#!/bin/zsh -fuC

# 0300 is the device class of VGA devices
VGA_PCI_ID=${"$(lspci -d ::0300)"%% *}

ff_profile() {
    local ff_profile=$1 ff_profile_dir
    if [[ $ff_profile == \* ]]
    then
        ff_profile_dir=~/.mozilla/firefox/\*
    else
        ff_profile_dir=$(echo ~/.mozilla/firefox/*.$ff_profile(:t[1]))
    fi
    shift

    local allow_audio=true
    local allow_fs_browsing=true
    local allow_pinger=true
    local allow_updater=false
    local ff_dir=/usr/lib/firefox

    while (( $# ))
    do
        case $1 in
          allow_audio) allow_audio=true ;;
          deny_audio) allow_audio=false ;;
          allow_fs_browsing) allow_fs_browsing=true ;;
          deny_fs_browsing) allow_fs_browsing=false ;;
          allow_pinger) allow_pinger=true ;;
          deny_pinger) allow_pinger=false ;;
          allow_updater) allow_updater=true ;;
          deny_updater) allow_updater=false ;;

          *)
            if [[ -d $1 ]]
            then
                ff_dir=$1
            elif [[ $# -eq 1 ]]
            then
                break
            else
                echo "Invalid argument $1" >&2
                exit 1
            fi
        esac

        shift
    done

    local aa_profile=ff
    if [[ $ff_profile == \* ]]
    then
        aa_profile=firefox
    elif [[ $ff_profile != default ]]
    then
        aa_profile+=-$ff_profile
    fi

    cat <<__EOF

profile $aa_profile {
__EOF

    if $allow_audio
    then
        echo '  include <abstractions/audio>'
    else
        cat <<__EOF
  deny /usr/bin/pulseaudio x,
  deny /etc/pulse/client.conf r,
  deny /run/user/*/pulse/ rw,
  deny /dev/shm/ r,
__EOF
    fi

    cat <<__EOF
  include <abstractions/base>
  include <abstractions/dbus-session>
  include <abstractions/dconf>
  include <abstractions/dri-common>
  include <abstractions/gnome>
  include <abstractions/mesa>
  include <abstractions/nameservice>

  $ff_dir/** r,
  $ff_dir/*.so m,
  $ff_dir/firefox{,-bin} ix,
  /usr/share/firefox/** r,
  /usr/share/xul-ext/** r,
  /usr/share/hunspell/ r,
  /usr/share/hunspell/* r,
  /usr/share/fonts-font-awesome/fonts/* r,

  deny /{,usr/}bin/dash x,
  /usr/bin/lsb_release PUx,

  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mountinfo r,
  @{PROC}/@{pid}/net/arp r,
  @{PROC}/@{pid}/net/if_inet6 r,
  owner @{PROC}/@{pid}/stat r,
  owner @{PROC}/@{pid}/statm r,
  owner @{PROC}/@{pid}/smaps r,
  owner @{PROC}/@{pid}/task/@{tid}/stat r,

  /etc/timezone r,
  /etc/mailcap r,
  /etc/mime.types r,
  owner @{HOME}/.mailcap r,
  owner @{HOME}/.mime.types r,
  owner @{HOME}/.cache/fontconfig/* wk,
  owner @{HOME}/.cache/thumbnails/*/*.png r,
  deny /var/cache/fontconfig/ w,

  # DRI
  /sys/devices/pci0000:00/0000:$VGA_PCI_ID/* r,

  # firefox specific
  /etc/firefox/ r,
  /etc/firefox/** r,
  /etc/xul-ext/** r,
  /usr/share/mozilla/extensions/** r,
  /usr/share/webext/** r,

  owner @{PROC}/@{pid}/cgroup r,
  /sys/devices/system/cpu/present r,
  /sys/devices/system/cpu/*/cache/*/size r,
  /sys/devices/system/cpu/cpufreq/*/cpuinfo_max_freq r,
  /sys/devices/system/node/ r,
  /sys/devices/system/node/*/meminfo r,
  /sys/fs/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,
  owner /dev/shm/org.mozilla.ipc.* rwk,
  owner /dev/shm/org.chromium.* rw,

  # per-user firefox configuration
  owner @{HOME}/.cache/mozilla/firefox/$ff_profile_dir/ r,
  owner @{HOME}/.cache/mozilla/firefox/$ff_profile_dir/** rw,
  owner @{HOME}/.cache/mozilla/firefox/$ff_profile_dir/**/*.{db,parentlock,sqlite}* k,
  owner @{HOME}/.mozilla/firefox/profiles.ini r,
__EOF

    if [[ $ff_profile == \* ]]
    then
        echo '  owner @{HOME}/.mozilla/firefox/profiles.ini w,'
    fi

    cat <<__EOF
  owner @{HOME}/.mozilla/firefox/$ff_profile_dir/ r,
  owner @{HOME}/.mozilla/firefox/$ff_profile_dir/** rw,
  owner @{HOME}/.mozilla/firefox/$ff_profile_dir/**.{db,mdb,parentlock,sqlite}* k,
  owner @{HOME}/.mozilla/firefox/$ff_profile_dir/extensions/* w,

