# Bodhi.Zazen's icecat profile
# Please note this for :
# Icecat 3.6 installed from the GNUzilla ppa
# https://launchpad.net/~gnuzilla-team/+archive/ppa
# Ubuntu 9.10

#include <tunables/global>

/usr/lib/icecat/icecat {
  #include <abstractions/base>
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/consoles>
  #include <abstractions/dbus>
  #include <abstractions/fonts>
  #include <abstractions/gnome>
  #include <abstractions/nameservice>

  deny @{HOME}/.Private/ r,
  deny @{HOME}/.bash* rw,
  deny @{HOME}/.ssh/* rw,
  deny @{HOME}/.zshrc rw,
  deny @{HOME}/Private/ r,
  deny @{PROC}/ r,
  deny @{PROC}/* r,

  /bin/dash rix,
  /bin/grep rix,
  /bin/ls rix,
  /bin/ps rix,
  /bin/pwd rix,
  /bin/readlink rix,
  /bin/sed rix,
  /bin/true rix,
  /bin/uname rix,
  /bin/which rix,
  /dev/shm/ r,
  /dev/shm/* rw,
  /etc/ r,
  /etc/firefox*/** r,
  /etc/gnome/defaults.list r,
  /etc/gre.d/ r,
  /etc/gre.d/* r,
  /etc/mailcap r,
  /etc/mime.types r,
  /etc/mplayer/* r,
  /etc/openoffice/* r,
  /etc/pulse/* r,
  /etc/sound/events/* r,
  /etc/wildmidi/* r,
  /etc/xdg/xubuntu/*/ r,
  /etc/xdg/xubuntu/applications/defaults.list r,
  /etc/xulrunner-1.9.1/system-greprefs.js r,
  /tmp/** mrwlk,
  /usr/bin/basename rix,
  /usr/bin/dirname rix,
  /usr/bin/evince rix,
  /usr/bin/expr rix,
  /usr/bin/gnome-app-install rix,
  /usr/bin/gnome-mplayer rix,
  /usr/bin/icecat rix,
  /usr/bin/launchpad-integration rix,
  /usr/bin/lpr rix,
  /usr/bin/mplayer rix,
  /usr/bin/nautilus rix,
  /usr/bin/ooffice rix,
  /usr/bin/setarch rix,
  /usr/bin/stat rix,
  /usr/lib/ r,
  /usr/lib/** mr,
  /usr/lib/icecat/icecat rix,
  /usr/lib/icecat/icecat-bin rix,
  /usr/lib/icecat/run-icecat.sh rix,
  /usr/lib/icecat/components/** rw,
  /usr/lib/nspluginwrapper/i386/linux/npviewer rix,
  /usr/lib/nspluginwrapper/i386/linux/npviewer.bin rix,
  /usr/lib/openoffice/** rkix,
  /usr/lib/realplay-10.0.9/realplay rix,
  /usr/lib/realplay-10.0.9/realplay.bin rix,
  /usr/lib/totem/gstreamer/totem-plugin-viewer rix,
  /usr/lib32/** mr,
  /usr/local/share/** r,
  /usr/share/** mr,
  /var/lib/flashplugin-installer/* mr,
  /var/lib/flashplugin-nonfree/* mr,
  owner @{HOME}/ r,
  owner @{HOME}/.adobe/** rw,
  owner @{HOME}/.config/** rw,
  owner @{HOME}/.fontconfig/* mr,
  owner @{HOME}/.icons/ r,
  owner @{HOME}/.icons/** r,
  owner @{HOME}/.local/share/** r,
  owner @{HOME}/.macromedia/** rw,
  owner @{HOME}/.mailcap rw,
  owner @{HOME}/.mozilla/** rwk,
  owner @{HOME}/.gnome2/** rw,
  owner @{HOME}/.gnuzilla/ rw,
  owner @{HOME}/.gnuzilla/** rwk,
  owner @{HOME}/.gnuzilla/icecat/*/extensions/moonlight@novell.com/plugins/libmoonloader.so mrwk,
  owner @{HOME}/.gnuzilla/icecat/*/extensions/moonlight@novell.com/plugins/moonlight/* mrwk,
  owner @{HOME}/.gnuzilla/plugins/moonlight/silverlight-media-pack-linux-x64-5-*.so mrwk,
  owner @{HOME}/.openoffice.org2/** rwk,
  owner @{HOME}/.pulse-cookie rwk,
  owner @{HOME}/.realplayerrc rw,
  owner @{HOME}/.recently-used** rwk,
  owner @{HOME}/.thumbnails/ r,
  owner @{HOME}/.thumbnails/** r,
  owner @{HOME}/{Desktop,Documents,Downloads}/ rw,
  owner @{HOME}/{Desktop,Documents,Downloads}/** rw,
  @{PROC}/*/fd/ r,
  @{PROC}/*/maps r,
  @{PROC}/*/mounts r,

}