usr.bin.gpg

/usr/bin/gpg {

#include <abstractions/gconv-i386>

capability mknod,

unix create type=stream addr=none,

signal (receive, send) set=(int) peer=/usr/bin/gpg,
signal (receive, send) set=(int) peer=unconfined,

/etc/ld.so.cache r,

/dev/tty rw,
/dev/{,u}random r,

/usr/lib/locale/{,**} r,

/usr/share/locale/locale.alias r,
/etc/locale.alias r,

/etc/inputrc r,
/etc/localtime r,
/lib/terminfo/x/xterm r,

owner /tmp/gpg-*/S.gpg-agent rw,

owner /home/*/.gnupg/gpg.conf r,
owner /home/*/.gnupg/pubring.gpg{,.{lock,tmp},~} rwkl,
owner /home/*/.gnupg/random_seed rw,
owner /home/*/.gnupg/secring.gpg{,.{lock,tmp}} rwkl,
owner /home/*/.gnupg/trustdb.gpg{,.lock} rwkl,
owner /home/*/.gnupg/.#* rwkl,

profile /usr/lib/gnupg/gpgkeys_hkp {

 unix create type=stream addr=none,

 network inet dgram,
 network inet stream,

 /usr/lib/gnupg/gpgkeys_hkp r,

 /etc/ld.so.cache r,

 /etc/host.conf r,
 /etc/hosts r,
 /etc/nsswitch.conf r,
 /etc/resolv.conf r,

 /lib/i386-linux-gnu/libnss_{dns,files}*.so{,.?} rm,

 /lib/i386-linux-gnu/ld-linux.so.? r,
 /lib/i386-linux-gnu/ld-*.so rm,

 /lib/i386-linux-gnu/libc*.so{,.?} rm,
 /lib/i386-linux-gnu/libresolv*.so{,.?} rm,

}

/usr/lib/gnupg/ r,
/usr/lib/gnupg/gpgkeys_finger rix,
/usr/lib/gnupg/gpgkeys_hkp Cx,
/usr/lib/gnupg/gpgkeys_ldap rix,
/usr/lib/gnupg/gpgkeys_mailto rix,

/lib/i386-linux-gnu/libresolv*.so{,.?} rm,

/lib/i386-linux-gnu/libz.so.?{,.*} rm,

/lib/i386-linux-gnu/libbz2.so.* rm,

/lib/i386-linux-gnu/libreadline.so.?{,.*} rm,

/lib/i386-linux-gnu/libdl*.so{,.?} rm,

/lib/i386-linux-gnu/libusb*.so.* rm,

/lib/i386-linux-gnu/libc*.so{,.?} rm,

/lib/i386-linux-gnu/libtinfo.so.* rm,

}