1 files changed, 31 insertions, 0 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files
new file mode 100644
index 0000000..fa73152
--- /dev/null
+++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files
@@ -0,0 +1,31 @@
+# vim:syntax=apparmor
+
+  abi <abi/4.0>,
+
+  # Allow read to all files user has DAC access to and write access to all
+  # files owned by the user in $HOME.
+  @{HOME}/ r,
+  @{HOME}/** r,
+  owner @{HOME}/** w,
+
+  # Do not allow read and/or write to particularly sensitive/problematic files
+  include <abstractions/private-files>
+  audit deny @{HOME}/.ssh/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
+  audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl,
+  audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl,
+
+  # Comment this out if using gpg plugin/addons
+  audit deny @{HOME}/.gnupg/{,**} mrwkl,
+
+  # Allow read to all files user has DAC access to and write for files the user
+  # owns on removable media and filesystems.
+  /media/** r,
+  /mnt/** r,
+  /srv/** r,
+  /net/** r,
+  owner /media/** w,
+  owner /mnt/** w,
+  owner /srv/** w,
+  owner /net/** w,