# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022-2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

# Read access to all disks.

  abi <abi/4.0>,

  # CD-ROM
  include <abstractions/dev/read/cdrom>
  include <abstractions/udev/cdrom>

  # Device mappers (LUKS/LVM)
  include <abstractions/dev/read/dm>
  include <abstractions/sys/dm>

  # Floppy disks
  include <abstractions/dev/read/floppy>
  include <abstractions/sys/floppy>
  include <abstractions/udev/floppy>

  # Loop devices
  include <abstractions/dev/read/loop>
  include <abstractions/sys/loop>
  include <abstractions/udev/loop>

  # MD RAID devices
  include <abstractions/dev/read/md>
  include <abstractions/sys/md>
  include <abstractions/udev/md>

  # SD card devices
  include <abstractions/dev/read/mmc>
  include <abstractions/sys/mmc>
  include <abstractions/udev/mmc>

  # NBD devices
  include <abstractions/dev/read/nbd>
  include <abstractions/sys/nbd>
  include <abstractions/udev/nbd>

  # SSD Nvme devices
  include <abstractions/sys/nvme>
  include <abstractions/dev/read/nvme>

  # Regular disk/partition devices
  include <abstractions/dev/read/sd>
  include <abstractions/sys/sd>
  include <abstractions/udev/sd>
  include <abstractions/udev/usb>

  # ZFS devices
  include <abstractions/dev/read/zfs>
  include <abstractions/sys/zfs>
  include <abstractions/udev/zfs>

  # ZRAM devices
  include <abstractions/dev/read/zram>
  include <abstractions/sys/zram>

  # Lookup block device by major:minor numbers
  # See: https://apparmor.pujol.io/development/internal/#udev-rules

  @{run}/udev/data/b24[0-9]:@{int} r, # for dynamic assignment range 240
  @{run}/udev/data/b25[0-4]:@{int} r, #                           to 254
  @{run}/udev/data/b259:@{int} r,     # Block Extended Major

  @{sys}/block/ r,
  @{sys}/class/block/ r,
  @{sys}/class/iscsi_session/ r,
  @{sys}/dev/block/ r,

  # Xen PVH devices
  @{sys}/devices/vbd-@{int}/block/** r,

  # Channel subsystem for IBM Z
  @{sys}/devices/css@{int}/** r,

  /dev/ r,
  /dev/block/ r,
  /dev/disk/{,*/} r,

  include if exists <abstractions/disks-read.d>

# vim:syntax=apparmor
