diff --git a/apparmor.d/profiles-a-l/aa-status b/apparmor.d/profiles-a-l/aa-status new file mode 100644 index 00000000..c167323a --- /dev/null +++ b/apparmor.d/profiles-a-l/aa-status @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/aa-status +profile aa-status @{exec_path} { + include + + capability dac_read_search, + capability sys_ptrace, + + ptrace (read), + + @{exec_path} mr, + + @{sys}/kernel/security/apparmor/profiles r, + @{sys}/module/apparmor/parameters/enabled r, + + @{PROC}/ r, + @{PROC}/@{pids}/attr/apparmor/current r, + owner @{PROC}/@{pid}/mounts r, + + include if exists +} \ No newline at end of file