<Comment># Sample AppArmor Profile.</Comment><br/>
<Comment># License: Public Domain</Comment><br/>
<Comment># Last change: January 25, 2018</Comment><br/>
<dsNormal></dsNormal><br/>
<Preprocessor>include </Preprocessor><Prep. Lib><tunables/global></Prep. Lib><br/>
<dsNormal></dsNormal><br/>
<Comment># Variable assignment</Comment><br/>
<Variable>@{FOO_LIB}</Variable><Operator 1>=</Operator 1><Path>/usr/lib</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>32</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>64}</Globbing Brackets><Path>/foo</Path><br/>
<Variable>@{USER_DIR}</Variable><Operator 1> = </Operator 1><Variable>@{HOME}</Variable><Path>/Public </Path><Variable>@{HOME}</Variable><Path>/Desktop</Path><br/>
<Variable>@{USER_DIR}</Variable><Operator 1> += </Operator 1><Variable>@{HOME}</Variable><Path>/Hello</Path><br/>
<dsNormal></dsNormal><br/>
<Comment># Profile for /usr/bin/foo</Comment><br/>
<Path>/usr/bin/foo</Path><Normal Text> (</Normal Text><Flags>attach_disconnected</Flags><Normal Text>, </Normal Text><Flags>enforce</Flags><Normal Text>) {</Normal Text><br/>
<Preprocessor>	include </Preprocessor><Prep. Lib><abstractions/base></Prep. Lib><br/>
<Preprocessor>	include </Preprocessor><Prep. Lib><abstractions/dbus></Prep. Lib><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Preprocessor>#include </Preprocessor><Prep. Lib><abstractions/ubuntu-helpers></Prep. Lib><br/>
<Normal Text>	</Normal Text><Preprocessor>#include</Preprocessor><Prep. Lib><abstractions/wayland></Prep. Lib><br/>
<Normal Text>	</Normal Text><Preprocessor>#include</Preprocessor><Prep. Lib>"/etc/apparmor.d/abstractions/ubuntu-konsole"</Prep. Lib><br/>
<Preprocessor>	include </Preprocessor><Prep. Lib>"/etc/apparmor.d/abstractions/openssl"</Prep. Lib><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Path>/</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Char 1>**</Globbing Char 1><Globbing Brackets>/}</Globbing Brackets><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><Comment># Read only directories</Comment><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Path>/</Path><Globbing Brackets>{home</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>media</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>mnt</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>srv</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>net}</Globbing Brackets><Path>/</Path><Globbing Char 1>**</Globbing Char 1><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Variable>@{USER_DIR}</Variable><Path>/</Path><Globbing Char 1>**</Globbing Char 1><Permissions> rw</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Qualifier>audit</Qualifier><Normal Text> </Normal Text><Access Qualifier>deny</Access Qualifier><Normal Text> </Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Path>/</Path><Globbing Char 1>**</Globbing Char 1><Path>/</Path><Globbing Char 1>*</Globbing Char 1><Permissions> mx</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/</Path><Globbing Char 1>**</Globbing Char 1><Path>.</Path><Globbing Brackets>[tT][xX][tT]</Globbing Brackets><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><Normal Text>  </Normal Text><Comment># txt</Comment><br/>
<Normal Text>	</Normal Text><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Rule>file</Rule><Normal Text> </Normal Text><Variable>@{HOME}</Variable><Path>/.local/share/foo/</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Char 1>**</Globbing Char 1><Globbing Brackets>}</Globbing Brackets><Permissions> rwkl</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Variable>@{HOME}</Variable><Path>/.config/foo/</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Char 1>**</Globbing Char 1><Globbing Brackets>}</Globbing Brackets><Normal Text>          </Normal Text><Permissions> rwk</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Variable>@{HOME}</Variable><Path>/.config/</Path><Globbing Char 1>*</Globbing Char 1><Normal Text>                  </Normal Text><Permissions> rw</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Variable>@{HOME}</Variable><Path>/.config/</Path><Globbing Char 1>*</Globbing Char 1><Path>.