# /etc/apparmor.d/vesperprofiled
# AppArmor MAC profile for the vesperprofiled daemon.
# Installed by the vesperprofiled Debian package.

#include <tunables/global>

/usr/sbin/vesperprofiled {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # D-Bus (system bus access)
  #include <abstractions/dbus-strict>

  # Own binary
  /usr/sbin/vesperprofiled mr,

  # ── Profile store ─────────────────────────────────────────────────────────
  /var/lib/vesperprofiled/           rw,
  /var/lib/vesperprofiled/**         rw,

  # ── Config directories (profile drop-ins written here) ───────────────────
  /etc/vesperprofiled/               rw,
  /etc/vesperprofiled/**             rw,
  /etc/NetworkManager/conf.d/        rw,
  /etc/NetworkManager/conf.d/**      rw,
  /etc/NetworkManager/system-connections/ rw,
  /etc/NetworkManager/system-connections/** rw,
  /etc/apt/apt.conf.d/               rw,
  /etc/apt/apt.conf.d/**             rw,
  /etc/cloud/cloud.cfg.d/            rw,
  /etc/cloud/cloud.cfg.d/**          rw,
  /etc/systemd/timesyncd.conf.d/     rw,
  /etc/systemd/timesyncd.conf.d/**   rw,
  /etc/systemd/resolved.conf.d/      rw,
  /etc/systemd/resolved.conf.d/**    rw,
  /etc/security/pwquality.conf.d/    rw,
  /etc/security/pwquality.conf.d/**  rw,
  /etc/security/faillock.conf.d/     rw,
  /etc/security/faillock.conf.d/**   rw,
  /etc/nftables.d/                   rw,
  /etc/nftables.d/**                 rw,
  /etc/ldap/                         rw,
  /etc/ldap/**                       rw,
  /etc/nslcd.conf                    rw,
  /etc/profile.d/                    rw,
  /etc/profile.d/**                  rw,
  /etc/dconf/db/local.d/             rw,
  /etc/dconf/db/local.d/**           rw,
  /etc/ssl/private/vesperos/         rw,
  /etc/ssl/private/vesperos/**       rw,
  /usr/local/share/ca-certificates/vesperos/ rw,
  /usr/local/share/ca-certificates/vesperos/** rw,
  /var/lib/gnome-initial-setup/      rw,
  /var/lib/gnome-initial-setup/**    rw,

  # ── Schema (read only — owned by vesperprofiled-config-schema) ────────────
  /usr/share/vesperprofiled/schema/  r,
  /usr/share/vesperprofiled/schema/* r,

  # ── TLS / certificate paths (explicit — no abstractions/openssl on Debian) ─
  /etc/ssl/certs/                    r,
  /etc/ssl/certs/**                  r,
  /etc/ssl/openssl.cnf               r,
  /usr/lib/ssl/openssl.cnf           r,
  /usr/share/ca-certificates/        r,
  /usr/share/ca-certificates/**      r,
  /etc/vesperprofiled/profile_ca.pem r,

  # ── D-Bus service registration ────────────────────────────────────────────
  dbus (send, receive, bind)
      bus=system
      name="me.oxmc.vesperos.ProfileService",
  dbus (send)
      bus=system
      interface="org.freedesktop.DBus"
      member="RequestName",
  dbus (send)
      bus=system
      interface="org.freedesktop.NetworkManager",
  dbus (receive)
      bus=system
      interface="org.freedesktop.NetworkManager",

  # ── Executables called by payload handlers ────────────────────────────────
  /usr/sbin/update-ca-certificates  Px,
  /usr/bin/dconf                    Px,
  /usr/bin/gsettings                Px,
  /sbin/nft                         Px,
  /usr/sbin/nslcd                   Px,
  /usr/bin/pk12util                 Px,
  /bin/systemctl                    Px,
  /usr/bin/cloud-init               Px,
  # nmcli is no longer used (WiFi/Ethernet use keyfiles directly),
  # but keep read access for diagnostics
  /usr/bin/nmcli                    ix,

  # ── Network (ZTE HTTPS lookups via libcurl) ───────────────────────────────
  network inet  stream,
  network inet6 stream,
  network inet  dgram,   # DNS resolution

  # ── /proc and system info ─────────────────────────────────────────────────
  @{PROC}/@{pid}/status             r,
  @{PROC}/sys/kernel/hostname       r,
  /sys/class/dmi/id/                r,
  /sys/class/dmi/id/*               r,
  /sys/class/net/                   r,
  /sys/class/net/**                 r,
  /sys/firmware/efi/                r,
  /sys/firmware/efi/**              r,
  /sys/class/tpm/                   r,
  /etc/machine-id                   r,
  /var/lib/dbus/machine-id          r,

  # ── Logging ───────────────────────────────────────────────────────────────
  /run/systemd/journal/socket       w,
  /run/systemd/notify               w,
  /dev/log                          w,

  # ── Lock file (ZTE enrollment serialisation) ──────────────────────────────
  /run/vesperprofiled/              rw,
  /run/vesperprofiled/**            rw,

  # ── Deny sensitive paths ──────────────────────────────────────────────────
  deny /home/**                     rw,
  deny /root/**                     rw,
  deny /boot/**                     rw,
  deny network raw,
  deny network packet,
}
