/etc/apparmor.d/abstractions/totem is in apparmor-profiles-extra 1.19.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 | # vim:syntax=apparmor
# Author: Jamie Strandboge <jamie@canonical.com>
# Description: Limit executable access and reasonable read access. A look at
# the gconf schema files for totem-video-thumbnailer reveals at least the
# following files:
# 3gpp, ac3, acm, aiff, amr-wb, ape, asf, asx, au, avi, basic, divx, dv, flac,
# flc, fli, flic, flv, google-video-pointer, gpp, gsm, m4a, m4v, matroska,
# midi, mod, mp3, mp4, mp4es, mpeg, mpt2, msvideo, ms-wm, musepack,mxf,
# netshow, nsv, off, ogm, pict, pn-realaudio, prs.sid, quicktime, ram,
# realpix, rn, sbc, sdp, shorten, speex, theora, totem-stream, tta, ultravox,
# vivo, vorbis, wav, wavpack, wax, webm, wma, wmv, wmx, wpl, wvx, x-anim,
# x-it, xm
#
# While ideally we would narrow down our read access to the above, this is
# a maintenance problem and doesn't work for files without extensions.
#include <abstractions/gnome>
#include <abstractions/gstreamer>
#include <abstractions/nameservice>
#include <abstractions/dbus-session>
# Allow read on all directories
/**/ r,
# Allow read on removable media and files in /usr/share and /usr/local/share
/usr/local/share/** r,
/usr/share/** r,
/{media,mnt,opt,srv}/** r,
/usr/lib/@{multiarch}/gstreamer[0-9]*.[0-9]*/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner Px -> gst_plugin_scanner,
owner @{HOME}/.cache/gstreamer-[0-9]*.[0-9]*/ rw,
owner @{HOME}/.cache/gstreamer-[0-9]*.[0-9]*/registry.*.bin rw,
owner @{HOME}/.cache/gstreamer-[0-9]*.[0-9]*/registry.*.bin.tmp* rw,
owner @{HOME}/.cache/mesa/** rwk,
owner @{HOME}/.cache/thumbnails/** rw,
owner @{HOME}/.cache/totem/ rw,
owner @{HOME}/.cache/totem/** rwk,
owner @{HOME}/.cache/totem-* rwk,
owner @{HOME}/.cache/tracker/db-locale.txt r,
owner @{HOME}/.cache/tracker/meta.db{,-shm,-journal,-wal} rwk,
owner @{HOME}/.cache/tracker/ontologies.gvdb r,
owner @{HOME}/.config/totem/ rwk,
owner @{HOME}/.config/totem/** rwk,
owner @{HOME}/.local/share/grilo-plugins/ rwk,
owner @{HOME}/.local/share/grilo-plugins/*.db{,-shm,-journal,-wal} rwk,
owner @{HOME}/.local/share/gvfs-metadata/** r,
owner @{HOME}/.local/share/totem/ rwk,
owner @{HOME}/.local/share/tracker/data/tracker-store.journal rwk,
owner @{PROC}/@{pid}/status r,
/run/udev/data/c* r,
/run/udev/data/+drm:card* r,
/run/udev/data/+usb* r,
/sys/devices/system/node/*/meminfo r,
|