apparmor.d/apparmor.d/groups/_full/systemd-service

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

# Profile for generic systemd unit services. Only used by tiny systemd services
# that start a shell or use context specific programs.

# It does not specify an attachment path because it is intended to be used only
# via "Px -> systemd-service" exec transitions from the systemd profile.

abi <abi/4.0>,

include <tunables/global>

profile systemd-service flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/nameservice-strict>

  capability chown,
  capability fsetid,

  @{bin}/ldconfig      rix,
  @{bin}/savelog       rix,
  @{bin}/systemctl     rix,
  @{bin}/gzip          rix,
  @{coreutils_path}    rix,
  @{sh_path}          rmix,

  # ifup@.service
  @{bin}/ifup          rPx,

  # shadow.service
  @{bin}/pwck          rPx,
  @{bin}/grpck         rPx,

  @{bin}/grub-editenv  rPx,
  @{bin}/ibus-daemon   rPx,

  @{bin}/* r,
  @{lib}/ r,

  /var/cache/ldconfig/{,**} rw,

  /boot/grub/grubenv rw,
  /boot/grub/ w,

  /var/log/ r,
  /var/log/dmesg rw,
  /var/log/dmesg.* rwl -> /var/log/dmesg,

  # man-db.service
  /usr/{,local/}share/man/{,**} r,
  /etc/manpath.config r,
  /var/cache/man/{,**} rwk,

  # snapd.system-shutdown.service
  @{run}/initramfs/shutdown rw,
  @{run}/initramfs/ rw,

  # cockpit.socket
  @{run}/cockpit/@{rand8} rw,
  @{run}/cockpit/motd w,

  @{PROC}/cmdline r,
  @{PROC}/sys/kernel/osrelease r,

  include if exists <usr/systemd-service.d>
  include if exists <local/systemd-service>
}

# vim:syntax=apparmor