    # Example AppArmor Profile.
    # License: Public Domain
    # Last change: August 29, 2017

    # NOTE: This profile is not fully functional, since
    # it is designed to test the syntax highlighting.

    include <tunables/global>

    # Declare an AppArmor variables to help with overrides
    @{FOO_LIB}=/usr/lib{,64,/*-linux-gnu}/foo
    @{USER_DIR}=@{HOME}/Public @{HOME}/Desktop

    # Profile for /usr/bin/foo
    /usr/bin/foo (attach_disconnected, enforce) {
    	include <abstractions/base>
    	include <abstractions/dbus>
    	include <abstractions/dbus-session>
    	include <abstractions/dbus-accessibility>
    	include <abstractions/fonts>
    	include <abstractions/X>
    	include <abstractions/kde>
    	include <abstractions/consoles>

    	#include <abstractions/ubuntu-helpers>
    	#include<abstractions/confidential-deny>
    	#include"/etc/apparmor.d/abstractions/open-browser"
    	include "/etc/apparmor.d/abstractions/open-email"

    	/{,**/} r,# Read only directories

    	owner /{home,media,mnt,srv,net}/** r,
    	owner @{USER_DIR}/{,**} rw,

    	audit deny owner /**/* mx,
    	audit deny owner /**/**.py* r,

    	# Files supported
    	/**.[tT][xX][tT] r, # txt
    	/**.[wW][bB][mM][pP] r, # wbmp
    	/**.[wW][eE][bB][pP] r, # webp

    	# Local configuration
    	owner file @{HOME}/.local/share/foo/{,**} rwk,
    	owner @{HOME}/.local/share/RecentDocuments/* rwk,
    	owner @{HOME}/.config/foo/{,**} rwk,
    	owner @{HOME}/.config/foorc{,.lock} rwk,
    	owner @{HOME}/.config/.[a-zA-Z0-9]* rwk,
    	owner @{HOME}/.cache/foo/{,**} rwk,

    	"/usr/share/**" r,
    	"/var/lib/flatpak/exports/share/**" r,
    	"/var/lib/flatpak/app/**/export/share/applications/*.desktop" r,
    	"/var/lib/snapd/desktop/applications/**" r,

    	allow file /etc/nsswitch.conf r,
    	allow /etc/fstab r,
    	/etc/udev/udev.conf r,
    	/etc/passwd r,
    	/etc/xdg/{,**} r,
    	/etc/xdg/Trolltech.conf k,
    	deny /etc/xdg/{autostart,systemd}/{,**} rw,
    	deny /boot/** rwlkmx,
    	@{PROC}/[0-9]*/{cmdline,mountinfo,mounts,stat,status,vmstat} r,
    	/sys/devices/**/uevent r,

    	# Libraries and binaries
    	/usr/bin/foo ixr,
    	/usr/bin/dolphin PUx,
    	/usr/bin/khelpcenter Cxr -> sanitized_helper,
    	/usr/bin/helloworld Cxr -> hello_world,
    	/usr/bin/* Pixr,
    	/usr/lib{,64}/** Pixr,
    	/usr/lib{,64,/*-linux-gnu}/qt5/plugins/{,**/}*.so m,
    	@{FOO_LIB}/{,**} mr,

    	# Temporal files and sockets
    	owner /tmp/{*lock,kde-*/**} rwk,
    	owner /var/tmp/kdecache-*/* rwk,
    	owner /run/user/[0-9]*/{*-socket,bus,kdeinit5*,foo*} rwk,
    	owner /run/user/[0-9]*/ksocket-*/{,**} rwk,
    	/run/dbus/system_bus_socket w,

