# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = /etc/init.d/exim4
@{att} = ""
profile init-exim4 /etc/init.d/exim4 {
  include <abstractions/base-strict>
  include <abstractions/nameservice-strict>

  capability chown,
  capability dac_read_search,
  capability fowner,
  capability fsetid,
  capability kill,
  capability net_admin,
  capability sys_ptrace,

  signal send peer=exim4,

  ptrace read peer=exim4,

  @{exec_path} mr,

  @{bin}/cat                 rix,
  @{bin}/chmod               rix,
  @{bin}/chown               rix,
  @{bin}/dirname             rix,
  @{bin}/getopt              rix,
  @{bin}/{,e}grep            rix,
  @{bin}/id                  rix,
  @{bin}/install             rix,
  @{bin}/mv                  rix,
  @{bin}/plymouth            rpx,
  @{bin}/rm                  rix,
  @{bin}/run-parts           rix,
  @{bin}/sed                 rix,
  @{bin}/systemctl           rcx -> systemctl,
  @{bin}/touch               rix,
  @{bin}/tr                  rix,
  @{sbin}/exim4              rpx,
  @{sbin}/start-stop-daemon  rix,
  @{sbin}/update-exim4.conf  rix,

  /etc/default/exim4 r,
  /etc/exim4/* r,
  /etc/mailname r,

  owner /var/lib/exim4/* rw,

  owner @{run}/exim4/{,**} rw,

  profile systemctl {
    include <abstractions/base-strict>
    include <abstractions/app/systemctl>

    include if exists <local/init-exim4_systemctl>
  }

  include if exists <local/init-exim4>
}

# vim:syntax=apparmor
