# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# CONDITIONAL-VARIABLES

# System states
#
# Current system states. All of the variables depend on the running state and
# are thus expected to be configured by a program at runtime.
#
# All variables that depends on the running state should be uppercase.
#
# !!! warning
#
#     It is currently a work in progress and only enabled on abi 5.
#

# Apparmor version
# ----------------

# AppArmor ABI
@{ABI} = 5

# AppArmor version
@{VERSION} = 5


# Security Features
# -----------------

# The targeted security level of the system. These are experimental and subject to change.
# Supported values are:
# - 0: default
# - 1: strict
# - 2: fsp
# - 3: extreme
#
# See https://apparmor.pujol.io/security/architecture/#security-levels
@{LEVEL} = 0

# Either or not role-based access control is enabled on the system.
# Supported values are: true, false
#${RBAC} = false

# Either or not Full system policies is enabled on the system.
# If enabled, @{LEVEL} should be set to 2 or higher.
# Supported values are: true, false
#${FSP} = false

# Either or not the system is running in test mode.
# Supported values are: true, false
# ${TEST} = false


# Distribution information
# ------------------------

# The OS family. Supported family values are: apt, pacman, zypper, dnf
# It is a preferred way to check for the distribution.
@{OS_FAMILY} = pacman

# The OS ID. It is the value of the ID field in /etc/os-release.
@{OS_ID} = arch

# The OS version. It is the value of the VERSION_ID field in /etc/os-release.
@{OS_VERSION_ID} = rolling


# SYSTEM
# ------

# The list of GPU vendors. Only nvidia matters as it is the only one non standard.
# Supported values are: nvidia, amd, intel, none
@{GPU} = nvidia

# Type of virtualized environment.
# Supported values are: vm, container, none
@{VIRT} = none

# System architecture
# Supported values are: amd64, arm64, arm, 386, riscv64, ppc64le, s390x
@{ARCH} = amd64

# The system hostname
# @{HOSTNAME} = tbd


# Desktop
# -------

# The list of desktop environments installed on the system.
# Supported values are: gnome, kde, xfce, cosmic, none
@{DE} = gnome

# The list of display managers installed on the system.
# Supported values are: gdm, sddm, lightdm, none
@{DM} = gdm

# The display server in use.
# Supported values are: wayland, x11, none
@{DS} = wayland


# Sysctl
# ------
#
# Provide variables for some of the sysctl settings.
#
# All variables that refer to a sysctl config should have the `sysctl_` prefix.
#
# !!! warning
#
#     **It is experimental**, both variables and values may be automatically set
#     set in the future.
#

#${sysctl_kernel_unprivileged_userns_clone} = true

include if exists <tunables/multiarch.d/state.d>

# vim:syntax=apparmor
