# vim:syntax=apparmor
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2006 Novell/SUSE
#    Copyright (C) 2009-2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  /bin/dash rix,
  /bin/df rix,
  /bin/ps rix,
  /bin/uname rix,
  /bin/which rix,
  /usr/bin/whois rix,
  /usr/bin/uuencode rix,
  /usr/lib/sm.bin/sendmail rPx,

  # shared snippets for config files
  /etc/mtab r,
  /etc/php5/** r,
  /etc/php5/{conf.d,apache2,cli,fastcgi,cgi}/ r,
  /etc/php5/{conf.d,apache2,cli,fastcgi,cgi}/*.ini r,

  # php libs
  /usr/lib/php{,5}/extensions/*.so mr,
  /usr/lib/php{,5}/[0-9]/*.so mr,
  /usr/lib/php{,4,5}/*.so mr,
  /usr/lib64/php{,5}/extensions/*.so mr,
  /usr/lib64/php{,5}/[0-9]/*.so mr,
  /usr/lib64/php{,4,5}/*.so mr,

  # Xlibs
  /usr/X11R6/lib{,32,64}/lib*.so* mr,

  # system libs
  /{,usr/}lib/lib*.so* mr,
  /{,usr/}lib/x86_64-linux-gnu/{lib,mod_}*.so* mr,

  # gconv libs
  /{,usr/}lib/x86_64-linux-gnu/gconv/*.so* mr,
  /{,usr/}lib/x86_64-linux-gnu/gconv/gconv-modules.cache r,

  # php extensions
  /usr/lib{64,}/php5/*/*.so mr,

  # php5 session mmap socket
  /var/lib/php5/session_mm_* rwlk,
  # file based session handler
  /var/lib/php{,5}/sess_* rwlk,

  # php libraries
  /usr/share/php{,5}/ r,
  /usr/share/php{,5}/** mr,
  /usr/share/php{,5}/.lock rk,

  # MySQL extension
  /usr/share/mysql/** r,

  # extensions in general
  /usr/share/** r,

  # aspell
  #include <abstractions/aspell>
  #include <abstractions/enchant>
  /usr/bin/aspell rix,
  /var/lib/aspell/** r,

  # djpeg
  /usr/bin/jpegtopnm rix,
  /usr/bin/pnmtojpeg rix,
  /usr/bin/pnmscale rix,

	# openssl
	#include <abstractions/openssl>
	/usr/bin/openssl rix,

  # ghostscript
  /usr/bin/gs rix,
  /var/lib/ghostscript/** r,
  /etc/papersize r,

  # ImageMagick / GraphicsMagick
  /etc/ImageMagick/** r,
  /tmp/magick-* rwk,
  /tmp/magick-*/** rwk,
  /usr/bin/convert rix,
  /usr/bin/convert.im6 rix,
  /usr/bin/gm rix,
  /usr/lib/x86_64-linux-gnu/ImageMagick-6.7.7/** mr,

  # htmldoc
  /usr/bin/htmldoc rix,

  # locale
  /etc/locale.alias r,
  /usr/lib/locale/* r,

  # pear
  /etc/pear/* r,

	# php scripts
  /tmp rw,
  /proc/ r,
  /proc/loadavg r,
  @{PROC}/ r,
  @{PROC}/loadavg r,

  # Zend opcache
  /tmp/.ZendSem.* rwlk,

  # THOR scripts
  /home/*.php r,

  # xml
  /etc/xml/* r,

  #deny browsing the system for executables
  deny /bin/ r,
  deny /sbin/ r,
  deny /usr/bin/ r,
  deny /usr/local/bin/ r,
  deny /usr/local/sbin/ r,
  deny /usr/sbin/ r,

