Merge pull request #2784 from alexbelgium/claude/triage-hassio-addons-issues-ssmjik

Fix AppArmor profiles: add capability sys_chroot and fix profile name collisions

addons_updater/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile addon_updater flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   # Capabilities
   file,

arpspoof/apparmor.txt

@@ -9,6 +9,7 @@ profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

aurral/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile aurral flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   file,
   signal (send) set=(kill,term,int,hup,cont),

autobrr/apparmor.txt

@@ -9,6 +9,7 @@ profile autobrr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

baikal/apparmor.txt

@@ -9,6 +9,7 @@ profile baikal_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

battybirdnet-pi/apparmor.txt

@@ -9,6 +9,7 @@ profile battybirdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

bazarr/apparmor.txt

@@ -10,6 +10,7 @@ profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

bentopdf/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile bentopdf flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   # Capabilities
   file,

binance-trading-bot/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_binance-trading-bot flags=(attach_disconnected,mediate_deleted)
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

birdnet-go/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_birdnet-go flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_resource,
   file,

birdnet-pi/apparmor.txt

@@ -9,6 +9,7 @@ profile birdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

birdnet-pipy/apparmor.txt

@@ -8,6 +8,7 @@ profile birdnet-pipy_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

bitwarden/apparmor.txt

@@ -8,6 +8,7 @@ profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

booksonic_air/apparmor.txt

@@ -9,6 +9,7 @@ profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

browser_brave/apparmor.txt

@@ -1 +0,0 @@
-../browser_chromium/apparmor.txt

browser_brave/apparmor.txt

@@ -0,0 +1,72 @@
+#include <tunables/global>
+
+profile browser_brave_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_admin,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+
+# S6-Overlay
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /run/{,**} rwk,
+  /dev/tty rw,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+  # Files required
+  /dev/fuse mrwkl,
+  /dev/sda1 mrwkl,
+  /dev/sdb1 mrwkl,
+  /dev/nvme0 mrwkl,
+  /dev/nvme0n1 mrwkl,
+  /dev/nvme1 mrwkl,
+  /dev/mmcblk0p1 mrwkl,
+  /dev/* mrwkl,
+  /udev/* mrwkl,
+  /tmp/** mrkwl,
+  /dev/fuse/** mrkwl,
+  /dev/** mrkwl,
+  /sys/firmware/** mrkwl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

browser_chromium/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
+profile browser_chromium_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

browserless_chrome/apparmor.txt

@@ -9,6 +9,7 @@ profile browserlesschrome_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

calibre/apparmor.txt

@@ -10,6 +10,7 @@ profile calibre_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

calibre_web/apparmor.txt

@@ -10,6 +10,7 @@ profile calibre-web_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

changedetection.io/apparmor.txt

@@ -8,6 +8,7 @@ profile addon_db21ed7f_changedetection.io_nas flags=(attach_disconnected,mediate
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

cleanuparr/apparmor.txt

@@ -8,6 +8,7 @@ profile cleanuparr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

cloudcommander/apparmor.txt

@@ -9,6 +9,7 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

codex/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_codex flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

collabora/apparmor.txt

@@ -8,6 +8,7 @@ profile collabora_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

comixed/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile comixed_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

emby/apparmor.txt

@@ -9,6 +9,7 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

emby_beta/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
+profile emby_beta_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

enedisgateway2mqtt/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile enedisgateway2mqtt_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

enedisgateway2mqtt_dev/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile enedisgateway2mqtt_dev_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

ente/apparmor.txt

@@ -9,6 +9,7 @@ profile ente_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

epicgamesfree/apparmor.txt

@@ -8,6 +8,7 @@ profile epicgamesfree_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

filebrowser/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile filebrowser_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

filebrowser_quantum/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile filebrowser_quantum_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

fireflyiii/apparmor.txt

@@ -8,6 +8,7 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

fireflyiii_data_importer/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
+profile fireflyiii_data_importer_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

fireflyiii_fints_importer/apparmor.txt

@@ -8,6 +8,7 @@ profile fireflyiii_fints_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

flaresolverr/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile joplin flags=(attach_disconnected,mediate_deleted) {
+profile flaresolverr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

flexget/apparmor.txt

@@ -8,6 +8,7 @@ profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

free_games_claimer/apparmor.txt

@@ -8,6 +8,7 @@ profile free_games_claimer_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

gazpar2mqtt/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile gazpar2mqtt_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

grampsweb/apparmor.txt

@@ -8,6 +8,7 @@ profile grampsweb_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

grav/apparmor.txt

@@ -8,6 +8,7 @@ profile grav_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

guacamole/apparmor.txt

@@ -8,6 +8,7 @@ profile guacamole_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

immich/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile immich_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

immich_frame/apparmor.txt

@@ -8,6 +8,7 @@ profile db21ed7f_immich_frame flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

immich_power_tools/apparmor.txt

@@ -8,6 +8,7 @@ profile db21ed7f_immich_power_tools flags=(attach_disconnected,mediate_deleted)
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

inadyn/apparmor.txt

@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

jackett/apparmor.txt

@@ -9,6 +9,7 @@ profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

jellyfin/apparmor.txt

@@ -10,6 +10,7 @@ profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted)
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

joal/apparmor.txt

@@ -8,6 +8,7 @@ profile joal_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

joplin/apparmor.txt

@@ -8,6 +8,7 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_time,
   file,
   signal,

