#include <tunables/global>

/usr/local/bin/iriunwebcam.real {
  #include <abstractions/base>

  # The binary itself
  /usr/local/bin/iriunwebcam.real mr,


  /usr/share/alsa/** r,
  /etc/nsswitch.conf r,
  /etc/group r,

  # Fonts
  /etc/fonts/** r,
  /home/*/.local/share/fonts/** r,
  /home/*/.cache/fontconfig/** r,
  /usr/share/fontconfig/** r,

  # Config
  /home/*/.config/Iriun/** rw,

  # Temp files
  /tmp/ r,
  /tmp/** rwk,

  # Video devices only
  /dev/video* rw,

  # USB (for ADB phone detection)
  /dev/bus/usb/** r,

  # ADB binary and its dependencies
  /usr/bin/dash ix,
  /usr/lib/android-sdk/platform-tools/adb ix,
  /etc/ld.so.cache r,
  /usr/lib/x86_64-linux-gnu/** mr,

  # Proc/sys reads
  /proc/** r,
  /sys/** r,
  /dev/bus/usb/ r,

  # Network (Wi-Fi connection to phone)
  network inet stream,
  network inet dgram,
  network inet6 stream,
  network inet6 dgram,

  # Explicitly deny all sound devices
  deny /dev/snd/** rwklmx,
  deny /run/user/*/pulse/** rwklmx,
}