abi <abi/4.0>,

include <tunables/global>

profile tailscale /usr/bin/tailscale flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/consoles>

  /usr/bin/tailscale rm,

  deny capability dac_read_search,
  deny capability dac_override,

  /{,var/}run/tailscale/tailscaled.sock rw,
  deny /proc/*/stat r,
  owner /proc/@{pids}/{cgroup,mountinfo,mounts} r,
  deny /usr/bin/systemctl x,

  /proc/ r,
  include if exists <local/tailscale>
}

profile tailscaled /usr/sbin/tailscaled flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/ssl_certs>
  include <abstractions/nameservice-strict>

  capability sys_ptrace,
  capability net_raw,
  capability net_admin,

  network inet,
  network inet6,
  network netlink raw,

  /dev/net/tun rw,

  owner /proc/@{pids}/net/{route,unix} r,
  owner /proc/@{pids}/{cgroup,mountinfo,mounts} r,
  deny /proc/*/stat r,
  /proc/sys/net/core/somaxconn r,

  /proc/sys/net/ipv6/conf/all/disable_policy r,

  /{,var/}run/tailscale/tailscaled.sock rwl,

  /systemd/notify w,
  /run/systemd/resolve/io.systemd.Resolve rw,
  /run/dbus/system_bus_socket rw,

  /sys/devices/virtual/dmi/id/bios_vendor r,
  /sys/devices/virtual/dmi/id/sys_vendor r,
  /sys/devices/virtual/dmi/id/product_name r,
  /sys/fs/cgroup/system.slice/tailscaled.service/cpu.max r,

  deny /etc/ r,

  /usr/sbin/tailscaled rm,

  deny /proc/1/stat r,
  deny ptrace peer=unconfined,

  /var/lib/tailscale/ r,
  /var/lib/tailscale/** rwlk,

  /var/lib/tailscale/files/ r,
  /var/lib/tailscale/files/** r,
  deny /var/lib/tailscale/files/** wlk,
  include if exists <local/tailscaled>
}