  # suppress execve("/bin/sh", ["/bin/sh", "-c", "test \"$DISPLAY\" != \"\""],
  deny /bin/sh x,
  deny /dev/ r,
  deny /etc/fstab r,
  deny @{HOME}/.mozilla/ r,
  deny "@{HOME}/.mozilla/firefox/Crash Reports/**" rw,
  deny "@{HOME}/.mozilla/firefox/Pending Pings/{,*}" r,
  deny $ff_dir/fonts/.uuid.* w,
__EOF

    if $allow_fs_browsing
    then
        cat <<__EOF

  # Make browsing directories work
  / r,
  /**/ r,

  owner @{HOME}/[^.]** r,
  # don't report Firefox tries to access hidden files, it happens in File Open dialogue
  deny @{HOME}/.* r,
  deny @{HOME}/.*/ r,
__EOF
    fi

    if $allow_pinger
    then
        cat <<__EOF

  # Pingsender (Mozilla call-back)
  $ff_dir/pingsender cx -> pingsender,

  profile pingsender {
    include <abstractions/base>
    include <abstractions/nameservice>

    /etc/ssl/openssl.cnf r,

    $ff_dir/pingsender r,
    # owner @{HOME}/.mozilla/firefox/Pending Pings/** rw,

    owner @{HOME}/.mozilla/firefox/$ff_profile_dir/saved-telemetry-pings/* rw,
  }
__EOF
    fi

    if $allow_updater
    then
        cat <<__EOF

  # Updater
  $ff_dir/active-update.xml{,.tmp} w,
  $ff_dir/updates.xml{,.tmp} w,
  $ff_dir/update.test{,/} w,
  $ff_dir/updates/** w,
  $ff_dir/updater cx -> updater,

  profile updater {
    include <abstractions/base>
    include <abstractions/gnome>

    $ff_dir/{,**} rw,
    $ff_dir/*.so m,

    $ff_dir/firefox-bin px -> $aa_profile,

    owner /dev/shm/org.chromium.* rw,

    # don't complain about leaked file descriptors
    # https://bugzilla.mozilla.org/show_bug.cgi?id=1520943
    deny @{HOME}/.mozilla/firefox/$ff_profile_dir/** r,
  }
__EOF
    fi

    if [[ $# -ge 1 ]]
    then
        echo -n "${(e)@}"
    fi

    echo '}'
}

echo 'include <tunables/global>'

ff_profile default /home/joerg/kein_Backup/firefox-56 deny_pinger '
  include <abstractions/cups-client>

  owner @{HOME}/.mozilla/native-messaging-hosts/* r,
  /home/joerg/bin/uget-integrator Ux,
  /home/joerg/bin/open-link Ux,
  /home/joerg/git/keepassxc/build/src/proxy/keepassxc-proxy Ux,

  owner @{HOME}/.config/.keysnail.js r,
  owner @{HOME}/Downloads/{,**} rw,

  deny $ff_dir/update.test{,/} w,
'

ff_profile nightly /home/joerg/kein_Backup/firefox-nightly allow_updater '
  owner @{HOME}/Downloads/{,**} rw,
  /sys/fs/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,

  deny /home/joerg/kein_Backup/update.test/ w,
'

ff_profile dev /home/joerg/kein_Backup/firefox-dev allow_updater '
  owner @{HOME}/.mozilla/native-messaging-hosts/* r,
  /home/joerg/bin/uget-integrator Ux,
  /home/joerg/git/keepassxc/build/src/proxy/keepassxc-proxy Ux,
  /sys/fs/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,

  deny /home/joerg/kein_Backup/update.test/ w,

  # https://searchfox.org/mozilla-central/source/toolkit/xre/glxtest.cpp#238
  # https://bugzilla.mozilla.org/show_bug.cgi?id=1676883
  /sys/devices/pci0000:00/0**/{device,class,vendor} r,
'

ff_profile hack /home/joerg/kein_Backup/firefox-dev allow_updater '
  deny /home/joerg/kein_Backup/update.test/ w,
  /sys/fs/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,
'

ff_profile m deny_pinger deny_fs_browsing '
  /dev/video? rw,
'

ff_profile fb deny_pinger deny_fs_browsing

ff_profile gr deny_pinger deny_fs_browsing '
  owner @{HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json r,
  /home/joerg/git/keepassxc/build/src/proxy/keepassxc-proxy Ux,
'

ff_profile bank deny_audio deny_pinger deny_fs_browsing '
  owner @{HOME}/Bank/{,**} rw,
'

ff_profile fidor deny_audio deny_pinger deny_fs_browsing '
  owner @{HOME}/Firma/{,**} rw,
'
