),

  dbus send bus=session path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

  dbus send bus=system  path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
       member=GetConnectionUnixUser,

  dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
       interface=org.freedesktop.{DBus.Properties,PolicyKit[0-9].Authority}
       member={CheckAuthorization,RegisterAuthenticationAgent,Changed,GetAll},

  dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
       interface=org.freedesktop.{DBus.Properties,Accounts*}
       member={GetAll,FindUserByName,Changed,PropertiesChanged,FindUserById,ListCachedUsers,UserAdded},

  dbus (send,receive) bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
       interface=org.freedesktop.DBus.Properties
       member={GetAll,PropertiesChanged},

  dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
       interface=org.freedesktop.{DBus.Properties,GeoClue2.Manager}
       member={PropertiesChanged,AddAgent,GetAll},

  dbus send    bus=system path=/org/freedesktop
       interface=org.freedesktop.DBus.ObjectManager
       member=GetManagedObjects
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop
       interface=org.freedesktop.DBus.ObjectManager
       member={InterfacesAdded,InterfacesRemoved}
       peer=(name=:*, label=NetworkManager),

  dbus send bus=system path=/org/gnome/DisplayManager/Manager
       interface=org.{freedesktop.DBus.Properties,gnome.DisplayManager.Manager}
       member={RegisterSession,Get,GetAll,OpenReauthenticationChannel,OpenSession},

  dbus send bus=system path=/org/freedesktop/PackageKit
       interface=org.freedesktop.DBus.Properties
       member=GetAll,

  dbus receive bus=session path=/org/freedesktop/Notifications
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gjs-console),

  dbus send bus=session path=/org/freedesktop/secrets
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gnome-keyring-daemon),

  dbus send bus=session path=/org/freedesktop/secrets
       interface=org.freedesktop.Secret.Service
       member=SearchItems
       peer=(name=:*, label=gnome-keyring-daemon),

  dbus send bus=system path=/net/hadess/{PackageKit,PowerProfiles,SwitcherooControl}
       interface=org.freedesktop.DBus.Properties
       member=GetAll,

  dbus send bus=system path=/org/freedesktop/locale[0-9]*
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=org.freedesktop.locale[0-9]*), # all peer's labels

  dbus send    bus=session path=/org/gnome/SettingsDaemon/Power
       interface=org.freedesktop.DBus.Properties
       member={GetAll,Set}
       peer=(name=:*, label=gsd-power),

  dbus receive bus=session path=/org/gnome/SettingsDaemon/Power
       interface=org.freedesktop.DBus.Properties
       member=PropertiesChanged
       peer=(name=:*, label=gsd-power),

  dbus send bus=system path=/net/reactivated/Fprint/Manager
       interface=net.reactivated.Fprint.Manager
       member=GetDefaultDevice,

  dbus send    bus=system path=/org/freedesktop/NetworkManager/Devices/[0-9]*
       interface=org.freedesktop.NetworkManager.Device
       member=Disconnect
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]*
       interface=org.freedesktop.NetworkManager.Connection.Active
       member=StateChanged
       peer=(name=:*, label=NetworkManager),

  dbus send    bus=system path=/org/freedesktop/NetworkManager/Settings/[0-9]*
       interface=org.freedesktop.NetworkManager.Settings.Connection
       member=GetSettings
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop/NetworkManager/Settings/[0-9]*
       interface=org.freedesktop.NetworkManager.Settings.Connection
       member=Updated
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop/NetworkManager/SecretAgent
       interface=org.freedesktop.NetworkManager.SecretAgent
       member={SaveSecrets,DeleteSecrets}
       peer=(name=:*, label=NetworkManager),

  dbus send    bus=system path=/org/freedesktop/NetworkManager{,/AgentManager}
       interface=org.freedesktop.NetworkManager{,.AgentManager}
       member={Unregister,RegisterWithCapabilities,GetPermissions},

  dbus send    bus=system path=/org/freedesktop/NetworkManager
       interface=org.freedesktop.NetworkManager
       member=ActivateConnection
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop/NetworkManager
       interface=org.freedesktop.NetworkManager
       member=CheckPermissions,