</Path><Globbing Brackets>[a</Globbing Brackets><Globbing Char 2>-</Globbing Char 2><Globbing Brackets>zA</Globbing Brackets><Globbing Char 2>-</Globbing Char 2><Globbing Brackets>Z0</Globbing Brackets><Globbing Char 2>-</Globbing Char 2><Globbing Brackets>9]</Globbing Brackets><Globbing Char 1>*</Globbing Char 1><Normal Text>     </Normal Text><Permissions> rwk</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Variable>@{HOME}</Variable><Path>/.cache/foo/</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Char 1>**</Globbing Char 1><Globbing Brackets>}</Globbing Brackets><Normal Text>           </Normal Text><Permissions> rwk</Permissions><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Text Quoted>"/usr/share/</Text Quoted><Globbing Char 1>**</Globbing Char 1><Text Quoted>"</Text Quoted><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Text Quoted>"/var/lib/flatpak/exports/share/</Text Quoted><Globbing Char 1>**</Globbing Char 1><Text Quoted>"</Text Quoted><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Text Quoted>"/var/lib/flatpak/app/</Text Quoted><Globbing Char 1>**</Globbing Char 1><Text Quoted>/export/share/applications/</Text Quoted><Globbing Char 1>*</Globbing Char 1><Text Quoted>.desktop"</Text Quoted><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Access Qualifier>allow</Access Qualifier><Normal Text> </Normal Text><Rule>file</Rule><Normal Text> </Normal Text><Path>/etc/nsswitch.conf</Path><Normal Text>          </Normal Text><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Access Qualifier>allow</Access Qualifier><Normal Text> </Normal Text><Path>/etc/fstab</Path><Normal Text>                       </Normal Text><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/etc/udev/udev.conf</Path><Normal Text>                    </Normal Text><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/etc/xdg/</Path><Globbing Char 1>**</Globbing Char 1><Normal Text>                            </Normal Text><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/etc/xdg/Trolltech.conf</Path><Normal Text>                </Normal Text><Permissions> k</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Access Qualifier>deny</Access Qualifier><Normal Text> </Normal Text><Path>/etc/xdg/</Path><Globbing Brackets>{autostart</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>systemd}</Globbing Brackets><Path>/</Path><Globbing Char 1>**</Globbing Char 1><Normal Text>   </Normal Text><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Access Qualifier>deny</Access Qualifier><Normal Text> </Normal Text><Path>/boot/</Path><Globbing Char 1>**</Globbing Char 1><Normal Text>                          </Normal Text><Permissions> rwlkmx</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><br/>
<Normal Text>	</Normal Text><File Qualifier>owner</File Qualifier><Normal Text> </Normal Text><Variable>@{PROC}</Variable><Path>/</Path><Variable>@{pid}</Variable><Path>/</Path><Globbing Brackets>{cmdline</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>mountinfo</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>mounts</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>stat</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>status</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>vmstat}</Globbing Brackets><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/sys/devices/</Path><Globbing Char 1>**</Globbing Char 1><Path>/uevent</Path><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Path>/usr/bin/foo</Path><Normal Text>        </Normal Text><Permissions> ixr</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/usr/bin/dolphin</Path><Normal Text>    </Normal Text><Permissions> PUx</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/usr/bin/</Path><Globbing Char 1>*</Globbing Char 1><Normal Text>          </Normal Text><Permissions> Pixr</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/usr/bin/khelpcenter</Path><Permissions> Cx</Permissions><Normal Text>  </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Transition Profile Name>sanitized_helper</Transition Profile Name><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Path>/usr/bin/helloworld</Path><Normal Text> </Normal Text><Permissions> Cxr</Permissions><Normal Text> </Normal Text><Operator 2>-></Operator 2><br/>
<Normal Text>			</Normal Text><Transition Profile Name>hello_world</Transition Profile Name><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><br/>