kometa/apparmor.txt

@@ -9,6 +9,7 @@ profile kometa_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

librespeed/apparmor.txt

@@ -8,6 +8,7 @@ profile librespeed_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

lidarr/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
+profile lidarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

linkwarden/apparmor.txt

@@ -8,6 +8,7 @@ profile linkwarden_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

maintainerr/apparmor.txt

@@ -8,6 +8,7 @@ profile maintainerr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

manyfold/apparmor.txt

@@ -15,6 +15,7 @@ profile hassio-addons/manyfold flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
 
   deny /proc/kcore rwklx,
   deny /proc/sysrq-trigger rwklx,

mealie/apparmor.txt

@@ -8,6 +8,7 @@ profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

monica/apparmor.txt

@@ -8,6 +8,7 @@ profile monica_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

mylar3/apparmor.txt

@@ -9,6 +9,7 @@ profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

navidrome/apparmor.txt

@@ -9,6 +9,7 @@ profile navidrome_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

netalertx/apparmor.txt

@@ -10,6 +10,7 @@ profile netalertx_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_raw,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

nextcloud/apparmor.txt

@@ -9,6 +9,7 @@ profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

nzbget/apparmor.txt

@@ -9,6 +9,7 @@ profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

omni-tools/apparmor.txt

@@ -9,6 +9,7 @@ profile omni-tools flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal (send) set=(kill,term,int,hup,cont),
 

openproject/apparmor.txt

@@ -8,6 +8,7 @@ profile openproject_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

organizr/apparmor.txt

@@ -8,6 +8,7 @@ profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

photoprism/apparmor.txt

@@ -9,6 +9,7 @@ profile photoprism flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_rawio,
   file,

piwigo/apparmor.txt

@@ -9,6 +9,7 @@ profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

plex/apparmor.txt

@@ -9,6 +9,7 @@ profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

portainer/apparmor.txt

@@ -8,6 +8,7 @@ profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

portainer_agent/apparmor.txt

@@ -19,6 +19,7 @@ profile portainer_agent_addon flags=(attach_disconnected,mediate_deleted) {
   network unix dgram,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
 
 
 # S6-Overlay

postgres_15/apparmor.txt

@@ -8,6 +8,7 @@ profile postgres_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

prowlarr/apparmor.txt

@@ -9,6 +9,7 @@ profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

qbittorrent/apparmor.txt

@@ -10,6 +10,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

radarr/apparmor.txt

@@ -9,6 +9,7 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

readarr/apparmor.txt

@@ -9,6 +9,7 @@ profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

requestrr/apparmor.txt

@@ -9,6 +9,7 @@ profile requestrr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

resiliosync/apparmor.txt

@@ -10,6 +10,7 @@ profile resiliosync_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

sabnzbd/apparmor.txt

@@ -9,6 +9,7 @@ profile sabnzbd_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

scrutiny/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
+profile scrutiny_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_rawio,
   file,

scrutiny_fa_original/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
+profile scrutiny_fa_original_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_rawio,
   file,

scrutiny_original/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
+profile scrutiny_original_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_rawio,
   file,

seafile/apparmor.txt

@@ -10,6 +10,7 @@ profile seafile_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

seerr/apparmor.txt

@@ -8,6 +8,7 @@ profile seerr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

social_to_mealie/apparmor.txt

@@ -8,6 +8,7 @@ profile social_to_mealie_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

sonarr/apparmor.txt

@@ -9,6 +9,7 @@ profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

sponsorblockcast/apparmor.txt

@@ -1,7 +1,8 @@
 #include <tunables/global>
 
-profile addon_updater flags=(attach_disconnected,mediate_deleted) {
+profile sponsorblockcast_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   # Capabilities
   file,

spotweb/apparmor.txt

@@ -8,6 +8,7 @@ profile spotweb_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

tandoor_recipes/apparmor.txt

@@ -8,6 +8,7 @@ profile tandoor_recipes_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

tdarr/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_tdarr flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

teamspeak/apparmor.txt

@@ -8,6 +8,7 @@ profile teamspeak_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

transmission/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

transmission_openvpn/apparmor.txt

@@ -10,6 +10,7 @@ profile db21ed7f_transmission_openvpn flags=(attach_disconnected,mediate_deleted
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

ubooquity/apparmor.txt

@@ -9,6 +9,7 @@ profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

unpackerr/apparmor.txt

@@ -9,6 +9,7 @@ profile unpackerr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

webtop/apparmor.txt

@@ -1 +0,0 @@
-../webtop_kde/apparmor.txt

webtop/apparmor.txt

@@ -0,0 +1,72 @@
+#include <tunables/global>
+
+profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_admin,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+
+# S6-Overlay
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /run/{,**} rwk,
+  /dev/tty rw,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+  # Files required
+  /dev/fuse mrwkl,
+  /dev/sda1 mrwkl,
+  /dev/sdb1 mrwkl,
+  /dev/nvme0 mrwkl,
+  /dev/nvme0n1 mrwkl,
+  /dev/nvme1 mrwkl,
+  /dev/mmcblk0p1 mrwkl,
+  /dev/* mrwkl,
+  /udev/* mrwkl,
+  /tmp/** mrkwl,
+  /dev/fuse/** mrkwl,
+  /dev/** mrkwl,
+  /sys/firmware/** mrkwl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

webtop_kde/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
+profile webtop_kde_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,