diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce new file mode 100644 index 00000000..502d56bf --- /dev/null +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -0,0 +1,35 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/aa-enforce @{bin}/aa-complain +profile aa-enforce @{exec_path} { + include + include + include + + capability dac_read_search, + + @{exec_path} mr, + + @{bin}/ r, + @{bin}/apparmor_parser rPx, + + /usr/share/terminfo/x/xterm-256color r, + + /etc/apparmor/logprof.conf r, + /etc/apparmor.d/{,**} rw, + + /etc/inputrc r, + + owner /snap/core[0-9]*/@{int}/etc/apparmor.d/{,**} rw, + owner /var/lib/snapd/apparmor/{,**} rw, + + owner @{PROC}/@{pid}/fd r, + + include if exists +} \ No newline at end of file