#include <tunables/global>

/usr/bin/minecraft-server {
  #include <abstractions/base>
  #include <abstractions/ssl_certs>
  #include <abstractions/openssl>
  #include <abstractions/python>
  #include <abstractions/nameservice>

  /usr/bin/minecraft-server r,

  deny /usr/bin/ r,
  deny /vat/tmp/ r,

  /usr/bin/make ix,
  /usr/bin/dirname ix,
  /usr/bin/wget ix,
  /bin/mkdir ix,
  /bin/touch ix,
  /bin/grep ix,
  /bin/rm ix,
  /usr/bin/python3 ix,
  /usr/bin/python3.* ix,
  /bin/dash ix,
  /usr/lib/jvm/java-*-*/jre/bin/java Cx,

  /etc/wgetrc r,
  owner @{HOME}/.netrc r,

  deny @{PROC}/@{pid}/sys/devices/system/cpu/ r,
  deny /sys/devices/system/cpu/ r,

  network inet stream,
  network inet dgram,
  network inet6 dgram,
  network inet6 stream,

  deny /usr/lib/python*/dist-packages/apport_python_hook.py r,
  deny /usr/lib/python*/dist-packages/apport* r,
  deny /etc/apparmor.d/ r,

  deny @{HOME}/.wget-hsts r,

  deny /usr/bin/id x,
  deny /etc/passwd r,
  /etc/hosts r,
  /etc/timezone r,

  deny @{HOME} r,
  owner @{HOME}/servers/revelations/ rw,
  owner @{HOME}/servers/revelations/server.jar rw,
  owner @{HOME}/servers/revelations/ServerStart.sh rwix,
  owner @{HOME}/servers/revelations/settings.sh rwix,
  owner @{HOME}/servers/revelations/settings-local.sh rwix,
  owner @{HOME}/servers/revelations/FTBInstall.sh rwix,
  owner @{HOME}/servers/revelations/libraries/net/minecraft/launchwrapper/1.12/launchwrapper-1.12.jar rwix,
  owner @{HOME}/servers/revelations/minecraft_server.1.12.2.jar rwix,
  owner @{HOME}/servers/revelations/FTBserver-1.12.2-14.23.4.2759-universal.jar rwix,
  owner @{HOME}/servers/revelations/eula.txt rw,

  profile /usr/lib/jvm/java-*-*/jre/bin/java flags=(complain) {
    #include <abstractions/ssl_certs>
    #include <abstractions/nameservice>

    /usr/bin/id ix,

    network inet stream,
    network inet dgram,
    network inet6 dgram,
    network inet6 stream,
    network netlink raw,
    network unix stream,

    signal (receive) peer=unconfined,
    signal (receive) peer=/usr/bin/minecraft-server,
    signal (send, receive) peer=@{profile_name},
    signal (receive) set=("exists"),

    /proc/meminfo r,
    /proc/cpuinfo r,
    /proc/filesystems r,
    /proc/stat r,
    /proc/@{pid}/maps r,
    /proc/@{pid}/mounts r,
    /sys/devices/system/cpu/online r,
    /sys/devices/system/cpu/ r,

    /dev/random r,
    /dev/urandom r,

    /lib/@{multiarch}/libselinux.so.* r,
    /lib/@{multiarch}/libpcre.so.* r,
    /lib/@{multiarch}/libnsl-*.so r,

    /usr/lib/jvm/java-*-*/jre/bin/java r,

    /etc/ssl/certs/java/cacerts r,
    /etc/java-*-*/jvm-*.cfg r,
    /etc/java-*-*/security/* r,
    /etc/java-*-*/*.properties r,
    /etc/ld.so.cache r,
    /etc/localtime r,
    /etc/timezone r,
    /etc/locale.alias r,
    /usr/lib/locale/locale-archive r,
    /usr/share/javazi/* r,
    /usr/share/zoneinfo/posixrules r,

    owner @{HOME}/servers/revelations/server.jar r,
    /usr/share/java/jayatana.jar r,
    /usr/share/java/jayatanaag.jar r,
    /usr/lib/jayatana/lib*.so r,
    /usr/share/java/java-atk-wrapper.jar r,
    /usr/lib/jvm/java-*-*/jre/lib/meta-index r,
    /usr/lib/jvm/java-*-*/jre/lib/*.jar r,
    /usr/lib/jvm/java-*-*/jre/lib/ext/ r,
    /usr/lib/jvm/java-*-*/jre/lib/ext/*.jar r,
    /usr/lib/jvm/java-*-*/jre/lib/tzdb.dat r,
    /usr/lib/jvm/java-*-*/jre/lib/currency.data r,
    /usr/lib/jvm/java-*-*/jre/lib/security/*.jar r,

