# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{lib_dirs} = @{lib}/postgresql/@{version}/
@{bin_dirs} = @{lib_dirs}/bin

@{exec_path} = @{bin_dirs}/pg_ctl
@{att} = ""
profile pg_ctl /{,usr/}lib{,exec,32,64}/postgresql/[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{.[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],},}{.[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],},}{-[0-9a-zA-Z]{[0-9a-zA-Z],}{[0-9a-zA-Z],}{[0-9a-zA-Z],}{[0-9a-zA-Z],}{[0-9a-zA-Z],}{[0-9a-zA-Z],}{[0-9a-zA-Z],}{[0-9a-zA-Z],}{[0-9a-zA-Z],},}/bin/pg_ctl flags=(complain) {
  include <abstractions/base-strict>

  signal send peer=postgres,

  @{exec_path} mr,

  @{sh_path}           rix,
  @{bin_dirs}/postgres  px,

  owner /var/lib/postgresql/**.pid r,
  owner /var/log/postgresql/*.log w,

  include if exists <local/pg_ctl>
}

# vim:syntax=apparmor
