#include <tunables/global>
/usr/{bin,sbin}/avahi-daemon {
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/dbus>
  #include <abstractions/nameservice>

  capability chown,
  capability dac_override,
  capability kill,
  capability setuid,
  capability setgid,
  capability sys_chroot,

  network netlink dgram,

  /etc/avahi/ r,
  /etc/avahi/avahi-daemon.conf r,
  /etc/avahi/hosts r,
  /etc/avahi/services/ r,
  /etc/avahi/services/*.service r,
  @{PROC}/@{pid}/fd/ r,
  /usr/{bin,sbin}/avahi-daemon mr,
  /usr/share/avahi/introspection/*.introspect r,
  /usr/share/dbus-1/interfaces/org.freedesktop.Avahi.*.xml r,
  /{,var/}run/avahi-daemon/ w,
  /{,var/}run/avahi-daemon/pid krw,
  /{,var/}run/avahi-daemon/socket w,
  /{,var/}run/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.sbin.avahi-daemon>
}