/
/
/
1profile music_assistant_addon flags=(attach_disconnected,mediate_deleted) {
2 capability,
3 file,
4 signal,
5 mount,
6 umount,
7 remount,
8 network udp,
9 network tcp,
10 network dgram,
11 network stream,
12 network seqpacket,
13 network inet,
14 network inet6,
15 network netlink raw,
16 network unix dgram,
17 network unix stream,
18
19 capability setgid,
20 capability setuid,
21 capability sys_admin,
22 capability dac_read_search,
23 capability sys_nice,
24
25 /dev/* mrwkl,
26 /tmp/** mrkwl,
27
28 # Data access
29 /data/** rw,
30 /media/** rw,
31
32 # D-Bus system bus access
33 dbus send,
34 dbus receive,
35 dbus bind,
36 unix (send, receive) type=stream,
37 /run/dbus/system_bus_socket rw,
38 /var/run/dbus/system_bus_socket rw,
39
40 # docker daemon confinement requires explict allow rule for signal
41 signal (receive) set=(kill,term) peer=/usr/bin/docker,
42
43}