AppArmor config for Skype

# HOWTO:
# $ sudo aa-genprof /usr/bin/skype
# $ sudo service apparmor restart
# $ sudo aa-enforce skype
# then monitor syslog and add more, if required

# INFO: man 5 apparmor.d
# Access modes:
# r - read
# w - write
# m -- allow PROT_EXEC with mmap()
# l -- link
# k -- lock
# *x -- different ways to execute. Best: ix

#include <tunables/global>

/usr/bin/skype {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/fonts>
  /etc/pulse/client.conf r,
  /etc/xdg/Trolltech.conf rk,
  owner @{HOME}/Downloads/ rwk,
  owner @{HOME}/Downloads/** rwk,
  owner @{HOME}/.Skype/ rwk,
  owner @{HOME}/.Skype/** rwk,
  owner @{HOME}/.Xauthority r,
  owner @{HOME}/.config/Skype/Skype.conf rwk,
  owner @{HOME}/.config/Trolltech.conf rk,
  /proc/sys/kernel/osrelease r,
  /proc/sys/kernel/ostype r,
  /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq r,
  /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq r,
  /usr/bin/skype mr,
  /usr/bin/firefox mixr,
  /usr/bin/xdg-open ixr,
  /usr/lib/firefox/firefox.sh ixr,
  /usr/bin/x-www-browser mixr,
  /usr/share/icons/hicolor/index.theme rk,
  /usr/share/javascript/mathjax/fonts/** r,
  /usr/share/skype/** r,
  /var/cache/fontconfig/** rwk,
}