# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/dracut
@{att} = ""
profile dracut /{,usr/}bin/dracut {
  include <abstractions/base-strict>
  include <abstractions/consoles>
  include <abstractions/disks-read>

  @{exec_path} mrix,

  @{sh_path}                  rix,
  @{archive_path}             rix,
  @{coreutils_path}           rix,
  @{ldd_path}                  cx -> ldd,
  @{bin}/3cpio                rix,
  @{bin}/findmnt               px,
  @{bin}/getopt               rix,
  @{bin}/hardlink             rix,
  @{bin}/kmod                  cx -> kmod,
  @{bin}/sync                 rix,
  @{bin}/systemctl             cx -> systemctl,
  @{bin}/systemd-detect-virt   px,
  @{bin}/systemd-escape        px,
  @{bin}/udevadm               px,
  @{sbin}/blkid                px,
  @{sbin}/ldconfig            rix,
  @{lib}/plymouth/plymouth-populate-initrd pux,

  @{lib}/dracut/dracut-util    rix,
  @{lib}/dracut/dracut-install px,

  @{lib}/dracut/{,**} r,

  @{bin}/ r,
  @{sbin}/ r,

  /etc/depmod.d/ r,
  /etc/depmod.d/*.conf r,
  /etc/dracut.conf r,
  /etc/dracut.conf.d/{,**} r,
  /etc/machine-id r,
  /etc/modprobe.d/{,**} r,
  @{lib}/modprobe.d/{,**} r,

  /var/tmp/dracut.@{rand6}/{,**} rwl,

  @{sys}/module/firmware_class/parameters/path r,

  @{PROC}/@{pid}/fd/ r,

  profile systemctl {
    include <abstractions/base-strict>
    include <abstractions/app/systemctl>

    include if exists <local/dracut_systemctl>
  }

  profile kmod {
    include <abstractions/base-strict>
    include <abstractions/app/kmod>

    @{sys}/module/compression r,

    include if exists <local/dracut_kmod>
  }

  profile ldd {
    include <abstractions/base-strict>
    include <abstractions/consoles>
    include <abstractions/nameservice-strict>

    @{ldd_path}  mrix,

    @{bin}/* mr,
    @{sbin}/* mr,
    @{lib}/**  mr,

    include if exists <local/dracut_ldd>
  }

  include if exists <local/dracut>
}

# vim:syntax=apparmor
