  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/openssl>
  #include <abstractions/private-files-strict>
  #include <abstractions/python>

  /usr/bin/python{3,3.[0-9],3.1[0-9]} mr,

  # Why are these not in abstractions/python?
  /usr/lib{,32,64}/python{3,3.[0-9],3.1[0-9]}/__pycache__/ rw,
  /usr/lib{,32,64}/python{3,3.[0-9],3.1[0-9]}/__pycache__/* rw,
  /usr/lib{,32,64}/python{3,3.[0-9],3.1[0-9]}/**/__pycache__/ rw,
  /usr/lib{,32,64}/python{3,3.[0-9],3.1[0-9]}/**/__pycache__/* rw,

  /bin/dash rix,
  /{usr/,}bin/file rix,
  /proc/*/mounts r,
  /proc/*/fd/ r,
  /sbin/ldconfig rix,
  /sbin/ldconfig.real rix,
  /bin/uname rix,
  /etc/magic r,
  /etc/mime.types r,
  /usr/share/onionshare{,-cli}/ r,
  /usr/share/onionshare{,-cli}/** r,
  /tmp/ rw,
  /tmp/** rw,

  # Allow read on almost anything in @{HOME}. Lenient, but
  # private-files-strict is in effect.
  owner @{HOME}/         r,
  owner @{HOME}/[^.]**   r,

  # Configuration
  owner @{HOME}/.config/onionshare/{,**} rw,

  # Temporary files
  owner @{HOME}/.config/#[0-9]*[0-9] rw,

  # Directory for received files
  owner @{HOME}/Downloads/{,**} rw,

  # Silence innocuous denials
  deny @{HOME}/.face r,