  dbus receive bus=system path=/org/freedesktop/NetworkManager{,/**}
       interface=org.freedesktop.DBus.Properties
       member=PropertiesChanged
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/AuthenticationAgent
       interface=org.freedesktop.PolicyKit[0-9].AuthenticationAgent
       member=BeginAuthentication,

  dbus send    bus=session path=/org/freedesktop/systemd[0-9]*
       interface=org.freedesktop.systemd[0-9]*.Manager
       member={GetUnit,StartUnit,StartTransientUnit}
       peer=(name=org.freedesktop.systemd[0-9]*), # all peer's labels

  dbus receive bus=session path=/org/freedesktop/systemd[0-9]*
       interface=org.freedesktop.systemd[0-9]*.Manager
       member=JobRemoved
       peer=(name=:*),

  dbus (send, receive) bus=system path=/org/freedesktop/login[0-9]{,/**}
       interface=org.freedesktop.{DBus.Properties,login[0-9].{Manager,Session}}
       peer=(name=:*, label=systemd-logind),

  dbus send    bus=session path=/org/gnome/Mutter/DisplayConfig
       interface=org.gnome.Mutter.DisplayConfig
       member={GetResources,GetCrtcGamma}
       peer=(name=:*, label=gnome-shell),

  dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig
       interface=org.gnome.Mutter.DisplayConfig
       member={GetResources,GetCrtcGamma}
       peer=(name=:*, label="{gsd-power,gsd-color}"),

  dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig
       interface=org.gnome.Mutter.DisplayConfig
       member=GetCurrentState
       peer=(name=:*, label=xdg-desktop-portal-*),

  dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig
       interface=org.gnome.Mutter.DisplayConfig
       member=GetCurrentState
       peer=(name=:*, label="{spice-vdagent,gsd-xsettings}"),

  dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig
       interface=org.freedesktop.DBus.Properties
       member={GetAll,GetResources,Set}
       peer=(name=:*, label="{gsd-power,gsd-color,xdg-desktop-portal-*}"),

  dbus receive bus=session path=/org/{gnome/Shell/Screenshot,gnome/Shell/Introspect,gtk/Notifications,gnome/Mutter/RemoteDesktop,gnome/Mutter/ScreenCast}
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:* label=xdg-desktop-portal-*),

  dbus receive bus=session path=/org/gnome/Shell/Introspect
       interface=org.freedesktop.DBus.Properties
       member=Get
       peer=(name=:*, label=gsd-xsettings),

  dbus receive bus=session path=/org/gnome/ScreenSaver
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gjs-console),

  dbus send    bus=session path=/org/gnome/ScreenSaver
       interface=org.gnome.ScreenSaver
       member={ActiveChanged,WakeUpScreen}
       peer=(name=org.freedesktop.DBus, label=gjs-console),

  dbus receive bus=session path=/org/gnome/Shell
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gsd-media-keys),

  dbus send    bus=session path=/org/gnome/Shell
       interface=org.gnome.Shell
       member=AcceleratorActivated
       peer=(name=:*, label=gsd-media-keys),

  dbus receive bus=session path=/org/gnome/Shell
       interface=org.gnome.Shell
       member={GrabAccelerators,UngrabAccelerators}
       peer=(name=:*, label=gsd-media-keys),

  dbus send    bus=session path=/org/gnome/Shell/Introspect
       interface=org.gnome.Shell.Introspect
       member={RunningApplicationsChanged,WindowsChanged}
       peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal-*),

  dbus receive bus=session path=/org/gnome/Shell/Introspect
       interface=org.gnome.Shell.Introspect
       member=GetRunningApplications
       peer=(name=:*, label=xdg-desktop-portal-*),

  dbus receive bus=session path=/org/freedesktop/portal/desktop
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=xdg-desktop-portal),

  dbus send    bus=session path=/org/freedesktop/impl/portal/PermissionStore
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=xdg-permission-store),

  dbus send    bus=session path=/org/freedesktop/impl/portal/PermissionStore
       interface=org.freedesktop.impl.portal.PermissionStore
       member=Lookup
       peer=(name=:*, label=xdg-permission-store),

