  profile tt-rss flags=(attach_disconnected) {
    include <abstractions/php-fpm>

    /var/log/tt-rss/tt-rss.log wlk,

    /srv/www/vhosts/tt-rss/public/ r,
    /srv/www/vhosts/tt-rss/public/** r,
    /srv/www/vhosts/tt-rss/public/config/config.php k,

    owner /srv/www/vhosts/tt-rss/public/feed-icons/** rwlk,
    owner /srv/www/vhosts/tt-rss/public/cache/feed-icons/** rwlk,
    owner /srv/www/vhosts/tt-rss/public/lock/* rwlk,

    owner /srv/www/vhosts/tt-rss/data/** rwlk,
    owner /srv/www/vhosts/tt-rss/tmp/** rwlk,
    owner /srv/www/vhosts/tt-rss/sessions/ r,
    owner /srv/www/vhosts/tt-rss/sessions/** rwlk,

    ###
    # include snippets provides e.g. by plugin directories
    #
    # We use the directory layout for abstraction includes in AppArmor 3
    #
    include if exists <php-fpm.d/tt-rss.d>
    #
    # allow admins to add snippets as well.
    #
    include if exists <local/php-fpm.d/tt-rss.d>
    #
    ###
  }
