# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{sbin}/visudo @{bin}/visudo-rs
@{att} = /att/visudo/
profile visudo /{{,usr/}{,s}bin/visudo,{,usr/}bin/visudo-rs} flags=(attach_disconnected,attach_disconnected.path=@{att},complain) {
  include <abstractions/attached/base>
  include <abstractions/attached/consoles>
  include <abstractions/attached/nameservice-strict>

  capability dac_override,
  capability dac_read_search,
  capability setuid,
  capability setgid,

  @{exec_path} mr,

  @{bin}/vi          rpux,
  @{bin}/vim         rpux,
  @{bin}/nano        rpux,
  @{bin}/emacs       rpux,

  @{etc_ro}/sudoers r,
  @{etc_ro}/sudoers.d/{,*} r,
  /etc/sudoers.tmp rw,
  /etc/sudoers.d/ rw,

  owner @{tmp}/visudo-* rw,

  include if exists <local/visudo>
}

# vim:syntax=apparmor