  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/**}
       interface=org.freedesktop.DBus.Properties
       member={GetAll,PropertiesChanged}
       peer=(name=:*, label=gnome-session-binary),

  dbus receive bus=session path=/org/gnome/SessionManager/Presence
       interface=org.gnome.SessionManager.Presence
       member=StatusChanged
       peer=(name=:*, label=gnome-session-binary),

  dbus send    bus=session path=/org/gnome/SessionManager/EndSessionDialog
       interface=org.gnome.SessionManager.EndSessionDialog
       member={Canceled,Closed,ConfirmedLogout,ConfirmedReboot,ConfirmedShutdown}
       peer=(name=org.freedesktop.DBus, label=gnome-session-binary),

  dbus receive bus=session path=/org/gnome/SessionManager/EndSessionDialog
       interface=org.gnome.SessionManager.EndSessionDialog
       member={Open,Close}
       peer=(name=:*, label=gnome-session-binary),

  dbus send    bus=session path=/org/gnome/SessionManager
       interface=org.gnome.SessionManager
       member=Setenv
       peer=(name=org.gnome.SessionManager, label=gnome-session-binary),

  dbus send    bus=session path=/org/gnome/SessionManager
       interface=org.gnome.SessionManager
       member={CanShutdown,Shutdown,Reboot,Logout}
       peer=(name=:*, label=gnome-session-binary),

  dbus receive bus=session path=/org/gnome/SessionManager
       interface=org.gnome.SessionManager
       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
       peer=(name=:*, label=gnome-session-binary),

  dbus send    bus=session path=/org/gnome/SessionManager/Inhibitor[0-9]*
       interface=org.gnome.SessionManager.Inhibitor
       member=GetAppId
       peer=(name=:*, label=gnome-session-binary),

  dbus send    bus=session
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*), # all paths and peer's labels

  dbus receive bus=session path=/{,org,StatusNotifierWatcher}
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=:*, label=gnome-shell), # itself

  dbus (send, receive) bus=session path=/org/gnome/SettingsDaemon/Rfkill
       interface=org.freedesktop.DBus.Properties
       member={GetAll,PropertiesChanged}
       peer=(name=:*, label=gsd-rfkill),

  dbus send bus=session path=/org/gnome/SettingsDaemon/Color
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gsd-color),

  dbus send bus=session path=/org/gnome/SettingsDaemon/Wacom
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gsd-wacom),

  dbus send bus=session path=/org/gnome/SettingsDaemon/Smartcard
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gsd-smartcard),

  dbus send bus=session path=/org/gnome/SettingsDaemon/Smartcard
       interface=org.freedesktop.DBus.ObjectManager
       member=GetManagedObjects
       peer=(name=:*, label=gsd-smartcard),

  dbus receive bus=session path=/org/gnome/Mutter/IdleMonitor 
       interface=org.freedesktop.DBus.ObjectManager
       member=GetManagedObjects
       peer=(name=:*, label="{gnome-session-binary,gsd-power}"),

  dbus send    bus=session path=/org/gnome/Mutter/IdleMonitor/Core
       interface=org.gnome.Mutter.IdleMonitor
       member=WatchFired
       peer=(name=:*, label="{gnome-session-binary,gsd-power}"),

  dbus receive bus=session path=/org/gnome/Mutter/IdleMonitor/Core
       interface=org.gnome.Mutter.IdleMonitor
       member={AddIdleWatch,AddUserActiveWatch,RemoveWatch}
       peer=(name=:*, label="{gnome-session-binary,gsd-power}"),

  dbus receive bus=session path=/com/rastersoft/dingextension/control
       interface=org.gtk.Actions
       member=DescribeAll
       peer=(name=:*, label=gnome-extension-ding),

  dbus send    bus=session path=/com/rastersoft/ding
       interface=org.gtk.Actions
       member=DescribeAll
       peer=(name=:*, label=gnome-extension-ding),

