# curl: the "write" policy, with any host, your curlrc and ~/Downloads.
# It saves files in the project or ~/Downloads, and nowhere else, so a
# download cannot replace anything that runs outside the sandbox later.
# ~/.netrc, which may hold passwords, is never readable.
# policies/commands/curl.policy in blinker's config directory comes first.

# type  access  pattern
include write
file    read    ${XDG_CONFIG_HOME:-~/.config}/curlrc
file    read    ${CURL_HOME:-~}/.curlrc
file    write   ~/Downloads

host    allow   *

env     allow   CURL_HOME
env     allow   CURL_CA_BUNDLE
env     allow   SSL_CERT_FILE
env     allow   SSL_CERT_DIR