/
/
/
1#include <tunables/global>
2
3profile music_assistant_dev flags=(attach_disconnected,mediate_deleted) {
4 #include <abstractions/base>
5 #include <abstractions/dbus-strict>
6
7 capability,
8 file,
9 signal,
10 mount,
11 umount,
12 remount,
13 network udp,
14 network tcp,
15 network dgram,
16 network stream,
17 network seqpacket,
18 network inet,
19 network inet6,
20 network netlink raw,
21 network unix dgram,
22
23 capability setgid,
24 capability setuid,
25 capability sys_admin,
26 capability dac_read_search,
27
28 /dev/* mrwkl,
29 /tmp/** mrkwl,
30
31 # Data access
32 /data/** rw,
33 /media/** rw,
34
35 # D-Bus system bus access (required for shairport-sync remote control)
36 dbus bus=system,
37 unix (send, receive) type=stream addr=none peer=(label=unconfined),
38 /run/dbus/system_bus_socket rw,
39
40 # docker daemon confinement requires explict allow rule for signal
41 signal (receive) set=(kill,term) peer=/usr/bin/docker,
42
43}