# Last Modified: Wed Sep 25 04:21:21 2024
include <tunables/global>

## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

/usr/bin/kloak {
  include <local/usr.bin.kloak>

  network unix stream,
  network netlink raw,

  signal receive set=cont peer=unconfined,
  signal receive set=exists peer=unconfined,
  signal receive set=kill peer=unconfined,
  signal receive set=term peer=unconfined,

  capability dac_override,
  deny capability dac_read_search,

  /etc/ld.so.cache r,
  /etc/ld.so.preload r,
  /usr/bin/kloak mr,
  /{,usr/}lib{,32,64}/** mr,
  /dev/input/ r,
  /dev/input/event* rw,
  /dev/console r,
  /dev/urandom r,
  /dev/shm/* mrw,
  /dev/zero rw,
  /dev/null rw,
  /sys/devices/**/uevent r,
  /run/udev/data/* r,
  /run/user/*/ r,
  /run/user/*/wayland-* r,

  /proc/* r,
  /proc/** r,

  /usr/share/libinput/ r,
  /usr/share/libinput/* r,
}