<Normal Text>	</Normal Text><Path>/usr/lib</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>32</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>64}</Globbing Brackets><Path>/</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Variable>@{multiarch}</Variable><Globbing Brackets>/}</Globbing Brackets><Path>qt5/plugins/</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Char 1>**</Globbing Char 1><Globbing Brackets>/}</Globbing Brackets><Globbing Char 1>*</Globbing Char 1><Path>.so</Path><Permissions> m</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Variable>@{FOO_LIB}</Variable><Path>/</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Char 1>**</Globbing Char 1><Globbing Brackets>}</Globbing Brackets><Permissions> mr</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><br/>
<Normal Text>	</Normal Text><Qualifier>audit</Qualifier><Normal Text> </Normal Text><Access Qualifier>deny</Access Qualifier><Normal Text> </Normal Text><Path>/dev/</Path><Globbing Brackets>{audio</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>video}</Globbing Brackets><Globbing Char 1>*</Globbing Char 1><Permissions> rwlkmx</Permissions><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Comment># Dbus rules</Comment><br/>
<Normal Text>	</Normal Text><Rule>dbus</Rule><Normal Text> (</Normal Text><Permissions>send</Permissions><Normal Text>)</Normal Text><br/>
<Normal Text>		</Normal Text><Option>bus</Option><Operator 1>=</Operator 1><Other Data>system</Other Data><br/>
<Normal Text>		</Normal Text><Option>path</Option><Operator 1>=</Operator 1><Path>/org/freedesktop/NetworkManager</Path><br/>
<Normal Text>		</Normal Text><Option>interface</Option><Operator 1>=</Operator 1><Path>org.freedesktop.DBus.Introspectable</Path><br/>
<Normal Text>		</Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Other Option>name</Other Option><Operator 1>=</Operator 1><Path>org.freedesktop.NetworkManager</Path><Normal Text> </Normal Text><Other Option>label</Other Option><Operator 1>=</Operator 1><Other Data>unconfined</Other Data><Normal Text>)</Normal Text><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Rule>dbus</Rule><Normal Text> (</Normal Text><Permissions>send</Permissions><Normal Text> </Normal Text><Permissions>receive</Permissions><Normal Text>)</Normal Text><br/>
<Normal Text>		</Normal Text><Option>bus</Option><Operator 1>=</Operator 1><Other Data>system</Other Data><br/>
<Normal Text>		</Normal Text><Option>path</Option><Operator 1>=</Operator 1><Path>/org/freedesktop/NetworkManager</Path><br/>
<Normal Text>		</Normal Text><Option>interface</Option><Operator 1>=</Operator 1><Path>org.freedesktop.NetworkManager</Path><br/>
<Normal Text>		</Normal Text><Option>member</Option><Operator 1>=</Operator 1><Globbing Brackets>{Introspect</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>state}</Globbing Brackets><br/>
<Normal Text>		</Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Other Option>name</Other Option><Operator 1>=</Operator 1><Globbing Brackets>(org.freedesktop.NetworkManager</Globbing Brackets><Globbing Char 2>|</Globbing Char 2><Globbing Brackets>org.freedesktop.DBus)</Globbing Brackets><Normal Text>)</Normal Text><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Rule>dbus</Rule><Normal Text> (</Normal Text><Permissions>send</Permissions><Normal Text>)</Normal Text><br/>
<Normal Text>		</Normal Text><Option>bus</Option><Operator 1>=</Operator 1><Other Data>session</Other Data><br/>
<Normal Text>		</Normal Text><Option>path</Option><Operator 1>=</Operator 1><Path>/org/gnome/GConf/Database/</Path><Globbing Char 1>*</Globbing Char 1><br/>
<Normal Text>		</Normal Text><Option>member</Option><Operator 1>=</Operator 1><Globbing Brackets>{AddMatch</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>AddNotify</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>AllEntries</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>LookupExtended</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>RemoveNotify}</Globbing Brackets><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Rule>dbus</Rule><Normal Text> (</Normal Text><Permissions>bind</Permissions><Normal Text>)</Normal Text><br/>
<Normal Text>		</Normal Text><Option>bus</Option><Operator 1>=</Operator 1><Other Data>system</Other Data><br/>
<Normal Text>		</Normal Text><Option>name</Option><Operator 1>=</Operator 1><Path>org.bluez</Path><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Comment># Signal rules</Comment><br/>
