Opera 11.10 AppArmor profile

#Opera 11.10 AppArmor profile by Ryan Farmer
#include <tunables/global>

/usr/bin/opera {
  #include <abstractions/audio>
  #include <abstractions/cups-client>
  #include <abstractions/dbus-session>
  #include <abstractions/nameservice>
  #include <abstractions/kde>
  #include <abstractions/freedesktop.org>

  #Allow networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,

  #For printing
  /etc/cups/** rk,

  #Capabilities
  capability ipc_lock,
  capability sys_ptrace,

  #Enable user to do normal stuff with home folder, allow file locking in Pictures to enable Speed Dial background.
  owner @{HOME}/Downloads/** ixrwk,
  owner @{HOME}/Pictures/** rwk,
  owner @{HOME}/Documents/** rw,
  owner @{HOME}/Music/** rw,

  #Stuff that Opera executes in normal operation.
  /usr/lib/gstreamer*/gstreamer*/gst-plugin-scanner ix,
  /usr/bin/kde4-config ix,
  /usr/lib/opera/opera* ix,
  /bin/dash ix,
  /bin/grep ix,
  /bin/uname ix,
  /bin/ps ix,
  /bin/sed ix,
  /usr/bin/file ix,

  #Stuff that needs to be read.
  /dev/tty r,
  /etc/fstab r,
  /etc/magic r,
  /etc/mtab r,
  /etc/udev/udev.conf r,
  /proc/*/cmdline r,
  /proc/*/stat r,
  /proc/*/status r,
  /proc/version r,
  /proc/modules r,
  /proc/uptime r,
  /proc/tty/drivers r,
  /proc/sys/kernel/pid_max r,

  #Stuff that needs to be mmapped
  /lib/*-linux-gnu/** m,
  /usr/lib** m,
  /tmp/** m,

  #We obviously need to let the Opera binary manipulate itself and read/write its own profile and read/file lock some global settings.
  /etc/mailcap rk,
  /etc/X11/cursors/** rk,
  /etc/xdg/Trolltech.conf rk,
  owner @{HOME}/.config/oxygen-gtk/* rw,
  owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rwlk,
  owner @{HOME}/.gstreamer-0.10/registry.* rwlk,
  owner @{HOME}/.gtk-bookmarks r,
  owner @{HOME}/.opera** rwlk,
  owner @{HOME}/.kde/share/config/** rwk,
  owner @{HOME}/.kde/share/apps/** rwlk,
  owner @{HOME}/.config/ibus/bus/ w,
  /usr/bin/opera ixrmk,
  /usr/share/** rk,
  /etc/gnome/defaults.list rk,
  /usr/local/share/applications/mimeinfo.cache rk,
  owner @{HOME}/.local/share/applications/mimeinfo.cache rk,
  owner @{HOME}/.config/user-dirs.dirs rk,

  #Adobe Trash likes to write to the video card for GPU accel and Opera will eventually anyway. Vomit a little in my mouth.
  /dev/ati/** rw,
  /dev/nvidia/** rw,
  /proc/*/major r,

  #Make webcam work in Adobe Trash and give Trash access to its settings folder. Vomit a little more in my mouth.
  /dev/v4l/** r,
  owner @{HOME}/.macromedia/** rw,
  owner @{HOME}/.adobe/** rw,

  #So importing Firefox profiles works
  owner @{HOME}/.{firefox,mozilla}/** r,

  #File Helpers
  /usr/bin/kfmclient rix,
  /usr/bin/kde-open rix,
  /usr/bin/xdg-open rix,
  /usr/bin/kioclient rix,

  #Document Viewers
  /usr/bin/okular rix,
  /usr/bin/kate rix,
  /usr/bin/kwrite rix,

  #So instant messenger protocol helpers work.
  /usr/bin/kopete rix,
  /usr/bin/pidgin rix,

  #Package installers for Debian/Ubuntu KDE and GTK

  /usr/bin/gdebi* rix,

  #This should support most bittorrent clients
  /usr/bin/deluge rix,
  /usr/bin/transmission* rix,
  /usr/bin/*torrent rix,

  #So browsing directories works without crashing the file viewer.
  / r,
  /**/ r,

}