# Sample site-wide configuration file for syd user profile.

# Systemd
allow/net/connect+/run/dbus/system_bus_socket
allow/net/connect+/var/run/dbus/system_bus_socket
allow/net/connect+/run/systemd/userdb/io.systemd.DynamicUser
allow/net/connect+/run/user/[0-9]*/bus
allow/net/connect+/run/systemd/journal/dev-log

# Allow screen sessions.
allow/net/bind+/run/screen/S-*/***
allow/net/connect+/run/screen/S-*/***
allow/net/bind+/tmp/screens/S-*/***
allow/net/connect+/tmp/screens/S-*/***

# Allow tmux sessions.
allow/net/bind+/tmp/tmux-[0-9]*/***
allow/net/connect+/tmp/tmux-[0-9]*/***

# All internet must go through TOR.
allow/net/connect+loopback!9050

# As of 3.17.0, lock will be set to on in case no lock clauses are given
# before sandbox process startup. However, setting it explicitly here
# prevents user from overriding the config using ~/.user.syd-3. If
# allowed, user can effectively override the whole policy as last
# matching rule wins!
# Read more here: https://man.exherbo.org/syd.2.html#lock
# and here https://man.exherbo.org/syd.7.html#Threat_Model
lock:on
