Merge pull request #2587 from alexbelgium/copilot/review-apparmor-permissions-addons

Replace blanket AppArmor `capability,` with specific per-addon capabilities
Replace blanket capability, with specific capabilities in all AppArmor profiles
2026-05-21 00:01:50 +02:00 · 2026-03-17 09:09:09 +01:00 · 2026-03-17 07:42:05 +00:00 · 2026-03-17 08:33:19 +01:00 · 2026-03-17 07:33:06 +00:00 · 2026-03-17 08:31:13 +01:00
111 changed files with 684 additions and 742 deletions
--- a/arpspoof/apparmor.txt
+++ b/arpspoof/apparmor.txt
@@ -3,7 +3,13 @@
 profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/autobrr/apparmor.txt
+++ b/autobrr/apparmor.txt
@@ -3,7 +3,13 @@
 profile autobrr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile autobrr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/baikal/apparmor.txt
+++ b/baikal/apparmor.txt
@@ -4,7 +4,11 @@
 profile baikal_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -19,12 +23,6 @@ profile baikal_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/battybirdnet-pi/apparmor.txt
+++ b/battybirdnet-pi/apparmor.txt
@@ -3,7 +3,13 @@
 profile battybirdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile battybirdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/bazarr/apparmor.txt
+++ b/bazarr/apparmor.txt
@@ -4,7 +4,13 @@
 profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -19,12 +25,6 @@ profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/binance-trading-bot/apparmor.txt
+++ b/binance-trading-bot/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_binance-trading-bot flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_binance-trading-bot flags=(attach_disconnected,mediate_deleted)
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/birdnet-go/apparmor.txt
+++ b/birdnet-go/apparmor.txt
@@ -3,7 +3,14 @@
 profile db21ed7f_birdnet-go flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_resource,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile db21ed7f_birdnet-go flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/birdnet-pi/apparmor.txt
+++ b/birdnet-pi/apparmor.txt
@@ -3,7 +3,13 @@
 profile birdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile birdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/birdnet-pipy/apparmor.txt
+++ b/birdnet-pipy/apparmor.txt
@@ -3,7 +3,11 @@
 profile birdnet-pipy_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,10 +22,6 @@ profile birdnet-pipy_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,

