# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

# !!! warning
#
#     This abstraction should only be used by profiles in the systemd software suite.
#

  abi <abi/4.0>,

  / r,
  @{att}/ r,

  @{sys}/fs/cgroup/system.slice/@{profile_name}.service/ r,
  @{sys}/fs/cgroup/system.slice/@{profile_name}.service/memory.pressure rw,

        @{PROC}/1/cgroup r,
        @{PROC}/1/environ r,
        @{PROC}/1/sched r,
        @{PROC}/cmdline r,
        @{PROC}/sys/kernel/osrelease r,
        @{PROC}/sys/kernel/random/boot_id r,
  owner @{PROC}/@{pid}/stat r,

  /dev/kmsg w,

  # Silence this noisy denial. systemd utilities look at /proc/1/environ to see
  # if running in a container, but they will fallback gracefully. No other
  # interfaces allow this denial, so no problems with silencing it for now. Note
  # that allowing this triggers a 'ptrace trace peer=unconfined' denial, which we
  # want to avoid.
  deny @{PROC}/1/environ r,

  include if exists <abstractions/common/systemd.d>

# vim:syntax=apparmor