<Normal Text>	</Normal Text><Rule>signal</Rule><Normal Text> (</Normal Text><Permissions>send</Permissions><Normal Text>) </Normal Text><Option>set</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Flags>term</Flags><Normal Text>) </Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Other Data>unconfined</Other Data><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Rule>signal</Rule><Normal Text> (</Normal Text><Permissions>send</Permissions><Normal Text>, </Normal Text><Permissions>receive</Permissions><Normal Text>) </Normal Text><Option>set</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Flags>int</Flags><Normal Text> </Normal Text><Flags>exists</Flags><Normal Text> </Normal Text><Flags>rtmin+8</Flags><Normal Text>) </Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Path>/usr/lib/hello/world</Path><SubProfile Operator>//</SubProfile Operator><SubProfile>foo-helper</SubProfile><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Comment># Child profile</Comment><br/>
<Normal Text>	</Normal Text><Profile Head>profile</Profile Head><Normal Text> </Normal Text><Profile Name>hello_world</Profile Name><Normal Text> {</Normal Text><br/>
<Normal Text>		</Normal Text><Comment># File rules (three different ways)</Comment><br/>
<Normal Text>		</Normal Text><Rule>file</Rule><Normal Text> </Normal Text><Path>/usr/lib</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>32</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>64}</Globbing Brackets><Path>/helloworld/</Path><Globbing Char 1>**</Globbing Char 1><Path>.so</Path><Permissions> mr</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Path>/usr/lib</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>32</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>64}</Globbing Brackets><Path>/helloworld/</Path><Globbing Char 1>**</Globbing Char 1><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	</Normal Text><Permissions>	rk</Permissions><Normal Text> </Normal Text><Path>/usr/lib</Path><Globbing Brackets>{</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>32</Globbing Brackets><Globbing Char 2>,</Globbing Char 2><Globbing Brackets>64}</Globbing Brackets><Path>/helloworld/hello,file</Path><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Link rules (two ways)</Comment><br/>
<Normal Text>	</Normal Text><Permissions>	l</Permissions><Normal Text> </Normal Text><Path>/foo1</Path><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Path>/bar</Path><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>link</Rule><Normal Text> </Normal Text><Path>/foo2</Path><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> bar</Normal Text><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>link</Rule><Normal Text> </Normal Text><Path>/foo3</Path><Operator 2> to</Operator 2><Normal Text> bar</Normal Text><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>link</Rule><Normal Text> </Normal Text><Data>subset</Data><Normal Text> </Normal Text><Path>/link</Path><Globbing Char 1>*</Globbing Char 1><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Path>/</Path><Globbing Char 1>**</Globbing Char 1><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Network rules</Comment><br/>
<Normal Text>		</Normal Text><Rule>network</Rule><Normal Text> </Normal Text><Data>inet6</Data><Normal Text> </Normal Text><Data>tcp</Data><End of Rule Char>,</End of Rule Char><Normal Text> </Normal Text><Comment>#Allow access to tcp only for inet6 addresses</Comment><br/>
<Normal Text>		</Normal Text><Rule>network</Rule><Normal Text> </Normal Text><Data>netlink</Data><Normal Text> </Normal Text><Data>dgram</Data><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>network</Rule><Normal Text> </Normal Text><Data>bluetooth</Data><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>network</Rule><Normal Text> </Normal Text><Other Data>unspec</Other Data><Normal Text> </Normal Text><Data>dgram</Data><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Capability rules</Comment><br/>
<Normal Text>		</Normal Text><Rule>capability</Rule><Normal Text> </Normal Text><Data>dac_override</Data><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>capability</Rule><Normal Text> </Normal Text><Data>sys_admin</Data><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>capability</Rule><Normal Text> </Normal Text><Data>sys_chroot</Data><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Mount rules</Comment><br/>
