mirror of
https://github.com/oxen-io/lokinet.git
synced 2024-11-19 09:25:28 +00:00
da2c979936
add nameservice abstraction
give profile a name
allow to read conf, tmp files, etc.
remove /lib/@{multiarch}/ld-*.so mr, already covered by abstractions/base
allow local additions
28 lines
634 B
Plaintext
28 lines
634 B
Plaintext
# Last Modified: Fri 05 Feb 2021 08:13:58 PM UTC
|
|
#include <tunables/global>
|
|
|
|
profile lokinet /usr/bin/lokinet {
|
|
#include <abstractions/base>
|
|
#include <abstractions/nameservice>
|
|
|
|
capability net_admin,
|
|
capability net_bind_service,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network netlink raw,
|
|
|
|
/etc/loki/lokinet.ini r,
|
|
/dev/net/tun rw,
|
|
/usr/bin/lokinet mr,
|
|
|
|
owner /{var/,}lib/lokinet/ rw,
|
|
owner /{var/,}lib/lokinet/** rwk,
|
|
owner ${HOME}/.lokinet/ rw,
|
|
owner ${HOME}/.lokinet/** rwk,
|
|
owner @{PROC}/@{pid}/task/@{pid}/comm rw,
|
|
owner /tmp/lokinet.*/{**,} rw,
|
|
|
|
#include if exists <local/usr.bin.lokinet>
|
|
}
|