#include <tunables/global>

profile /usr/lib/firefox/firefox {
  include <abstractions/X>
  include <abstractions/audio>
  include <abstractions/base>
  include <abstractions/bash>
  include <abstractions/dconf>
  include <abstractions/gnome>
  include <abstractions/consoles>
  include <abstractions/fonts>
  include <abstractions/nameservice-strict>
  include <abstractions/freedesktop.org>
  include <abstractions/user-tmp>
  include <abstractions/mesa>

  userns,
  network inet,
  network inet6,
  network netlink,

  / r,
  /bin/dash ix,
  /bin/readlink rix,
  /bin/which rix,
  /usr/bin/dirname ix,

  /usr/lib/firefox/vaapitest ix,
  /usr/lib/firefox/glxtest ix,
  /usr/lib/firefox/gfxtest ix,
  /usr/share/glvnd/** r,
  /usr/share/libdrm/** r,

  /etc/firefox/{,**} r,
  /etc/mime.types r,
  /etc/mailcap r,
  /etc/fstab r,

  /usr/share/xulrunner-*/** r,
  /usr/share/firefox/** r,
  /usr/share/mozilla/** r,
  /usr/share/mime/ r,
  /usr/share/doc/** r,
  /usr/share/fontconfig/** r,

  /usr/lib/firefox/firefox ix,

  /usr/share/glib-2.0/schemas/gschemas.compiled r,

  /sys/devices/** r,
  /sys/bus/{,**} r,
  /sys/class/ r,
  /sys/class/hidraw/ r,
  /sys/fs/cgroup/**/cpu.max r,
  /dev/hidraw* rw,
  owner @{PROC}/@{pid}/{fd/,cmdline,mountinfo,smaps,stat,statm,cgroup} r,
  owner @{PROC}/@{pid}/task/ r,
  owner @{PROC}/@{pid}/task/[0-9]*/{comm,stat} r,
  @{PROC}/pressure/memory r,
  /dev/ r,
  /dev/dri/ r,
  owner @{PROC}/@{pid}/oom_score_adj w,
  owner /{dev,run}/shm/org.chromium.* mrw,
  owner /{dev,run}/shm/org.mozilla.ipc.* mrw,

  owner /run/user/*/dconf/user rw,
  owner @{HOME}/.mozilla/ w,
  owner @{HOME}/.mozilla/firefox/ w,
  owner @{HOME}/.mozilla/firefox/** rwk,
  owner @{HOME}/.config/mozilla/ w,
  owner @{HOME}/.config/mozilla/firefox/ w,
  owner @{HOME}/.config/mozilla/firefox/** rwk,
  owner @{HOME}/.cache/mozilla/** rwk,
  owner @{HOME}/.cache/dconf/user rw,
  owner @{HOME}/.config/mimeapps.list.* w,
  owner @{HOME}/Downloads/{,**} rw,
  owner @{HOME}/config/** r,

  # bwrap / glycin-loaders
  /usr/bin/bwrap rix,
  /usr/libexec/glycin-loaders/2+/* rix,
  /usr/share/glycin-loaders/2+/conf.d/{,**} r,
  @{PROC}/sys/kernel/overflow[gu]id r,
}