<Normal Text>		</Normal Text><Rule>mount</Rule><Normal Text> </Normal Text><Option>options</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Permissions>rw</Permissions><Normal Text> </Normal Text><Permissions>bind</Permissions><Normal Text> </Normal Text><Permissions>remount</Permissions><Normal Text> </Normal Text><Permissions>nodev</Permissions><Normal Text> </Normal Text><Permissions>noexec</Permissions><Normal Text>) </Normal Text><Option>vfstype</Option><Operator 1>=</Operator 1><Flags>ecryptfs</Flags><Normal Text> </Normal Text><Path>/home/</Path><Globbing Char 1>*</Globbing Char 1><Path>/.helloworld/</Path><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Path>/home/</Path><Globbing Char 1>*</Globbing Char 1><Path>/helloworld/</Path><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>mount</Rule><Normal Text> </Normal Text><Option>options</Option><Operator 2> in</Operator 2><Normal Text> (</Normal Text><Permissions>rw</Permissions><Normal Text>, </Normal Text><Permissions>bind</Permissions><Normal Text>) </Normal Text><Path>/</Path><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Path>/run/hellowordd/</Path><Globbing Char 1>*</Globbing Char 1><Path>.mnt</Path><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>mount</Rule><Normal Text> </Normal Text><Option>option</Option><Operator 1>=</Operator 1><Permissions>read-only</Permissions><Normal Text> </Normal Text><Option>fstype</Option><Operator 1>=</Operator 1><Flags>btrfs</Flags><Normal Text> </Normal Text><Path>/dev/sd</Path><Globbing Brackets>[a</Globbing Brackets><Globbing Char 2>-</Globbing Char 2><Globbing Brackets>z][1</Globbing Brackets><Globbing Char 2>-</Globbing Char 2><Globbing Brackets>9]</Globbing Brackets><Globbing Char 1>*</Globbing Char 1><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Path>/media/</Path><Globbing Char 1>*</Globbing Char 1><Path>/</Path><Globbing Char 1>*</Globbing Char 1><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>umount</Rule><Normal Text> </Normal Text><Path>/home/</Path><Globbing Char 1>*</Globbing Char 1><Path>/helloworld/</Path><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Pivot Root rules</Comment><br/>
<Normal Text>		</Normal Text><Rule>pivot_root</Rule><Normal Text> </Normal Text><Option>oldroot</Option><Operator 1>=</Operator 1><Path>/mnt/root/old/</Path><Normal Text> </Normal Text><Path>/mnt/root/</Path><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>pivot_root</Rule><Normal Text> </Normal Text><Path>/mnt/root/</Path><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Ptrace rules</Comment><br/>
<Normal Text>		</Normal Text><Rule>ptrace</Rule><Normal Text> (</Normal Text><Permissions>trace</Permissions><Normal Text>) </Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Other Data>unconfined</Other Data><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>ptrace</Rule><Normal Text> (</Normal Text><Permissions>read</Permissions><Normal Text>, </Normal Text><Permissions>trace</Permissions><Normal Text>, </Normal Text><Permissions>tracedby</Permissions><Normal Text>) </Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Path>/usr/lib/hello/helloword</Path><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Unix rules</Comment><br/>
<Normal Text>		</Normal Text><Rule>unix</Rule><Normal Text> (</Normal Text><Permissions>connect</Permissions><Normal Text> </Normal Text><Permissions>receive</Permissions><Normal Text> </Normal Text><Permissions>send</Permissions><Normal Text>) </Normal Text><Option>type</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Data>stream</Data><Normal Text>) </Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Other Option>label</Other Option><Operator 1>=</Operator 1><Other Data>unconfined</Other Data><Normal Text> </Normal Text><Other Option>addr</Other Option><Operator 1>=</Operator 1><Path>@/tmp/ibus/dbus-</Path><Globbing Char 1>*</Globbing Char 1><Normal Text>)</Normal Text><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>unix</Rule><Normal Text> (</Normal Text><Permissions>send</Permissions><Normal Text>,</Normal Text><Permissions>receive</Permissions><Normal Text>) </Normal Text><Option>type</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Data>stream</Data><Normal Text>) </Normal Text><Option>protocol</Option><Operator 1>=</Operator 1><Normal Text>0 </Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Other Option>addr</Other Option><Operator 1>=</Operator 1><Other Data>none</Other Data><Normal Text>)</Normal Text><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>unix</Rule><Normal Text> </Normal Text><Option>peer</Option><Operator 1>=</Operator 1><Normal Text>(</Normal Text><Other Option>label</Other Option><Operator 1>=</Operator 1><Variable>@{profile_name}</Variable><Normal Text>,</Normal Text><Other Option>addr</Other Option><Operator 1>=</Operator 1><Path>@helloworld</Path><Normal Text>)</Normal Text><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Rlimit rule</Comment><br/>
