# This AppArmor profile is part of the prometheus-nginx_exporter package
# Georg Pfuetzenreuter <mail+apparmor@georg-pfuetzenreuter.net>

abi <abi/3.0>,

include <tunables/global>

# TODO: switch to ...disconnected_path=... after updating to AppArmor 4.1
# profile nginx_exporter /usr/bin/nginx_exporter flags=(attach_disconnected.path=/att/nginx_exporter/) {
profile nginx_exporter /usr/bin/nginx_exporter flags=(attach_disconnected) {
  include <abstractions/base>

  network inet stream,
  network inet6 stream,

  owner /proc/@{pid}/{cgroup,limits,mountinfo,stat} r,

# /att/nginx_exporter/run/nginx/status.sock w,
  /run/nginx/status.sock w,  # disconnected path

  /usr/bin/nginx_exporter mr,

  include if exists <local/prometheus-nginx_exporter>
}