 # S6-Overlay
  /init ix,
--- a/bitwarden/apparmor.txt
+++ b/bitwarden/apparmor.txt
@@ -3,7 +3,11 @@
 profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/booksonic_air/apparmor.txt
+++ b/booksonic_air/apparmor.txt
@@ -3,7 +3,13 @@
 profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/browser_chromium/apparmor.txt
+++ b/browser_chromium/apparmor.txt
@@ -3,7 +3,13 @@
 profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/browserless_chrome/apparmor.txt
+++ b/browserless_chrome/apparmor.txt
@@ -4,7 +4,11 @@
 profile browserlesschrome_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -19,12 +23,6 @@ profile browserlesschrome_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/calibre/apparmor.txt
+++ b/calibre/apparmor.txt
@@ -3,7 +3,14 @@
 profile calibre_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile calibre_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/calibre_web/apparmor.txt
+++ b/calibre_web/apparmor.txt
@@ -3,7 +3,14 @@
 profile calibre-web_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile calibre-web_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/changedetection.io/apparmor.txt
+++ b/changedetection.io/apparmor.txt
@@ -3,7 +3,11 @@
 profile addon_db21ed7f_changedetection.io_nas flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile addon_db21ed7f_changedetection.io_nas flags=(attach_disconnected,mediate
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/cleanuparr/apparmor.txt
+++ b/cleanuparr/apparmor.txt
@@ -3,7 +3,11 @@
 profile cleanuparr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile cleanuparr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/cloudcommander/apparmor.txt
+++ b/cloudcommander/apparmor.txt
@@ -3,7 +3,13 @@
 profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/codex/apparmor.txt
+++ b/codex/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_codex flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_codex flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/collabora/apparmor.txt
+++ b/collabora/apparmor.txt
@@ -3,7 +3,11 @@
 profile collabora_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile collabora_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/comixed/apparmor.txt
+++ b/comixed/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/elasticsearch/apparmor.txt
+++ b/elasticsearch/apparmor.txt
@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/emby/apparmor.txt
+++ b/emby/apparmor.txt
@@ -3,7 +3,13 @@
 profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/emby_beta/apparmor.txt
+++ b/emby_beta/apparmor.txt
@@ -3,7 +3,13 @@
 profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/enedisgateway2mqtt/apparmor.txt
+++ b/enedisgateway2mqtt/apparmor.txt
@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/enedisgateway2mqtt_dev/apparmor.txt
+++ b/enedisgateway2mqtt_dev/apparmor.txt
@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/ente/apparmor.txt
+++ b/ente/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/epicgamesfree/apparmor.txt
+++ b/epicgamesfree/apparmor.txt
@@ -3,7 +3,11 @@
 profile epicgamesfree_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile epicgamesfree_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/filebrowser/apparmor.txt
+++ b/filebrowser/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/filebrowser_quantum/apparmor.txt
+++ b/filebrowser_quantum/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/fireflyiii/apparmor.txt
+++ b/fireflyiii/apparmor.txt
@@ -3,7 +3,11 @@
 profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/fireflyiii_data_importer/apparmor.txt
+++ b/fireflyiii_data_importer/apparmor.txt
@@ -3,7 +3,11 @@
 profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/fireflyiii_fints_importer/apparmor.txt
+++ b/fireflyiii_fints_importer/apparmor.txt
@@ -3,7 +3,11 @@
 profile fireflyiii_fints_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile fireflyiii_fints_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/flaresolverr/apparmor.txt
+++ b/flaresolverr/apparmor.txt
@@ -3,7 +3,11 @@
 profile joplin flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/flexget/apparmor.txt
+++ b/flexget/apparmor.txt
@@ -3,7 +3,11 @@
 profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/free_games_claimer/apparmor.txt
+++ b/free_games_claimer/apparmor.txt
@@ -3,7 +3,11 @@
 profile free_games_claimer_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile free_games_claimer_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/gazpar2mqtt/apparmor.txt
+++ b/gazpar2mqtt/apparmor.txt
@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/gitea/apparmor.txt
+++ b/gitea/apparmor.txt
@@ -3,7 +3,11 @@
 profile gitea_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile gitea_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/grampsweb/apparmor.txt
+++ b/grampsweb/apparmor.txt
@@ -3,7 +3,11 @@
 profile grampsweb_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile grampsweb_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/grav/apparmor.txt
+++ b/grav/apparmor.txt
@@ -3,7 +3,11 @@
 profile grav_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile grav_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/guacamole/apparmor.txt
+++ b/guacamole/apparmor.txt
@@ -3,7 +3,11 @@
 profile guacamole_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile guacamole_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/immich/apparmor.txt
+++ b/immich/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/immich_frame/apparmor.txt
+++ b/immich_frame/apparmor.txt
@@ -3,7 +3,11 @@
 profile db21ed7f_immich_frame flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile db21ed7f_immich_frame flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/immich_power_tools/apparmor.txt
+++ b/immich_power_tools/apparmor.txt
@@ -3,7 +3,11 @@
 profile db21ed7f_immich_power_tools flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile db21ed7f_immich_power_tools flags=(attach_disconnected,mediate_deleted)
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/inadyn/apparmor.txt
+++ b/inadyn/apparmor.txt
@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/jackett/apparmor.txt
+++ b/jackett/apparmor.txt
@@ -3,7 +3,13 @@
 profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/jellyfin/apparmor.txt
+++ b/jellyfin/apparmor.txt
@@ -3,7 +3,14 @@
 profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted)
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability sys_rawio,
-  capability dac_read_search,
-  # capability dac_override,

 # S6-Overlay
  /init ix,
--- a/joal/apparmor.txt
+++ b/joal/apparmor.txt
@@ -3,7 +3,11 @@
 profile joal_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile joal_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/joplin/apparmor.txt
+++ b/joplin/apparmor.txt
@@ -3,7 +3,12 @@
 profile joplin flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_time,
  file,
  signal,
  mount,
@@ -18,12 +23,6 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/kometa/apparmor.txt
+++ b/kometa/apparmor.txt
@@ -3,7 +3,13 @@
 profile kometa_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile kometa_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/librespeed/apparmor.txt
+++ b/librespeed/apparmor.txt
@@ -3,7 +3,11 @@
 profile librespeed_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile librespeed_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/lidarr/apparmor.txt
+++ b/lidarr/apparmor.txt
@@ -3,7 +3,13 @@
 profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/linkwarden/apparmor.txt
+++ b/linkwarden/apparmor.txt
@@ -3,7 +3,11 @@
 profile linkwarden_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile linkwarden_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/maintainerr/apparmor.txt
+++ b/maintainerr/apparmor.txt
@@ -3,7 +3,11 @@
 profile maintainerr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile maintainerr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/manyfold/apparmor.txt
+++ b/manyfold/apparmor.txt
@@ -10,7 +10,11 @@ profile hassio-addons/manyfold flags=(attach_disconnected,mediate_deleted) {
  # denying known high-risk kernel interfaces.
  file,
  network,
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,

