# Last Modified: Wed Jun  3 14:45:18 2015
#include <tunables/global>
#include <tunables/sys>



/usr/share/hplip/plugin.py {
  #include <abstractions/bash>
  #include <abstractions/hplip>

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability fsetid,
  capability ipc_lock,
  capability sys_nice,
  capability setuid,
  capability setgid,
  capability sys_resource,
  capability audit_write,
  capability net_admin,
   /{,usr/}bin/gpg rUx,
   /{,usr/}bin/gpg2 rUx,
  /{,usr/}bin/chmod rix,
  /{,usr/}bin/xauth rix,
  /{,usr/}bin/bash rix,
  /run/utmp rwk,
  /{,usr/}bin/true rix,
  /bin/dash rix,
  /bin/dd rix,
  /bin/df rix,
  /bin/gzip rix,
  /{,usr/}bin/mkdir rix,
  /bin/ping rix,
  /{,usr/}bin/tar rix,
  /{,usr/}bin/dpkg-query ix,
  /bin/uname rix,
  /{,usr/}bin/which rix,
  /run/sudo/ts/** k,
  / r,
  /etc/ r,
  /etc/udev/rules.d/** w,
  /usr/lib{,32,64}/sane/hpgt* w,
  /usr/lib{,32,64}/x86_64-linux-gnu/sane/hpgt* w,
  /usr/{,local/}lib{,32,64}/libjpeg* w,
  /usr/lib/*-linux-gnu/libjpeg* w,
  /usr/lib{,32,64}/sane/libsane-hp* w,
  /usr/lib/*-linux-gnu/sane/libsane-hp* w,
  /etc/sane.d/dll.conf w,
  /home/ r,
  /home/*/ ra,
  /home/*/** ra,
  /home/*/.Xauthority r,
  /run/dbus/* rw,
  /{,usr/}bin/basename rix,
  /{,usr/}bin/cksum rix,
  /{,usr/}bin/cut rix,
  /{,usr/}bin/expr rix,
  /{,usr/}bin/file rix,
  /{,usr/}bin/gpg rUx,
  /{,usr/}bin/head rix,
  /{,usr/}bin/[gm]awk rix,
  /{,usr/}bin/md5sum rix,
  /{,usr/}bin/tail rix,
  /{,usr/}bin/tr rix,
  /{,usr/}bin/wc rix,
  /{,usr/}bin/wget rix,
  /{,usr/}bin/getopt rix,
  /{,usr/}lib{,32,64}/** mra,
  /var/hp-plugin.lock rw,
  /home/*/.hplip/** rwixl,
  /home/*/.config/** l,
  /{,usr/}bin/cat rix,
  /{,usr/}bin/lsb_release rix,
  /{,usr/}bin/sed rix,
  /{,usr/}bin/dd rix,
  /{,usr/}bin/gzip rix,
  /{,usr/}bin/df rix,
  /{,usr/}bin/chown rix,
  /{,usr/}bin/id rix,
  /{,usr/}bin/chgrp rix,
  /{,usr/}bin/rm rix,
  /{,usr/}bin/sudo rix,
  /{,usr/}bin/su rix,
    /usr/lib{,32,64}/python{2.[4-7],3.[0-4]}/**.{pyc,so} rw,
}



/usr/share/hplip/sendfax.py {
  #include <abstractions/hplip>
  #include <abstractions/ibus>
  #include <abstractions/p11-kit>

  /bin/ r,
  /bin/dash ix,
  /etc/cups/ r,
  /etc/cups/ppd/** r,
  /etc/cups/raw.convs r,
  /etc/fonts/** r,
  /etc/fstab r,
  /etc/nsswitch.conf r,
  /etc/passwd r,
  /etc/python[2-3].[0-9]/sitecustomize.py r,
  /etc/xdg/Trolltech.conf r,
  /home/*/ r,
  /home/*/** rw,
  /home/*/.ICEauthority r,
  /home/*/.cache/fontconfig/** rw,
  /home/*/.config/Trolltech.conf r,
  /home/*/.hplip/hplip.conf r,
  /proc/*/cmdline r,
  /proc/*/mounts r,
  /proc/filesystems r,
  /proc/meminfo r,
  /run/user/1000/dconf/user rw,
  /run/** r,
  /sbin/ r,
  /etc/ r,
  /{,usr/}bin/ r,
  /usr/lib{,32,64}/** ra,
  /usr/local/bin/ r,
  /usr/local/lib/python2.7/dist-packages/ r,
  /usr/local/sbin/ r,
  /usr/local/share/fonts/ r,
  /usr/sbin/ r,
  /usr/share/cups/mime/ r,
  /usr/share/cups/mime/cupsfilters.convs r,
  /usr/share/cups/mime/mime.convs r,
  /usr/share/cups/mime/pstotiff.convs r,
  /usr/share/fontconfig/conf.avail/90-fonts-nanum.conf r,
  /usr/share/fonts/ r,
  /usr/share/fonts/** r,
  /usr/share/glib-2.0/schemas/gschemas.compiled r,
  /usr/share/gvfs/remote-volume-monitors/ r,
  /usr/share/gvfs/remote-volume-monitors/afc.monitor r,
  /usr/share/gvfs/remote-volume-monitors/gphoto2.monitor r,
  /usr/share/gvfs/remote-volume-monitors/mtp.monitor r,
  /usr/share/gvfs/remote-volume-monitors/udisks2.monitor r,
  /usr/share/icons/ r,
  /usr/share/icons/** r,
  /usr/share/poppler/cMap/** r,
  /var/cache/fontconfig/** rw,
  /var/lib/snmp/mib_indexes/ a,
  @{PROC}/[0-9]*/net/dev r,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,
  @{PROC}/[0-9]*/net/wireless r,
  /{,usr/}bin/stty rix,