    	/dev/{ati,dri}/** rw,
    	audit deny /dev/{audio,video}* rwlkmx,

    	# Dbus rules
    	dbus (send)
    		bus=system
    		path=/org/freedesktop/NetworkManager
    		interface=org.freedesktop.DBus.Introspectable
    		peer=(name=org.freedesktop.NetworkManager label=unconfined),
    	dbus (send receive)
    		bus=system
    		path=/org/freedesktop/NetworkManager
    		interface=org.freedesktop.NetworkManager
    		member={Introspect,state}
    		peer=(name=(org.freedesktop.NetworkManager|org.freedesktop.DBus)),
    	dbus (send)
    		bus=session
    		path=/org/gnome/GConf/Database/*
    		member={AddMatch,AddNotify,AllEntries,LookupExtended,RemoveNotify},

    	# Signal rules
    	signal (send) set=(term) peer=unconfined,
    	signal (send, receive) set=(int exists) peer=/usr/lib/hello/world//foo-helper,

    	# Child profile
    	profile hello_world {
    		# File rules (three different ways)
    		file /usr/lib{,32,64}/helloworld/**.so mr,
    		/usr/lib{,32,64}/helloworld/** r,
    		rk /usr/lib{,32,64}/helloworld/hello,file,

    		# Link rules (two ways)
    		l /foo1 -> /bar,
    		link /foo2 -> bar,
    		link /foo3 to bar,
    		link subset /link* -> /**,

    		# Network rules
    		network inet6 tcp,#Allow access to tcp only for inet6 addresses
    		network netlink dgram,
    		network bluetooth,

    		# Capability rules
    		capability dac_override,
    		capability sys_admin,
    		capability sys_chroot,

    		# Mount rules
    		mount options=(rw bind remount nodev noexec) fstype=ecryptfs /home/*/.helloworld/ -> /home/*/helloworld/,
    		mount options in (rw, bind) / -> /run/hellowordd/*.mnt,
    		umount /home/*/helloworld/,

    		# Pivot Root rules
    		pivot_root oldroot=/mnt/root/old/ /mnt/root/,
    		pivot_root /mnt/root/,

    		# Ptrace rules
    		ptrace (trace) peer=unconfined,
    		ptrace (read, trace, tracedby) peer=/usr/lib/hello/helloword,

    		# Unix rules
    		unix (connect receive send) type=(stream) peer=(label=unconfined addr=@/tmp/ibus/dbus-*),
    		unix (send,receive) type=(stream) protocol=0 peer=(addr=none),
    		unix peer=(label=@{profile_name},addr=@helloworld),

    		# Rlimit rule
    		set rlimit data <= 100M,
    		set rlimit nproc <= 10,
    		set rlimit nice <= 5,

    		# Change Profile rules
    		change_profile unsafe /** -> [^u/]**,
    		change_profile unsafe /** -> {u,un,unc,unco,uncon,unconf,unconfi,unconfin,unconfine},
    		change_profile /bin/bash -> new_profile,

    		# Alias
    		alias /usr/ -> /mnt/usr/,
    	}

    	# Hat
    	^foo-helper {
    		network unix stream,
    		unix stream,

    		/usr/hi\"esc\x23esc\032esc\c3esc r, # Escape expressions

    		# Text after a variable is highlighted as path
    		file /my/path r,
    		@{FOO_LIB}file r,
    		@{FOO_LIB}#my/path r, #Comment
    	}
    }

    # Profile for /usr/bin/error
    profile syntax_error /usr/bin/error flags=(complain audit) {
    	# Syntax error highlighting:

    	# Error: Include
    	include<filepath>
    	include <filepath >
    	#includefilepath
    	# include
    	file #include /hello r,

    	# Error: Variable open or with characters not allowed
    	@{var
    	@{sdf&s}

    	# Error: Open brackets
    	/{hello{ab,cd}world  kr,
    	/{abc{abc kr,
    	/[abc  kr,
    	/(abc kr,

    	# Error: Empty brackets
    	/hello[]hello{}hello()he  kr,

    	# Error: Open rule
    	/home/*/file rw
    	capability dac_override
    	deny file /etc/fstab w
    	audit network ieee802154,

    	dbus (receive
    	unix stream,
    	unix stream,
    }