# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/hugeadm
@{att} = ""
profile hugeadm /{,usr/}bin/hugeadm flags=(complain) {
  include <abstractions/base-strict>
  include <abstractions/nameservice-strict>

  # To mount anything under /var/lib/hugetlbfs/** .
  capability sys_admin,

  # For chown on the /var/lib/hugetlbfs/ dir and subdirs.
  capability chown,

  # For chmod on the /var/lib/hugetlbfs/ dir and subdirs.
  capability fowner,

  # For setting the set-group-ID bit on the /var/lib/hugetlbfs/group/*/ dirs.
  capability fsetid,

  # To create /var/lib/hugetlbfs/user/*/pagesize-*/ subdir because the /var/lib/hugetlbfs/user/*/
  # parent dir is owned by a different user than root with the "drwx------" permissions.
  capability dac_read_search,
  capability dac_override,

  @{exec_path} mr,

  mount fstype=hugetlbfs -> /var/lib/hugetlbfs/pagesize-*/,
  mount fstype=hugetlbfs -> /var/lib/hugetlbfs/{user,group}/*/pagesize-*/,
  mount fstype=hugetlbfs -> /var/lib/hugetlbfs/global/pagesize-*/,

  /var/lib/hugetlbfs/ w,
  /var/lib/hugetlbfs/pagesize-*/ w,
  /var/lib/hugetlbfs/{user,group}/ w,
  /var/lib/hugetlbfs/{user,group}/*/ w,
  /var/lib/hugetlbfs/{user,group}/*/pagesize-*/ w,
  /var/lib/hugetlbfs/global/ w,
  /var/lib/hugetlbfs/global/pagesize-*/ w,

        @{PROC}/zoneinfo r,
  owner @{PROC}/@{pid}/mounts r,
        @{PROC}/sys/vm/nr_overcommit_hugepages r,
  # For the "--set-recommended-min_free_kbytes" parameter.
  owner @{PROC}/sys/vm/min_free_kbytes w,
  # For the "--set-recommended-shmmax" parameter.
  owner @{PROC}/sys/kernel/shmmax w,
  # For the "--set-shm-group" parameter.
  owner @{PROC}/sys/vm/hugetlb_shm_group w,

        @{sys}/kernel/mm/hugepages/ r,
        @{sys}/kernel/mm/transparent_hugepage/* r,
  owner @{sys}/kernel/mm/transparent_hugepage/* rw,

  include if exists <local/hugeadm>
}

# vim:syntax=apparmor
