# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/systemd-sysext @{bin}/systemd-confext
@{att} = /att/systemd-sysext/
profile systemd-sysext /{{,usr/}bin/systemd-sysext,{,usr/}bin/systemd-confext} flags=(attach_disconnected,attach_disconnected.path=@{att},mediate_deleted)  {
  include <abstractions/attached/base>
  include <abstractions/bus-system>
  include <abstractions/disks-write>

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fsetid,
  capability net_admin,
  capability sys_admin,
  capability sys_rawio,
  capability sys_resource,

  mount,
  # mount                options=(rw bind)                        @{lib}/confexts/core-config/ -> @{run}/systemd/sysext/confexts/core-config/,
  # mount                options=(rw bind)                        @{run}/systemd/sysext/overlay/etc/.systemd-confext/ -> @{run}/systemd/sysext/overlay/etc/.systemd-confext/,
  # mount                options=(rw make-rslave)                 @{run}/,
  # mount                options=(rw rbind)                       @{run}/systemd/sysext/overlay/etc/ -> /etc/,
  # mount fstype=overlay options=(ro nodev noexec nosuid)         confext -> @{run}/systemd/sysext/overlay/etc/,
  # mount fstype=overlay options=(rw noatime nodev noexec nosuid) confext -> @{run}/systemd/sysext/overlay/etc/,
  # mount fstype=tmpfs                                            confext -> @{run}/systemd/sysext/,

  # mount                options=(rw move)                                      -> @{run}/systemd/sysext/overlay/etc/machine-id,
  # mount                options=(rw move)                                      -> @{run}/systemd/sysext/submounts/etc/machine-id,
  # mount                options=(rw rbind)  @{run}/systemd/sysext/overlay/usr/ -> /usr/,
  # mount fstype=erofs   options=(ro nodev)  @{att}/dev/dm-@{int}               -> @{run}/systemd/dissect-root/,
  # mount fstype=erofs   options=(ro nodev)  /dev/dm-@{int}                     -> @{run}/systemd/sysext/confexts/*/,
  # mount fstype=erofs   options=(ro nodev)  /dev/dm-@{int}                     -> @{run}/systemd/sysext/extensions/*/,
  # mount fstype=overlay options=(ro nodev)  sysext                             -> @{run}/systemd/sysext/overlay/usr/,
  # mount fstype=tmpfs                       sysext                             -> @{run}/systemd/sysext/,
  # mount options=(rw make-rshared make-rslave) /,
  # mount options=(rw rshared rslave) -> /,

  umount @{run}/systemd/sysext/submounts/etc/machine-id,
  umount /etc/,
  umount /etc/.systemd-confext/,
  umount /etc/machine-id,
  umount /usr/,

  unix bind type=stream addr=@@{udbus}/bus/systemd-sysext/,

  ptrace read peer=@{p_systemd},

  signal send set=(cont term winch) peer=child-pager,

  @{exec_path} mr,

  @{pager_path}                px -> child-pager,

  /usr/ r,
  /usr/.systemd-sysext/dev r,
  /usr/.systemd-sysext/extensions r,
  /usr/.systemd-sysext/origin r,

  @{att}/etc/ r,
  @{att}/etc/{,**} r,
  @{att}/etc/extension-release.d/{,**} r,
  @{att}/etc/systemd/{,**} r,
  @{att}/meta/{,**} r,
  @{att}/usr/{,**} r,
  @{att}/usr/share/** r,
  @{att}/var/lib/extensions.mutable/{,**} rw,

  /etc/ r,
  /etc/.systemd-confext/confexts r,
  /etc/.systemd-confext/dev r,
  /etc/.systemd-confext/origin r,
  /etc/extension-release.d/extension-release.* r,
  /etc/os-release r,

  /var/lib/confexts.d/ rw,
  /var/lib/confexts.d/** rwk,
  /var/lib/confexts/ rw,
  /var/lib/confexts/** rwk,
  /var/lib/extensions.d/ rw,
  /var/lib/extensions.d/** rwk,
  /var/lib/extensions/ rw,
  /var/lib/extensions/** rwk,

  @{run}/systemd/ r,
  @{run}/systemd/dissect-root/** r,
  @{run}/systemd/nspawn/ rw,
  @{run}/systemd/nspawn/locks/ w,
  @{run}/systemd/nspawn/locks/* rwk,
  @{run}/systemd/private rw,
  @{run}/systemd/sysext/{,**} rw,
  @{run}/systemd/sysupdate/notify/io.systemd.sysext rw,

  @{sys}/devices/virtual/bdi/*/read_ahead_kb r,

        @{PROC}/@{pid}/mountinfo r,
        @{PROC}/1/cgroup r,
        @{PROC}/1/environ r,
        @{PROC}/cmdline r,
        @{PROC}/devices r,
        @{PROC}/sys/kernel/osrelease r,
  owner @{PROC}/@{pid}/cgroup r,

  /dev/btrfs-control rw,
  /dev/loop-control rwk,

  include if exists <local/systemd-sysext>
}

# vim:syntax=apparmor