<Normal Text>		</Normal Text><Rule>set</Rule><Normal Text> </Normal Text><Rule>rlimit</Rule><Normal Text> </Normal Text><Data>data</Data><Normal Text>  </Normal Text><Operator 2><=</Operator 2><Normal Text> </Normal Text><Number>100</Number><Flags>M</Flags><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>set</Rule><Normal Text> </Normal Text><Rule>rlimit</Rule><Normal Text> </Normal Text><Data>nproc</Data><Normal Text> </Normal Text><Operator 2><=</Operator 2><Normal Text> </Normal Text><Number>10</Number><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>set</Rule><Normal Text> </Normal Text><Rule>rlimit</Rule><Normal Text> </Normal Text><Data>memlock</Data><Normal Text> </Normal Text><Operator 2><=</Operator 2><Normal Text> </Normal Text><Number>2</Number><Flags>GB</Flags><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>set</Rule><Normal Text> </Normal Text><Rule>rlimit</Rule><Normal Text> </Normal Text><Data>rss</Data><Normal Text> </Normal Text><Operator 2><=</Operator 2><Normal Text> </Normal Text><Other Data>infinity</Other Data><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Change Profile rules</Comment><br/>
<Normal Text>		</Normal Text><Rule>change_profile</Rule><Normal Text> </Normal Text><Data>unsafe</Data><Normal Text> </Normal Text><Path>/</Path><Globbing Char 1>**</Globbing Char 1><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Transition Profile Name>[^u/]</Transition Profile Name><Globbing Char 3>**</Globbing Char 3><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>change_profile</Rule><Normal Text> </Normal Text><Data>unsafe</Data><Normal Text> </Normal Text><Path>/</Path><Globbing Char 1>**</Globbing Char 1><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Transition Profile Name>{u,un,unc,unco,uncon,unconf,unconfi,unconfin,unconfine}</Transition Profile Name><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>change_profile</Rule><Normal Text> </Normal Text><Path>/bin/bash</Path><Normal Text>  </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><br/>
<Normal Text>			</Normal Text><Transition Profile Name>new_profile</Transition Profile Name><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Alias</Comment><br/>
<Normal Text>		</Normal Text><Rule>alias</Rule><Normal Text> </Normal Text><Path>/usr/</Path><Normal Text> </Normal Text><Operator 2>-></Operator 2><Normal Text> </Normal Text><Path>/mnt/usr/</Path><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>	}</Normal Text><br/>
<dsNormal></dsNormal><br/>
<Normal Text>	</Normal Text><Comment># Hat</Comment><br/>
<Profile Head>	^</Profile Head><Profile Name>foo-helper</Profile Name><Normal Text> {</Normal Text><br/>
<Normal Text>		</Normal Text><Rule>network</Rule><Normal Text> </Normal Text><Data>unix</Data><Normal Text> </Normal Text><Data>stream</Data><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Rule>unix</Rule><Normal Text> </Normal Text><Data>stream</Data><End of Rule Char>,</End of Rule Char><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Path>/usr/hi</Path><Escape Expression>\"</Escape Expression><Path>esc</Path><Escape Expression>\x23</Escape Expression><Path>esc</Path><Escape Expression>\032</Escape Expression><Path>esc</Path><Escape Expression>\*</Escape Expression><Path>es</Path><Escape Expression>\{</Escape Expression><Path>esc</Path><Escape Expression>\ </Escape Expression><Path>rw</Path><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><Normal Text> </Normal Text><Comment># Escape expressions</Comment><br/>
<dsNormal></dsNormal><br/>
<Normal Text>		</Normal Text><Comment># Text after a variable is highlighted as path</Comment><br/>
<Normal Text>		</Normal Text><Rule>file</Rule><Normal Text> </Normal Text><Path>/my/path</Path><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Variable>@{FOO_LIB}</Variable><Path>file</Path><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><br/>
<Normal Text>		</Normal Text><Variable>@{FOO_LIB}</Variable><Path>#my/path</Path><Permissions> r</Permissions><End of Rule Char>,</End of Rule Char><Normal Text> </Normal Text><Comment>#Comment</Comment><br/>
<Normal Text>	}</Normal Text><br/>
<Normal Text>}</Normal Text><br/>
