# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/dracut
@{att} = /att/dracut/
profile dracut /{,usr/}bin/dracut flags=(attach_disconnected,attach_disconnected.path=@{att}) {
  include <abstractions/attached/base>
  include <abstractions/attached/consoles>
  include <abstractions/disks-read>
  include <abstractions/attached/nameservice-strict>
  include <abstractions/path>

  capability dac_override,
  capability mknod,
  capability sys_chroot,

  network alg seqpacket, # kernel crypto API

  @{exec_path} mrix,

  @{sh_path}                  rix,
  @{archive_path}             rix,
  @{coreutils_path}           rix,
  @{ldd_path}                  cx -> ldd,
  @{bin}/@{multiarch}-pkg-config rix,
  @{bin}/3cpio                rix,
  @{bin}/eu-strip             rix,
  @{bin}/logger rix,
  @{bin}/findmnt               px,
  @{bin}/getopt               rix,
  @{bin}/hardlink             rix,
  @{bin}/kmod                  cx -> kmod,
  @{bin}/mountpoint           rix,
  @{bin}/pkgconf              rix,
  @{bin}/sync                 rix,
  @{bin}/systemctl             cx -> systemctl,
  @{bin}/systemd-cat           px,
  @{bin}/systemd-detect-virt   px,
  @{bin}/systemd-escape        px,
  @{bin}/udevadm               px,
  @{bin}/zgrep                rix,
  @{sbin}/blkid                px,
  @{sbin}/btrfs                px,
  @{sbin}/ldconfig            rix,
  @{lib}/plymouth/plymouth-populate-initrd pux,

  @{lib}/dracut/dracut-util    rix,
  @{lib}/dracut/dracut-install px,

  @{lib}/ r,
  @{lib}/dracut/{,**} r,

  /usr/share/kbd/{,**} r,
  /usr/share/pkgconfig/{,**} r,
  /usr/share/plymouth/{,**} r,
  /usr/share/terminfo/{,**} r,

  /etc/depmod.d/ r,
  /etc/depmod.d/*.conf r,
  /etc/dracut.conf r,
  /etc/dracut.conf.d/{,**} r,
  /etc/machine-id r,
  /etc/modprobe.d/{,**} r,
  @{lib}/modprobe.d/{,**} r,

  /etc/crypttab r,
  /etc/fstab r,
  /etc/modules-load.d/{,**} r,
  /etc/plymouth/plymouthd.conf r,
  /etc/shadow r,
  /etc/sysconfig/{,**} r,
  /etc/systemd/{,**} r,
  /etc/vconsole.conf r,

  @{efi}/initrd* rw,

  /var/lib/bluetooth/{,**/} r,

  /var/tmp/dracut.@{rand6}/{,**} rwl,
  /var/tmp/dracut.@{rand6}@{w}/{,**} rwl,

  @{run}/modprobe.d/ r,
  @{run}/modprobe.d/*.conf r,

  @{sys}/class/drm/ r,
  @{sys}/bus/*/devices/ r,
  @{sys}/devices/**/modalias r,
  @{sys}/module/firmware_class/parameters/path r,

  @{PROC}/@{pid}/cgroup r,
  @{PROC}/@{pid}/fd/ r,
  @{PROC}/@{pid}/mountinfo r,
  @{PROC}/cmdline r,
  @{PROC}/swaps r,

  profile systemctl {
    include <abstractions/attached/base>
    include <abstractions/app/systemctl>

    capability net_admin,

    /var/tmp/dracut.@{rand6}/{,**} rw,
    /var/tmp/dracut.@{rand6}@{w}/{,**} rw,

    include if exists <local/dracut_systemctl>
  }

  profile kmod {
    include <abstractions/attached/base>
    include <abstractions/app/kmod>

    /var/tmp/dracut.@{rand6}/initramfs/@{lib}/modules/*/ r,
    /var/tmp/dracut.@{rand6}/initramfs/@{lib}/modules/*/kernel/{,**} r,
    /var/tmp/dracut.@{rand6}/modules/*/ r,
    /var/tmp/dracut.@{rand6}/modules/*/kernel/{,**} r,
    /var/tmp/dracut.@{rand6}/modules/*/modules.* rw,

    /var/tmp/dracut.@{rand6}@{w}/initramfs/@{lib}/modules/*/ r,
    /var/tmp/dracut.@{rand6}@{w}/initramfs/@{lib}/modules/*/kernel/{,**} r,
    /var/tmp/dracut.@{rand6}@{w}/modules/*/ r,
    /var/tmp/dracut.@{rand6}@{w}/modules/*/kernel/{,**} r,
    /var/tmp/dracut.@{rand6}@{w}/modules/*/modules.* rw,

    @{sys}/module/compression r,
    @{sys}/module/**/initstate r,

    include if exists <local/dracut_kmod>
  }

  profile ldd {
    include <abstractions/attached/base>
    include <abstractions/attached/consoles>
    include <abstractions/attached/nameservice-strict>

    @{ldd_path}  mrix,

    @{bin}/* mr,
    @{sbin}/* mr,
    @{lib}/**  mr,

    include if exists <local/dracut_ldd>
  }

  include if exists <local/dracut>
}

# vim:syntax=apparmor