  deny /proc/kcore rwklx,
  deny /proc/sysrq-trigger rwklx,
--- a/mealie/apparmor.txt
+++ b/mealie/apparmor.txt
@@ -3,7 +3,11 @@
 profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/monica/apparmor.txt
+++ b/monica/apparmor.txt
@@ -3,7 +3,11 @@
 profile monica_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile monica_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/mylar3/apparmor.txt
+++ b/mylar3/apparmor.txt
@@ -3,7 +3,13 @@
 profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/navidrome/apparmor.txt
+++ b/navidrome/apparmor.txt
@@ -3,7 +3,13 @@
 profile navidrome_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile navidrome_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/netalertx/CHANGELOG.md
+++ b/netalertx/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 26.3.16-2 (17-03-2026)
+- Minor bugs fixed
+## 26.3.16-1 (17-03-2026)
+- Minor bugs fixed
 ## 26.3.7-3 (07-03-2026)
 - Minor bugs fixed
 ## 26.3.7-2 (07-03-2026)
--- a/netalertx/apparmor.txt
+++ b/netalertx/apparmor.txt
@@ -3,35 +3,25 @@
 profile netalertx_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability net_admin,
+  capability net_raw,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
-  umount,
  remount,
-  network udp,
-  network tcp,
-  network dgram,
-  network stream,
-  network inet,
-  network inet6,
-  network netlink raw,
-  network unix dgram,
+  umount,
+  network,
+  ptrace,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
-
-# S6-Overlay
  /init ix,
  /run/{s6,s6-rc*,service}/** ix,
  /package/** ix,
  /command/** ix,
-  /run/{,**} rwk,
-  /dev/tty rw,
  /bin/** ix,
  /usr/bin/** ix,
  /usr/lib/bashio/** ix,
@@ -40,27 +30,5 @@ profile netalertx_addon flags=(attach_disconnected,mediate_deleted) {
  /etc/services.d/** rwix,
  /etc/cont-init.d/** rwix,
  /etc/cont-finish.d/** rwix,
-  /init rix,
-  /var/run/** mrwkl,
-  /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl,
-  # Files required
-  /dev/fuse mrwkl,
-  /dev/sda1 mrwkl,
-  /dev/sdb1 mrwkl,
-  /dev/nvme0 mrwkl,
-  /dev/nvme1 mrwkl,
-  /dev/mmcblk0p1 mrwkl,
-  /dev/* mrwkl,
-  /tmp/** mrkwl,
-
-  # Data access
-  /data/** rw,
-
-  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
-  ptrace (trace,read) peer=docker-default,
-
-  # docker daemon confinement requires explict allow rule for signal
-  signal (receive) set=(kill,term) peer=/usr/bin/docker,
-
 }
+
--- a/netalertx/config.yaml
+++ b/netalertx/config.yaml
@@ -1,48 +1,38 @@
 arch:
  - aarch64
  - amd64
-description: "\U0001F5A7\U0001F50D WIFI / LAN scanner, intruder, and presence detector"
-environment:
-  PGID: "20211"
-  PORT: "20211"
-  PUID: "20211"
-  TZ: Europe/Berlin
-  NETALERTX_DATA: /config
-  NETALERTX_CONFIG: /config/config
-  NETALERTX_DB: /config/db
-  TMP_DIR: /tmp/tmp
-  NETALERTX_CONFIG_FILE: /config/config/app.conf
-  NETALERTX_DB_FILE: /config/db/app.db
+description: "\U0001F5A7\U0001F50D Centralized network visibility and continuous asset discovery."
 hassio_api: true
 host_network: true
 image: ghcr.io/alexbelgium/netalertx-{arch}
 ingress: true
-ingress_port: 0
+ingress_port: 20211
 ingress_stream: true
 init: false
 map:
  - addon_config:rw
-  - media:rw
-  - share:rw
-  - ssl
 name: NetAlertX
-options:
-  env_vars: []
 panel_icon: mdi:wifi-check
 ports:
  20211/tcp: 20211
  20212/tcp: 20212
 ports_description:
-  20211/tcp: WebUI port
-  20212/tcp: GraphQL port
+  20211/tcp: NetAlertX WebUI port
+  20212/tcp: GraphQL & MCP port
 privileged:
  - NET_ADMIN
  - NET_RAW
+environment:
+  PUID: "20211"
+  PGID: "20211"
+  TZ: Europe/Berlin
+  NETALERTX_CONFIG: /config/config
+  NETALERTX_DB: /config/db
+  TMP_DIR: /tmp/tmp
+  NETALERTX_CONFIG_FILE: /config/config/app.conf
+  NETALERTX_DB_FILE: /config/db/app.db
+  SKIP_STARTUP_CHECKS: excessive capabilities.sh,appliance integrity.sh
 schema:
-  env_vars:
-    - name: match(^[A-Za-z0-9_]+$)
-      value: str?
-  APP_CONF_OVERRIDE: str?
  TZ: str?
 services:
  - mqtt:want
@@ -50,4 +40,4 @@ slug: netalertx
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "26.2.6-4"
+version: "26.3.16-2"
--- a/netalertx/rootfs/etc/cont-init.d/91-configure.sh
+++ b/netalertx/rootfs/etc/cont-init.d/91-configure.sh
@@ -6,12 +6,11 @@ set -e
 # Update structure #
 ####################

