add network capability

addons_updater/apparmor.txt

@@ -2,10 +2,17 @@
 
 profile addon_updater flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   # Capabilities
   file,
   signal,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   # S6-Overlay
   /init rix,
@@ -24,13 +31,13 @@ profile addon_updater flags=(attach_disconnected,mediate_deleted) {
 
   # Access to Options.json and other files within your addon
   /data/** rw,
-  
+
   # Start new profile for service
   /usr/bin/myprogram cx,
-  
+
   profile usr/bin/myprogram flags=(attach_disconnected,mediate_deleted) {
     #include <abstractions/base>
-    
+
     # Receive signals from S6-Overlay
     signal receive,
   }

arpspoof/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

bazarr/apparmor.txt

@@ -3,17 +3,25 @@
 
 profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -29,20 +37,20 @@ profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

bitwarden/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

booksonic_air/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

cloudcommander/apparmor.txt

@@ -2,9 +2,10 @@
 
 profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
@@ -18,8 +19,8 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -35,21 +36,21 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
   /data/** rw,
   /** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

code-server/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile code_server_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile code_server_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

elasticsearch/apparmor.txt

@@ -2,12 +2,20 @@
 
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 
@@ -24,14 +32,14 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

emby/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,7 +36,7 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -36,13 +44,13 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   /dev/ttyUSB0 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

enedisgateway2mqtt/apparmor.txt

@@ -2,12 +2,20 @@
 
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 
@@ -24,14 +32,14 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

enedisgateway2mqtt_dev/apparmor.txt

@@ -2,12 +2,20 @@
 
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 
@@ -24,14 +32,14 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

filebrowser/apparmor.txt

@@ -2,9 +2,10 @@
 
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
@@ -18,8 +19,8 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -35,20 +36,20 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

fireflyiii/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

fireflyiii_data_importer/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

flaresolverr/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile joplin flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   capability dac_override,
   capability sys_rawio,
 
@@ -28,7 +36,7 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -36,13 +44,13 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   /dev/ttyUSB0 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

flexget/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

gazpar2mqtt/apparmor.txt

@@ -2,12 +2,20 @@
 
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 
@@ -24,14 +32,14 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

grav/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile grav_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile grav_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

inadyn/apparmor.txt

@@ -2,12 +2,20 @@
 
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 
@@ -24,14 +32,14 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

jackett/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

jellyfin/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,7 +36,7 @@ profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted)
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -37,13 +45,13 @@ profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted)
   /dev/* mrwkl,
   /tmp/** mrkwl,
   /opt/vc/lib/ mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

joal/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile joal_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

joplin/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile joplin flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   capability dac_override,
   capability sys_rawio,
 
@@ -28,7 +36,7 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -36,13 +44,13 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   /dev/ttyUSB0 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

lidarr/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

mealie/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

mylar3/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

nextcloud/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

nzbget/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

organizr/apparmor.txt

@@ -2,12 +2,20 @@
 
 profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
@@ -25,14 +33,14 @@ profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

paperless_ng/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile addon_db21ed7f_paperless_ng flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,7 +36,7 @@ profile addon_db21ed7f_paperless_ng flags=(attach_disconnected,mediate_deleted)
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -36,14 +44,14 @@ profile addon_db21ed7f_paperless_ng flags=(attach_disconnected,mediate_deleted)
   /dev/ttyUSB0 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

papermerge/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile papermerge_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile papermerge_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

photoprism/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile photoprism flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   capability dac_override,
   capability sys_rawio,
 
@@ -28,7 +36,7 @@ profile photoprism flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -36,13 +44,13 @@ profile photoprism flags=(attach_disconnected,mediate_deleted) {
   /dev/ttyUSB0 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

piwigo/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

plex/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,7 +36,7 @@ profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -36,13 +44,13 @@ profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
   /dev/ttyUSB0 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

portainer/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

prowlarr/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

qbittorrent/apparmor.txt

@@ -2,9 +2,10 @@
 
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
@@ -19,12 +20,12 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability setgid,
   capability chown,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
   capability dac_read_search,
   capability net_admin,
   capability dac_override,
-  capability net_bind_service, 
+  capability net_bind_service,
-  capability net_broadcast, 
+  capability net_broadcast,
   capability sys_rawio,
 
 # S6-Overlay
@@ -39,7 +40,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
@@ -47,13 +48,13 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   /dev/* mrwkl,
   /tmp/** mrkwl,
   /dev/net/tun mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

radarr/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

readarr/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

scrutiny/apparmor.txt

@@ -2,9 +2,10 @@
 
 profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
@@ -19,8 +20,8 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   capability setgid,
   capability setuid,
   capability dac_override,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   capability sys_rawio,
 
 # S6-Overlay
@@ -35,11 +36,11 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
-  /dev/mmcblk0p1 mrwkl, 
+  /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
   /dev/sda mrwkl,
@@ -54,13 +55,13 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   /dev/nvme2 mrwkl,
   /dev/nvme3 mrwkl,
   /dev/nvme4 mrwkl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

sonarr/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

spotweb/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile spotweb_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

tandoor_recipes/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile tandoor_recipes_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

teamspeak/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile teamspeak_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

transmission/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

ubooquity/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,20 +36,20 @@ profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 

webtop/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

webtrees/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile webtrees_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

wger/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile wger_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

whoogle/apparmor.txt

@@ -2,17 +2,25 @@
 
 profile whoogle-search_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
-  
+
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,
-  capability sys_admin, 
+  capability sys_admin,
-  capability dac_read_search, 
+  capability dac_read_search,
   # capability dac_override,
   # capability sys_rawio,
 
@@ -28,21 +36,21 @@ profile whoogle-search_addon flags=(attach_disconnected,mediate_deleted) {
   /init rix,
   /var/run/** mrwkl,
   /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl, 
+  /dev/i2c-1 mrwkl,
   # Files required
   /dev/sda1 mrwkl,
   /dev/sdb1 mrwkl,
   /dev/mmcblk0p1 mrwkl,
   /dev/* mrwkl,
   /tmp/** mrkwl,
-  
+
   # Data access
-  /data/** rw, 
+  /data/** rw,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
- 
+
   # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
-} 
+}

xteve/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile xteve_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}