  dbus send    bus=session path=/com/rastersoft/ding
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gnome-extension-ding),

  dbus send    bus=session path=/ca/desrt/dconf/Writer/user
       interface=ca.desrt.dconf.Writer
       member=Change
       peer=(name=ca.desrt.dconf), # no peer's labels

  dbus receive bus=session path=/ca/desrt/dconf/Writer/user
       interface=ca.desrt.dconf.Writer
       member=Notify
       peer=(name=:*, label=dconf-service),

  dbus send    bus=session path=/org/gnome/ControlCenter
       interface=org.gtk.Actions
       member=DescribeAll
       peer=(name=:*, label=gnome-control-center),

  dbus send    bus=session path=/org/gnome/ControlCenter
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=gnome-control-center),

  dbus receive bus=session path=/org/gnome/ControlCenter
       interface=org.gtk.Actions
       member=Changed
       peer=(name=:*, label=gnome-control-center),

  dbus send    bus=session path=/org/gnome/ControlCenter/window/[0-9]*
       interface=org.gtk.Actions
       member=DescribeAll
       peer=(name=:*, label=gnome-control-center),

  dbus send bus=session path=/org/gtk/vfs/metadata
       interface=org.gtk.vfs.Metadata
       member={Remove,GetTreeFromDevice}
       peer=(name=:*, label=gvfsd-metadata),

  dbus receive bus=session path=/org/gtk/vfs/mounttracker
       interface=org.gtk.vfs.MountTracker
       member=Mounted
       peer=(name=:*, label=gvfsd),

  dbus send bus=session path=/org/a11y/bus
       interface=org.a11y.Bus
       member=GetAddress
       peer=(name=org.a11y.Bus), # all peer's labels

  dbus send    bus=accessibility path=/org/a11y/atspi/registry
       interface=org.a11y.atspi.Registry
       member=GetRegisteredEvents
       peer=(name=org.a11y.atspi.Registry), # all peer's labels

  dbus receive bus=accessibility path=/org/a11y/atspi/registry
       interface=org.a11y.atspi.Registry
       member=EventListenerDeregistered
       peer=(name=:*, label=at-spi2-registryd),

  dbus send    bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
       interface=org.a11y.atspi.DeviceEventController
       member={GetKeystrokeListeners,GetDeviceEventListeners}
       peer=(name=org.a11y.atspi.Registry), # all peer's labels

  dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
       interface=org.a11y.atspi.Socket
       member=Embed
       peer=(name=org.a11y.atspi.Registry), # all peer's labels

  dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
       interface=org.gtk.Private.RemoteVolumeMonitor
       member={List,IsSupported}
       peer=(name=:*, label=gvfs-*-volume-monitor),

  dbus bind bus=session name=com.rastersoft.dingextension,

  dbus bind bus=session name=com.canonical.Unity,

  dbus bind bus=session name=org.kde.StatusNotifierWatcher,

  dbus bind bus=session name=org.gtk.MountOperationHandler,

  dbus bind bus=session name=org.gtk.Notifications,

  dbus bind bus=session name=org.gnome.*,

  @{exec_path} mr,

  /{usr/,}bin/Xwayland        rPx,
  @{libexec}/polkit-1/polkit* rPx,
  @{libexec}/*                rPUx,

  /usr/share/gnome-shell/extensions/ding@rastersoft.com/ding.js rPx,

  /opt/*/**/*.png r,
  /snap/*/@{uid}/**.png r,
  /usr/share/{,zoneinfo-}icu/{,**} r,
  /usr/share/app-info/icons/{,**} r,
  /usr/share/backgrounds/{,**} r,
  /usr/share/dconf/profile/gdm r,
  /usr/share/desktop-base/** r,
  /usr/share/desktop-directories/{,*.directory} r,
  /usr/share/egl/{,**} r,
  /usr/share/evolution-data-server/icons/{,**} r,
  /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
  /usr/share/gdm/BuiltInSessions/{,*.desktop} r,
  /usr/share/gdm/greeter-dconf-defaults r,
  /usr/share/gdm/greeter/applications/{,**} r,
  /usr/share/gnome-shell/{,**} r,
  /usr/share/libdrm/*.ids r,
  /usr/share/libgweather/Locations.xml r,
  /usr/share/libinput*/ r,
  /usr/share/libinput*/{,**/}[0-9][0-9]-*.quirks r,
  /usr/share/libinput*/libinput/ r,
  /usr/share/libwacom/{,*.stylus,*.tablet} r,
  /usr/share/pipewire/client.conf r,
  /usr/share/plymouth/*.png r,
  /usr/share/wallpapers/** r,
  /usr/share/wayland-sessions/{,*.desktop} r,
  /usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r,

