/
/
/
1profile music_assistant_addon flags=(attach_disconnected,mediate_deleted) {
2 capability,
3 file,
4 signal,
5 mount,
6 umount,
7 remount,
8 network udp,
9 network tcp,
10 network dgram,
11 network stream,
12 network seqpacket,
13 network inet,
14 network inet6,
15 network netlink raw,
16 network unix dgram,
17 network unix stream,
18
19 capability setgid,
20 capability setuid,
21 capability sys_admin,
22 capability dac_read_search,
23
24 /dev/* mrwkl,
25 /tmp/** mrkwl,
26
27 # Data access
28 /data/** rw,
29 /media/** rw,
30
31 # D-Bus system bus access - Allow ALL D-Bus operations
32 dbus,
33
34 # Unix sockets for D-Bus
35 unix,
36
37 # D-Bus socket access
38 /run/dbus/** rw,
39 /var/run/dbus/** rw,
40
41 # docker daemon confinement requires explict allow rule for signal
42 signal (receive) set=(kill,term) peer=/usr/bin/docker,
43
44}