    /lib/@{multiarch}/ld-*.so r,
    /lib/@{multiarch}/libc-*.so r,
    /lib/@{multiarch}/libz.so* r,
    /lib/@{multiarch}/libdl-*.so r,
    /lib/@{multiarch}/libm-*.so r,
    /lib/@{multiarch}/librt-*.so r,
    /lib/@{multiarch}/libpthread-*.so r,

    /lib/@{multiarch}/libgcc_s.so.* r,
    /lib/@{multiarch}/libnsl-2.21.so r,
    /lib/@{multiarch}/libnss_files-*.so r,
    /lib/@{multiarch}/libnss_compat-*.so r,
    /lib/@{multiarch}/libnss_nis-*.so r,
    /lib/@{multiarch}/libnss_mdns*_minimal.so.* r,
    /lib/@{multiarch}/libnss_dns-*.so r,
    /lib/@{multiarch}/libresolv-*.so r,
    /lib/@{multiarch}/libglib-2.0.so.* r,
    /usr/lib/@{multiarch}/libnss3.so r,
    /usr/lib/@{multiarch}/libnssutil3.so r,
    /usr/lib/@{multiarch}/libffi.so.* r,
    /usr/lib/@{multiarch}/libXi.so.* r,
    /usr/lib/@{multiarch}/libX11.so.* r,
    /usr/lib/@{multiarch}/libXau.so.* r,
    /usr/lib/@{multiarch}/libXdmcp.so.* r,
    /usr/lib/@{multiarch}/libxcb.so.* r,
    /usr/lib/@{multiarch}/libstdc++.so.* r,
    /usr/lib/@{multiarch}/libXext.so.* r,
    /usr/lib/@{multiarch}/libXrender.so.* r,
    /usr/lib/@{multiarch}/libXtst.so.* r,
    /usr/lib/@{multiarch}/libgio-2.0.so.* r,
    /usr/lib/@{multiarch}/libgobject-2.0.so.* r,
    /usr/lib/@{multiarch}/libgmodule-2.0.so.* r,
    /usr/lib/@{multiarch}/libplc4.so r,
    /usr/lib/@{multiarch}/libplds4.so r,
    /usr/lib/@{multiarch}/libnspr4.so r,
    /usr/lib/@{multiarch}/libsqlite3.so.* r,
    /usr/lib/@{multiarch}/nss/lib*.so r,
    /usr/lib/@{multiarch}/jni/libatk-wrapper.so.* r,
    /usr/lib/jvm/java-*-*/jre/lib/@{multiarch}/server/libjvm.so r,
    /usr/lib/jvm/java-*-*/jre/lib/@{multiarch}/lib*.so r,
    /usr/lib/jvm/java-*-*/jre/lib/@{multiarch}/jli/lib*.so r,

    @{HOME}/servers/revelations/ rw,
    owner @{HOME}/servers/revelations/eula.txt rw,
    owner @{HOME}/servers/revelations/server.properties rw,
    owner @{HOME}/servers/revelations/*.json rw,
    owner @{HOME}/servers/revelations/logs/ w,
    owner @{HOME}/servers/revelations/logs/*.log* rw,

    owner @{HOME}/servers/revelations/*/** ix,
    owner @{HOME}/servers/revelations/*/** ix,
    owner @{HOME}/servers/revelations/*/** m,

    @{PROC}/@{pid}/net/ipv6_route r,
    @{PROC}/@{pid}/net/if_inet6 r,
    @{PROC}/@{pid}/fd/ r,
    @{PROC}/sys/net/core/somaxconn r,

    owner /tmp/libnetty-transport-native-epoll*.so rw,
    deny /tmp/hsperfdata_*/ rw,
    deny /tmp/hsperfdata_*/* rw,
  }
}