fix

promtail/apparmor.txt

@@ -1,59 +1,38 @@
-include <tunables/global>
-
-# Docker overlay
-@{docker_root}=/docker/ /var/lib/docker/
-@{fs_root}=/ @{docker_root}/overlay2/*/diff/
-@{do_etc}=@{fs_root}/etc/
-@{do_opt}=@{fs_root}/opt/
-@{do_run}=@{fs_root}/{run,var/run}/
-@{do_usr}=@{fs_root}/usr/
-@{do_var}=@{fs_root}/var/
+#include <tunables/global>
 
 # Systemd Journal location
 @{journald}=/{run,var}/log/journal/{,**}
 
 profile promtail flags=(attach_disconnected,mediate_deleted) {
-  include <abstractions/base>
-  include <abstractions/bash>
+  #include <abstractions/base>
 
-  # Send signals to child services
-  signal (send) peer=@{profile_name}//*,
+  # Capabilities
+  file,
+  signal (send) set=(kill,term,int,hup,cont),
 
   # Network access
   network tcp,
   network udp,
 
   # S6-Overlay
-  /init                                   rix,
-  /bin/**                                 rix,
-  /usr/bin/**                             rix,
-  @{do_etc}/s6*/**                        r,
-  @{do_etc}/fix-attrs.d/{,**}             r,
-  @{do_etc}/cont-{init,finish}.d/{,**}    rwix,
-  @{do_etc}/services.d/{,**}              rwix,
-  @{do_run}/{s6,s6-rc*,service}/**        rix,
-  /command/**                             rix,
-  /package/**                             rix,
-  @{do_run}/{,**}                         rwk,
-  /dev/tty                                rw,
-  @{do_usr}/lib/locale/{,**}              r,
-  @{do_etc}/ssl/openssl.cnf               r,
-  @{do_etc}/{group,hosts,passwd}          r,
-  @{do_etc}/{host,nsswitch,resolv}.conf   r,
-  /dev/null                               k,
-
-  # https://github.com/hassio-addons/addon-debian-base/blob/main/base/rootfs/etc/cont-init.d/02-set-timezone.sh
-  # Wants to link /etc/localtime but apparmor sees a random hash so * it is.
-  @{do_etc}/*                             rw,
-  @{do_usr}/share/zoneinfo/{,**}          r,
+  /init ix,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /run/{,**} rwk,
+  /dev/tty rw,
 
   # Bashio
-  /usr/lib/bashio/**                      ix,
-  /tmp/**                                 rw,
+  /usr/lib/bashio/** ix,
+  /tmp/** rwk,
 
-  # Options.json & addon data
-  /data                                   r,
-  /data/**                                rw,
+  # Access to options.json and other files within your addon
+  /data/** rw,
 
   # Files needed for setup
   @{do_etc}/promtail/{,**}                rw,
@@ -61,11 +40,11 @@ profile promtail flags=(attach_disconnected,mediate_deleted) {
   /{share,ssl}/{,**}                      r,
   @{journald}                             r,
 
-  # Programs
-  /usr/bin/promtail                       cx -> promtail,
-  /usr/bin/yq                             Cx,
+  # Start new profile for service
+  /usr/bin/promtail cx -> promtail_profile,
+  /usr/bin/yq cx -> yq_profile,
 
-  profile promtail flags=(attach_disconnected,mediate_deleted) {
+profile promtail_profile flags=(attach_disconnected,mediate_deleted) {
     include <abstractions/base>
 
     # Receive signals from s6
@@ -100,7 +79,7 @@ profile promtail flags=(attach_disconnected,mediate_deleted) {
     @{do_etc}/ssl/certs/**    r,
   }
 
-  profile /usr/bin/yq flags=(attach_disconnected,mediate_deleted) {
+  profile yq_profile flags=(attach_disconnected,mediate_deleted) {
     include <abstractions/base>
 
     # Config files
@@ -113,4 +92,4 @@ profile promtail flags=(attach_disconnected,mediate_deleted) {
     @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
     /dev/null                             k,
   }
-}
+}