# Last Modified: Sun Nov  9 08:31:12 2025
include <tunables/global>

## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Code duplication. Entire file is almost identical to
## helper-scripts  /etc/apparmor.d/usr.libexec.helper-scripts.find_wl_compositor

/usr/libexec/kloak/find_wl_compositor flags=(attach_disconnected.path=/disconnected) {
  include <local/usr.libexec.kloak.find_wl_compositor>

  network unix stream,

  capability sys_tty_config,
  capability sys_ptrace,
  capability dac_read_search,
  capability dac_override,

  ptrace read,
  signal receive,

  /etc/ld.so.cache r,
  /etc/ld.so.preload r,
  /etc/python3.13/sitecustomize.py r,
  /usr/bin/python3 mr,
  /usr/lib/python3.13/sitecustomize.py r,
  /usr/libexec/kloak/find_wl_compositor r,
  /{,usr/}lib{,32,64}/** mr,
  /usr/bin/fgconsole rix,

  @{PROC}/sys/vm/overcommit_memory r,
  /usr/share/zoneinfo/** r,
  /usr{,/local}/lib/python*/dist-packages/ r,
  /usr{,/local}/lib/python*/dist-packages/** r,
  /usr/libexec/kloak/ r,

  /etc/locale.alias r,
  /dev/pts/* rw,
  /dev/tty* rw,
  /dev/console rw,
  /dev/zero rw,
  /dev/null rw,
  /disconnected/dev/zero rw,
  /disconnected/dev/null rw,

  @{PROC}/ r,
  @{PROC}/*/stat r,
  @{PROC}/*/comm r,
  @{PROC}/*/environ r,

  /run/user/*/ r,
  /run/user/*/wayland-* r,
  /run/kloak_wl_compositor_data rw,

  /usr/lib/python*/dist-packages/query_sock_pid/__pycache__/ rw,
  /usr/lib/python*/dist-packages/query_sock_pid/__pycache__/** rw,

  deny /etc/nsswitch.conf r,
  deny /etc/passwd r,
}
