add network capability

addons_updater/apparmor.txt

@@ -6,6 +6,13 @@ profile addon_updater flags=(attach_disconnected,mediate_deleted) {
   # Capabilities
   file,
   signal,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   # S6-Overlay
   /init rix,

arpspoof/apparmor.txt

@@ -5,9 +5,17 @@ profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

bazarr/apparmor.txt

@@ -6,9 +6,17 @@ profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

bitwarden/apparmor.txt

@@ -5,9 +5,17 @@ profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

booksonic_air/apparmor.txt

@@ -5,9 +5,17 @@ profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

cloudcommander/apparmor.txt

@@ -5,6 +5,7 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,

code-server/apparmor.txt

@@ -5,9 +5,17 @@ profile code_server_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

elasticsearch/apparmor.txt

@@ -5,9 +5,17 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 

emby/apparmor.txt

@@ -5,9 +5,17 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

enedisgateway2mqtt/apparmor.txt

@@ -5,9 +5,17 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 

enedisgateway2mqtt_dev/apparmor.txt

@@ -5,9 +5,17 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 

filebrowser/apparmor.txt

@@ -5,6 +5,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,

fireflyiii/apparmor.txt

@@ -5,9 +5,17 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

fireflyiii_data_importer/apparmor.txt

@@ -5,9 +5,17 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

flaresolverr/apparmor.txt

@@ -5,9 +5,17 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

flexget/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

gazpar2mqtt/apparmor.txt

@@ -5,9 +5,17 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 

grav/apparmor.txt

@@ -5,9 +5,17 @@ profile grav_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

inadyn/apparmor.txt

@@ -5,9 +5,17 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
   capability setgid,
   capability setuid,
 

jackett/apparmor.txt

@@ -5,9 +5,17 @@ profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

jellyfin/apparmor.txt

@@ -5,9 +5,17 @@ profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted)
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

joal/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile joal_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

joplin/apparmor.txt

@@ -5,9 +5,17 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

lidarr/apparmor.txt

@@ -5,9 +5,17 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

mealie/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

mylar3/apparmor.txt

@@ -5,9 +5,17 @@ profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

nextcloud/apparmor.txt

@@ -5,9 +5,17 @@ profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

nzbget/apparmor.txt

@@ -5,9 +5,17 @@ profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

organizr/apparmor.txt

@@ -5,9 +5,17 @@ profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

paperless_ng/apparmor.txt

@@ -5,9 +5,17 @@ profile addon_db21ed7f_paperless_ng flags=(attach_disconnected,mediate_deleted)
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

papermerge/apparmor.txt

@@ -5,9 +5,17 @@ profile papermerge_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

photoprism/apparmor.txt

@@ -5,9 +5,17 @@ profile photoprism flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

piwigo/apparmor.txt

@@ -5,9 +5,17 @@ profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

plex/apparmor.txt

@@ -5,9 +5,17 @@ profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

portainer/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

prowlarr/apparmor.txt

@@ -5,9 +5,17 @@ profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

qbittorrent/apparmor.txt

@@ -5,6 +5,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,

radarr/apparmor.txt

@@ -5,9 +5,17 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

readarr/apparmor.txt

@@ -5,9 +5,17 @@ profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

scrutiny/apparmor.txt

@@ -5,6 +5,7 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,

sonarr/apparmor.txt

@@ -5,9 +5,17 @@ profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

spotweb/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile spotweb_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

tandoor_recipes/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile tandoor_recipes_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

teamspeak/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile teamspeak_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

transmission/apparmor.txt

@@ -5,9 +5,17 @@ profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

ubooquity/apparmor.txt

@@ -5,9 +5,17 @@ profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

webtop/apparmor.txt

@@ -5,9 +5,17 @@ profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

webtrees/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile webtrees_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

wger/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile wger_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

whoogle/apparmor.txt

@@ -5,9 +5,17 @@ profile whoogle-search_addon flags=(attach_disconnected,mediate_deleted) {
 
   capability,
   file,
+  signal,
   mount,
   umount,
   remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
 
   capability setgid,
   capability setuid,

xteve/apparmor.txt

@@ -0,0 +1,46 @@
+#include <tunables/global>
+
+profile xteve_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  capability setgid,
+  capability setuid,
+
+
+# S6-Overlay
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}