# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{lib}/cni/calico /opt/cni/bin/calico
@{att} = /att/cni-calico/
profile cni-calico /{{,usr/}lib{,exec,32,64}/cni/calico,opt/cni/bin/calico}  flags=(attach_disconnected,attach_disconnected.path=@{att},complain) {
  include <abstractions/attached/base>
  include <abstractions/mime>

  capability sys_admin,
  capability net_admin,

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network netlink raw,

  signal (receive) set=kill peer=containerd,

  @{exec_path} mr,
  @{exec_path}-ipam rix,

  / r,

  /etc/cni/net.d/{,**}  r,

  /var/lib/calico/{,**} r,
  /var/log/calico/cni/ r,
  /var/log/calico/cni/*.log rw,

  @{run}/calico/ rw,
  @{run}/calico/ipam.lock rwk,
  @{run}/netns/cni-@{uuid} r,

  @{PROC}/sys/net/ipv{4,6}/ip_forward rw,
  @{PROC}/sys/net/ipv{4,6}/{conf,neigh}/cali[0-9a-z]*/* rw,

  include if exists <local/cni-calico>
}

# vim:syntax=apparmor
