#include <tunables/global>

# Ubuntu also installs GNU-prefixed and Rust coreutils at these exact paths.
@{northlink_coreutil_dirs} = /bin/ /usr/bin/ /usr/bin/gnu /usr/lib/cargo/bin/coreutils/

profile northlink-wg-quick /usr/lib/northlink/northlink-wg-quick {
  include <abstractions/base>
  include <abstractions/consoles>

  capability net_admin,
  network netlink raw,

  /usr/lib/northlink/northlink-wg-quick mr,
  /{,usr/}bin/{sh,bash,dash,wg-quick,ip,wg,grep,sed} mrix,
  @{northlink_coreutil_dirs}{cat,chmod,cut,dirname,head,mkdir,mv,readlink,rm,sort,stat,tail,tr,uname} mrix,
  /usr/sbin/{nft,sysctl} mrix,

  /sys/module/apparmor/parameters/enabled r,
  owner @{PROC}/@{pid}/attr/current r,
  owner /run/northlink/private/wireguard/nlk0.conf r,
  /proc/sys/net/ipv4/conf/all/src_valid_mark w,
  /etc/{nsswitch.conf,passwd} r,
  /usr/share/iproute2/rt_tables r,
  owner @{PROC}/@{pid}/cgroup r,
}