  # freedesktop.org-strict
  /usr/share/*ubuntu/applications/{,**} r,
  /usr/share/glib-2.0/schemas/gschemas.compiled r,

  /.flatpak-info r,
  /etc/fstab r,
  /etc/udev/hwdb.bin r,
  /etc/pipewire/client.conf.d/{,**} r,
  /etc/xdg/menus/gnome-applications.menu r,

  /var/lib/gdm{3,}/.cache/ w,
  /var/lib/gdm{3,}/.cache/event-sound-cache.tdb.*.x86_64-pc-linux-gnu rwk,
  /var/lib/gdm{3,}/.cache/fontconfig/{,*} rwl, 
  /var/lib/gdm{3,}/.cache/gstreamer-[0-9]*/ rw,
  /var/lib/gdm{3,}/.cache/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
  /var/lib/gdm{3,}/.cache/libgweather/ r,
  /var/lib/gdm{3,}/.cache/mesa_shader_cache/ rw,
  /var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw,
  /var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/@{hex} rw,
  /var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/@{hex}.tmp rwk,
  /var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
  /var/lib/gdm{3,}/.config/dconf/user r,
  /var/lib/gdm{3,}/.config/ibus/ rw,
  /var/lib/gdm{3,}/.config/ibus/bus/ rw,
  /var/lib/gdm{3,}/.config/ibus/bus/@{hex}-unix-{,wayland-}[0-9] r,
  /var/lib/gdm{3,}/.config/pulse/ r,
  /var/lib/gdm{3,}/.config/pulse/client.conf r,
  /var/lib/gdm{3,}/.config/pulse/cookie rwk,
  /var/lib/gdm{3,}/.local/share/applications/{,**} r,
  /var/lib/gdm{3,}/.local/share/gnome-shell/ rw,
  /var/lib/gdm{3,}/.local/share/icc/{,*} rw,

  /var/lib/gdm{3,}/greeter-dconf-defaults r,

  /var/lib/AccountsService/icons/* r,

  /var/lib/flatpak/app/**/gnome-shell/{,**} r,
  /var/lib/flatpak/appstream/**/icons/** r,
  /var/lib/flatpak/exports/share/gnome-shell/{,**} r,

  /var/lib/snapd/desktop/icons/{,**} r,

  owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
  owner @{HOME}/.var/app/**/ r,
  owner @{HOME}/.var/app/**.{png,jpg} r,
  owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} rw,
  owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,

  owner @{user_games_dirs}/**/*.{png,jpg} r,
  owner @{user_music_dirs}/**/*.{png,jpg} r,

  owner @{user_config_dirs}/.goutputstream{,*} rw,
  owner @{user_config_dirs}/ibus/ w,
  owner @{user_config_dirs}/monitors.xml{,~} rwl,
  owner @{user_config_dirs}/pulse/ r,
  owner @{user_config_dirs}/tiling-assistant/{,**} rw,

  owner @{user_share_dirs}/backgrounds/{,**} rw,
  owner @{user_share_dirs}/desktop-directories/{,**} r,
  owner @{user_share_dirs}/gnome-shell/{,**} rw,
  owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
  owner @{user_share_dirs}/gvfs-metadata/{,*} r,
  owner @{user_share_dirs}/icc/{,*} rw,
  owner @{user_share_dirs}/sounds/__custom/index.theme r,

  owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r,
  owner @{user_cache_dirs}/gnome-boxes/*.png r,
  owner @{user_cache_dirs}/gnome-photos/{,**} r,
  owner @{user_cache_dirs}/gnome-screenshot/{,**} rw,
  owner @{user_cache_dirs}/libgweather/{,**} rw,
  owner @{user_cache_dirs}/media-art/{,**} r,
  owner @{user_cache_dirs}/vlc/**/*.jpg r,

  owner @{run}/user/@{uid}/gnome-shell-disable-extensions rw,
  owner @{run}/user/@{uid}/gnome-shell/{,**} rw,
  owner @{run}/user/@{uid}/gvfsd/socket-[0-9A-Za-z]* rw,
  owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw,
  owner @{run}/user/@{uid}/systemd/notify rw,
  owner @{run}/user/@{uid}/wayland-[0-9].lock rwk,

  owner /dev/shm/.org.chromium.Chromium.* rw,
  owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,

  owner /tmp/.X[0-9]-lock rw,
  owner /tmp/[0-9A-Z]*.shell-extension.zip rw,
  owner /tmp/gdkpixbuf-xpm-tmp.[0-9A-Z]* rw,

  @{run}/systemd/users/@{uid} r,
  @{run}/systemd/seats/seat[0-9]* r,
  @{run}/systemd/sessions/  r,
  @{run}/systemd/sessions/* r,
  @{run}/systemd/inhibit/[0-9]*.ref rw,

  @{run}/udev/tags/seat/ r,

  @{run}/udev/data/+input* r,       # for mouse, keyboard, touchpad
  @{run}/udev/data/+platform* r,
  @{run}/udev/data/+dmi:id r,
  @{run}/udev/data/+acpi* r,
  @{run}/udev/data/+pci* r,         # for VGA compatible controller
  @{run}/udev/data/+sound:card* r,  # for sound
  @{run}/udev/data/+usb* r,         # for USB mouse and keyboard
  @{run}/udev/data/+i2c:* r,
  @{run}/udev/data/+hid* r,         # for HID-Compliant Keyboard
  @{run}/udev/data/c10:[0-9]* r,    # for non-serial mice, misc features
  @{run}/udev/data/c13:[0-9]* r,    # for /dev/input/*
  @{run}/udev/data/c189:[0-9]*  r,  # for /dev/bus/usb/**
  @{run}/udev/data/c226:[0-9]* r,   # for /dev/dri/card* 
  @{run}/udev/data/n[0-9]* r,

  @{sys}/**/uevent r,
  @{sys}/bus/ r,
  @{sys}/class/ r,
  @{sys}/class/hwmon/ r,
  @{sys}/class/input/ r,
  @{sys}/class/net/ r,
  @{sys}/class/power_supply/ r,
  @{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
  @{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
  @{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
  @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
  @{sys}/devices/**/power_supply/{,**} r,
  @{sys}/devices/pci[0-9]*/**/boot_vga r,
  @{sys}/devices/pci[0-9]*/**/drm/ r,
  @{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
  @{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
  @{sys}/devices/platform/**/input[0-9]*/{properties,name} r,
  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
  @{sys}/devices/virtual/net/*/statistics/{rx_bytes,tx_bytes} r,

        @{PROC}/ r,
        @{PROC}/@{pid}/attr/current r,
        @{PROC}/@{pid}/cgroup r,
        @{PROC}/@{pid}/net/* r,
        @{PROC}/@{pid}/stat r,
        @{PROC}/@{pid}/task/@{tid}/stat r,
        @{PROC}/@{pids}/cmdline r,
        @{PROC}/1/cgroup r,
        @{PROC}/cmdline r,
        @{PROC}/sys/kernel/osrelease r,
        @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
  owner @{PROC}/@{pid}/comm r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mountinfo r,
  owner @{PROC}/@{pid}/mounts r,
  owner @{PROC}/@{pid}/task/@{pid}/cmdline r,

  /dev/input/event[0-9]* rw,
  /dev/media[0-9]* rw,
  /dev/tty[0-9]* rw,

  include if exists <local/gnome-shell>
}