usr.bin.skype

# Skype 4.3.x + Ubuntu 15.10

#include <tunables/global>

/usr/bin/skype {
  #include <abstractions/base>
  #include <abstractions/user-tmp>
  #include <abstractions/audio>
  #include <abstractions/nameservice>
  #include <abstractions/ssl_certs>
  #include <abstractions/fonts>
  #include <abstractions/ibus>
  #include <abstractions/dbus>
  #include <abstractions/dbus-session>
  #include <abstractions/X>
  #include <abstractions/freedesktop.org>
  #include <abstractions/gnome>
  #include <abstractions/kde>

  audit deny /etc/passwd r,
  audit deny @{HOME}/.mozilla/ r,
  audit deny /home/*/.mozilla/** r,
  audit deny @{PROC}/*/auxv r,
  audit deny @{PROC}/*/cmdline r,
  audit deny @{PROC}/[0-9]*/fd/ r,
  deny @{PROC}/[0-9]*/task/ r,
  deny @{PROC}/[0-9]*/task/** r,
  audit deny @{PROC}/[0-9]*/fd/ r,
  audit deny /var/cache/fontconfig/ w,
  audit deny /sys/devices/** r,
  audit deny /etc/xdg/sni-qt.conf k,

  network,

  /usr/bin/skype mr,
  /opt/skype/skype pix,
  /opt/skype/** kmr,
  /usr/share/fonts/** m,
  owner @{PROC}/*/net/arp r,
  owner @{PROC}/*/cmdline r,
  owner @{PROC}/*/auxv r,
  @{PROC}/sys/kernel/ostype r,
  @{PROC}/sys/kernel/osrelease r,
  /usr/bin/xdg-open rUxmlk,
  /dev/ r,
  /dev/tty rw,
  /dev/snd/* mrw,
  /{dev,run}/shm/ r,
  /{dev,run}/shm/pulse-shm-* mrw,
  /etc/pulse/client.conf r,
  /dev/pts/* rw,
  /dev/video* mrw,
  owner @{HOME}/.cache/fontconfig/** lkmrw,
  owner @{HOME}/Downloads/* krw,
  owner @{HOME}/Downloads/ krw,
  /etc/xdg/Trolltech.conf rk,
  owner @{HOME}/.config/Trolltech.conf* rwk,
  /etc/xdg/sni-qt.conf r,
  /usr/share/locale-langpack/* mr,
  /usr/share/glib-2.0/schemas/gschemas.compiled rm,
  /usr/share/nvidia-331/** rm,
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/cpu0/cpufreq/* r,
  owner @{HOME}/.Skype/ krw,
  owner @{HOME}/.Skype/** krw,
  owner @{HOME}/.config/Skype/ krw,
  owner @{HOME}/.config/Skype/** krw,
  /usr/share/skype/** kmr,
  /usr/share/skype/sounds/*.wav kr,
  /usr/share/icons/** kr,
  /sys/class/power_supply/ r,

  owner @{PROC}/[0-9]*/status r,
  owner @{PROC}/[0-9]*/net/** r,

  /usr/bin/pavucontrol rmUx,

}