From cecd0a6284c1fb220730eab813df5de86330d759 Mon Sep 17 00:00:00 2001
From: EricLin0509 <ericlin050914@gmail.com>
Date: Fri, 23 Aug 2024 22:53:56 +0800
Subject: [PATCH] initial support for ufw

---
 apparmor.d/profiles-s-z/sysctl |  2 ++
 apparmor.d/profiles-s-z/ufw    | 57 ++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100644 apparmor.d/profiles-s-z/ufw

diff --git a/apparmor.d/profiles-s-z/sysctl b/apparmor.d/profiles-s-z/sysctl
index 4e50430b..02964dd7 100644
--- a/apparmor.d/profiles-s-z/sysctl
+++ b/apparmor.d/profiles-s-z/sysctl
@@ -30,6 +30,8 @@ profile sysctl @{exec_path} {
   deny network inet6 stream,
   deny network inet stream,
 
+  /etc/ufw/sysctl.conf r, # Add support for ufw
+
   include if exists <local/sysctl>
 }
 
diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw
new file mode 100644
index 00000000..63352e65
--- /dev/null
+++ b/apparmor.d/profiles-s-z/ufw
@@ -0,0 +1,57 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 EricLin
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/ufw
+profile ufw @{exec_path} {
+
+    include <abstractions/base>
+
+    capability dac_read_search,
+    capability net_admin,
+
+    network netlink raw,
+    network inet dgram,
+    network inet6 dgram,
+
+    @{exec_path} mr,
+
+    @{bin}/ r,
+    @{bin}/python3* ix,
+    @{bin}/cat ix,
+    @{bin}/xtables-nft-multi ix,
+
+    @{lib}/ufw/ufw-init ix,
+
+    @{PROC}/@{pid}/stat r,
+    @{PROC}/@{pid}/fd/ r,
+    @{PROC}/@{pid}/net/ip_tables_names r,
+
+    owner @{bin}/env r,
+
+    /etc/ufw/{,**} rwk,
+
+    /etc/default/ufw r,
+
+    /run/ufw.lock wk,
+
+    /etc/gai.conf r,
+    /etc/nsswitch.conf r,
+    /etc/passwd r,
+    /etc/services r,
+
+    /var/tmp/* rw,
+    /tmp/* rw,
+
+    /dev/pts/[0-9]* rw,
+    /dev/tty rw, 
+
+    include if exists <local/ufw>
+
+}
+
+# vim:syntax=apparmor