# /etc/apparmor.d/pawletprofiled
# AppArmor MAC profile for the pawletprofiled daemon.
# Installed by the pawletprofiled Debian package.

#include <tunables/global>

/usr/sbin/pawletprofiled {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # D-Bus (system bus access)
  #include <abstractions/dbus-strict>

  # Own binary
  /usr/sbin/pawletprofiled mr,

  # ── Profile store ─────────────────────────────────────────────────────────
  /var/lib/pawletprofiled/           rw,
  /var/lib/pawletprofiled/**         rw,

  # ── Config directories (profile drop-ins written here) ───────────────────
  /etc/pawletprofiled/               rw,
  /etc/pawletprofiled/**             rw,
  /etc/NetworkManager/conf.d/        rw,
  /etc/NetworkManager/conf.d/**      rw,
  /etc/NetworkManager/system-connections/ rw,
  /etc/NetworkManager/system-connections/** rw,
  /etc/apt/apt.conf.d/               rw,
  /etc/apt/apt.conf.d/**             rw,
  /etc/cloud/cloud.cfg.d/            rw,
  /etc/cloud/cloud.cfg.d/**          rw,
  /etc/systemd/timesyncd.conf.d/     rw,
  /etc/systemd/timesyncd.conf.d/**   rw,
  /etc/systemd/resolved.conf.d/      rw,
  /etc/systemd/resolved.conf.d/**    rw,
  /etc/security/pwquality.conf.d/    rw,
  /etc/security/pwquality.conf.d/**  rw,
  /etc/security/faillock.conf.d/     rw,
  /etc/security/faillock.conf.d/**   rw,
  /etc/nftables.d/                   rw,
  /etc/nftables.d/**                 rw,
  /etc/ldap/                         rw,
  /etc/ldap/**                       rw,
  /etc/nslcd.conf                    rw,
  /etc/profile.d/                    rw,
  /etc/profile.d/**                  rw,
  /etc/dconf/db/local.d/             rw,
  /etc/dconf/db/local.d/**           rw,
  /etc/ssl/private/pawletos/         rw,
  /etc/ssl/private/pawletos/**       rw,
  /usr/local/share/ca-certificates/pawletos/ rw,
  /usr/local/share/ca-certificates/pawletos/** rw,
  /var/lib/gnome-initial-setup/      rw,
  /var/lib/gnome-initial-setup/**    rw,

  # ── Schema (read only — owned by pawletprofiled-config-schema) ────────────
  /usr/share/pawletprofiled/schema/  r,
  /usr/share/pawletprofiled/schema/* r,

  # ── TLS / certificate paths (explicit — no abstractions/openssl on Debian) ─
  /etc/ssl/certs/                    r,
  /etc/ssl/certs/**                  r,
  /etc/ssl/openssl.cnf               r,
  /usr/lib/ssl/openssl.cnf           r,
  /usr/share/ca-certificates/        r,
  /usr/share/ca-certificates/**      r,
  /etc/pawletprofiled/profile_ca.pem r,

  # ── D-Bus service registration ────────────────────────────────────────────
  dbus (send, receive, bind)
      bus=system
      name="os.pawlet.ProfiledService",
  dbus (send)
      bus=system
      interface="org.freedesktop.DBus"
      member="RequestName",
  dbus (send)
      bus=system
      interface="org.freedesktop.NetworkManager",
  dbus (receive)
      bus=system
      interface="org.freedesktop.NetworkManager",

  # ── Executables called by payload handlers ────────────────────────────────
  /usr/sbin/update-ca-certificates  Px,
  /usr/bin/dconf                    Px,
  /usr/bin/gsettings                Px,
  /sbin/nft                         Px,
  /usr/sbin/nslcd                   Px,
  /usr/bin/pk12util                 Px,
  /bin/systemctl                    Px,
  /usr/bin/cloud-init               Px,
  # nmcli is no longer used (WiFi/Ethernet use keyfiles directly),
  # but keep read access for diagnostics
  /usr/bin/nmcli                    ix,

  # ── Network (ZTE HTTPS lookups via libcurl) ───────────────────────────────
  network inet  stream,
  network inet6 stream,
  network inet  dgram,   # DNS resolution

  # ── /proc and system info ─────────────────────────────────────────────────
  @{PROC}/@{pid}/status             r,
  @{PROC}/sys/kernel/hostname       r,
  /sys/class/dmi/id/                r,
  /sys/class/dmi/id/*               r,
  /sys/class/net/                   r,
  /sys/class/net/**                 r,
  /sys/firmware/efi/                r,
  /sys/firmware/efi/**              r,
  /sys/class/tpm/                   r,
  /etc/machine-id                   r,
  /var/lib/dbus/machine-id          r,

  # ── Logging ───────────────────────────────────────────────────────────────
  /run/systemd/journal/socket       w,
  /run/systemd/notify               w,
  /dev/log                          w,

  # ── Lock file (ZTE enrollment serialisation) ──────────────────────────────
  /run/pawletprofiled/              rw,
  /run/pawletprofiled/**            rw,

  # ── Deny sensitive paths ──────────────────────────────────────────────────
  deny /home/**                     rw,
  deny /root/**                     rw,
  deny /boot/**                     rw,
  deny network raw,
  deny network packet,
}