}
/usr/share/hplip/setup.py {
  #include <abstractions/hplip>
  capability dac_override,
  capability dac_read_search,
  /usr/share/hplip/plugin.py Px,
  /run/cups/certs/* r,
  /run/dbus/system_bus_socket rw,
  /{,usr/}bin/file rix,
  /usr/bin/lpr rix,
  /usr/lib{,32,64}/python{2.[4-7],3.[0-4]}/**.{pyc,so} rw,
  /var/lib/** rw,
  /usr/share/hplip/testpage.py rix,
  /run/udev/** r,

}
/usr/share/hplip/systray.py {
  #include <abstractions/hplip>
   /usr/share/hplip/toolbox.py Px,
  /usr/share/hplip/diagnose_plugin.py rix,
  /usr/share/hplip/plugin.py Px,
  /usr/share/hplip/upgrade.py rix,
 /usr/lib/libproxy-0.4.11/pxgsettings rix,
  #/usr/share/hplip/upgrade.py rix,
  /usr/bin/xdg-open rix,
  /usr/bin/gvfs-open rix,
  /usr/bin/which rix,
  /run/dbus/* rw,
  /usr/** mra,
  /usr/lib/python[2-3].[0-9]/** rw,
  /usr/share/hplip/sendfax.py ix,
  /var/lib/snmp/mib_indexes/ a,
  /var/cache/** r,
  #/usr/lib/firefox/firefox.sh rix,
    /run/udev/** r,

}


/usr/share/hplip/toolbox.py {
  #include <abstractions/hplip>
   /dev/ r,
   /usr/share/hplip/doctor.py rix,
   /run/dbus/system_bus_socket rw,
   /usr/share/hplip/fab.py rix,
   /usr/lib/libproxy-0.4.11/pxgsettings rix,
  /usr/share/hplip/upgrade.py rix,
  /usr/bin/xdg-open rix,
  /usr/bin/gvfs-open rix,
  /usr/lib/firefox/firefox.sh rix,
  /usr/lib/firefox/firefox rix,
  /var/cache/gio-2.0/gnome-defaults.list r,
  /usr/share/hplip/diagnose_queues.py rix,
  /run/udev/data/** r,
  /etc/ r,
  /usr/bin/gnome-terminal rix,
  /usr/lib/gnome-terminal/gnome-terminal-server rix,
  /usr/bin/gnome-terminal.real rix,
  /usr/lib/libvte-2.91-0/gnome-pty-helper rix,
  /usr/bin/lpr rix,
  /usr/bin/simple-scan rix,
  /usr/bin/xsane ix,
  /usr/lib{,32,64}/** mra,
  /usr/share/hplip/plugin.py Px,
  /usr/share/hplip/setup.py Px,
  /usr/share/hplip/systray.py Px,
  /usr/share/hplip/wificonfig.py Ux,
  /{,usr/}bin/basename rix,
  /{,usr/}bin/cksum rix,
  /{,usr/}bin/cut rix,
  /{,usr/}bin/expr rix,
  /{,usr/}bin/file rix,
  /{,usr/}bin/gpg rUx,
  /{,usr/}bin/gpg2 rUx,
  /{,usr/}bin/head rix,
  /{,usr/}bin/[gm]awk rix,
  /{,usr/}bin/md5sum rix,
  /{,usr/}bin/tail rix,
  /{,usr/}bin/tr rix,
  /{,usr/}bin/wc rix,
  /{,usr/}bin/wget rix,
  /{,usr/}bin/getopt rix,
  /{,usr/}lib{,32,64}/** mra,
  /var/hp-plugin.lock rw,
  @{HOME}/.hplip/** rwix,
  /{,usr/}bin/cat rix,
  /{,usr/}bin/lsb_release rix,
  /{,usr/}bin/sed rix,
  /{,usr/}bin/dd rix,
  /{,usr/}bin/gzip rix,
  /{,usr/}bin/df rix,
  /{,usr/}bin/chown rix,
  /{,usr/}bin/id rix,
  /{,usr/}bin/chgrp rix,
  /bin/dash rix,
  /bin/dd rix,
  /bin/df rix,
  /bin/gzip rix,
  /{,usr/}bin/mkdir rix,
  /bin/ping rix,
  /bin/tar rix,
  /bin/uname rix,
  /{,usr/}bin/which rix,
  /usr/lib{,32,64}/python{2.[4-7],3.[0-4]}/**.{pyc,so} rw,
  /usr/lib{,32,64}/python{2.[4-7],3.[0-4]}/** rw,
  /usr/lib/python3.4/** rw,
  /var/log/wtmp rw,
  /run/utmp rw,
 /bin/dash rix,
  /bin/grep rix,
  /bin/ps rix,
  /bin/stty rix,
  /bin/uname rix,
  /proc/ r,
  /proc/sys/kernel/pid_max r,
  /proc/uptime r,
  /sbin/ldconfig rix,
  /sbin/ldconfig.real rix,
  /usr/** rix,
 /{,usr/}bin/dpkg-architecture rix,
 /var/crash/** rw,
 /bin/getfacl rix,
}
