/
/
/
1profile music_assistant_addon flags=(attach_disconnected,mediate_deleted) {
2 #include <abstractions/base>
3
4 capability,
5 file,
6 signal (send) set=(kill,term,int,hup,cont),
7
8 # Network access
9 network inet stream,
10 network inet dgram,
11 network inet6 stream,
12 network inet6 dgram,
13 network netlink raw,
14 network unix dgram,
15 network unix stream,
16
17 capability setgid,
18 capability setuid,
19 capability sys_admin,
20 capability dac_read_search,
21 capability sys_nice,
22
23 # Basic file access
24 /dev/* mrwkl,
25 /tmp/** mrkwl,
26 /proc/* r,
27 /sys/bus/ r,
28 /sys/class/ r,
29
30 # Data access
31 /data/** rw,
32 /media/** rw,
33
34 # D-Bus access (following Home Assistant supervisor pattern)
35 #include <abstractions/dbus>
36 unix (send, receive) type=stream,
37 /run/dbus/system_bus_socket rw,
38 /var/run/dbus/system_bus_socket rw,
39
40 # docker daemon confinement requires explict allow rule for signal
41 signal (receive) set=(kill,term) peer=/usr/bin/docker,
42
43}