# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

# Read only access to journalctl binary log files

  abi <abi/4.0>,

  /etc/machine-id r,
  /var/lib/dbus/machine-id r,

  @{log}/journal/ r,
  @{log}/journal/@{hex32}/ r,
  @{log}/journal/@{hex32}/system.journal r,
  @{log}/journal/@{hex32}/system@@{hex16}-@{hex16}.journal~ r,
  @{log}/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal r,
  @{log}/journal/@{hex32}/user-@{uid}.journal r,
  @{log}/journal/@{hex32}/user-@{uid}@@{hex16}-@{hex16}.journal~ r,
  @{log}/journal/@{hex32}/user-@{uid}@@{hex32}-@{int16}-@{hex16}.journal r,

  @{log}/journal/system.journal r,
  @{log}/journal/system@@{hex16}-@{hex16}.journal~ r,
  @{log}/journal/system@@{hex32}-@{hex16}-@{hex16}.journal r,

  @{log}/journal/user-@{uid}.journal r,
  @{log}/journal/user-@{uid}@@{hex16}-@{hex16}.journal~ r,

  include if exists <abstractions/journal-read.d>

# vim:syntax=apparmor
