From 9e71a10822db1d8ce399ac85c1d6c13863987be0 Mon Sep 17 00:00:00 2001
From: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Date: Mon, 19 Dec 2016 16:21:01 +0100
Subject: * add and install apparmor profiles

  - d/rules install AppArmor profiles
  - d/control add dh-apparmor build-dep
  - d/usr.lib.ipsec.{charon, lookip, stroke} add latest AppArmor profiles
    for charon, lookip and stroke

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
---
 debian/usr.lib.ipsec.stroke | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 debian/usr.lib.ipsec.stroke

(limited to 'debian/usr.lib.ipsec.stroke')

diff --git a/debian/usr.lib.ipsec.stroke b/debian/usr.lib.ipsec.stroke
new file mode 100644
index 000000000..9d20ee7c9
--- /dev/null
+++ b/debian/usr.lib.ipsec.stroke
@@ -0,0 +1,28 @@
+# ------------------------------------------------------------------
+#
+#   Copyright (C) 2014 Canonical Ltd.
+#
+#   This program is free software; you can redistribute it and/or
+#   modify it under the terms of version 2 of the GNU General Public
+#   License published by the Free Software Foundation.
+#
+#   Author: Jonathan Davies <jonathan.davies@canonical.com>
+#
+# ------------------------------------------------------------------
+
+#include <tunables/global>
+
+/usr/lib/ipsec/stroke flags=(attach_disconnected) {
+  #include <abstractions/base>
+
+  capability dac_override,
+
+  /etc/strongswan.conf          r,
+  /etc/strongswan.d/            r,
+  /etc/strongswan.d/**          r,
+
+  /run/charon.ctl               rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.lib.ipsec.stroke>
+}
-- 
cgit v1.2.3