-APP_UID=20211

 # 1. Fix the directories
-for folder in /tmp/run/tmp /tmp/api /tmp/log /tmp/run /tmp/nginx/active-config "$TMP_DIR" "$NETALERTX_DATA" "$NETALERTX_DB" "$NETALERTX_CONFIG"; do
+for folder in /tmp/run/tmp /tmp/api /tmp/log /tmp/run /tmp/nginx/active-config "${TMP_DIR:-/tmp}" "${NETALERTX_DATA:-/data}" "${NETALERTX_DB:-/data/db}" "${NETALERTX_CONFIG:-/data/config}"; do
    mkdir -p "$folder"
-    chown -R $APP_UID:$APP_UID "$folder"
+    chown -R "${PUID}":"${PGID}" "$folder"
    chmod -R 755 "$folder"
 done

@@ -22,13 +21,17 @@ chmod 666 /dev/stdout /dev/stderr

 # 3. Pre-create and chown log files
 touch /tmp/log/app.php_errors.log /tmp/log/cron.log /tmp/log/stdout.log /tmp/log/stderr.log
-chown $APP_UID:$APP_UID /tmp/log/*.log
+chown "${PUID}":"${PGID}" /tmp/log/*.log

 # 4. Create Symlinks
 for item in db config; do
+    # ADD THESE TWO LINES: Ensure the target exists and is owned by 20211
+    mkdir -p "/config/$item"
+    chown -R "${PUID}":"${PGID}" "/config/$item"
+
    rm -rf "/data/$item"
    ln -sf "/config/$item" "/data/$item"
-    chown -R $APP_UID:$APP_UID "/data/$item"
+    chown -R "${PUID}":"${PGID}" "/data/$item"
    chmod -R 755 "/data/$item"
 done

--- a/netalertx/rootfs/etc/cont-init.d/99-run.sh
+++ b/netalertx/rootfs/etc/cont-init.d/99-run.sh
@@ -3,4 +3,4 @@
 set -e

 bashio::log.info "Starting upstream app"
-gosu netalertx /entrypoint.sh
+/root-entrypoint.sh
--- a/nextcloud/apparmor.txt
+++ b/nextcloud/apparmor.txt
@@ -3,7 +3,13 @@
 profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/nzbget/apparmor.txt
+++ b/nzbget/apparmor.txt
@@ -3,7 +3,13 @@
 profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/omni-tools/apparmor.txt
+++ b/omni-tools/apparmor.txt
@@ -4,7 +4,11 @@ profile omni-tools flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

  # Capabilities
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal (send) set=(kill,term,int,hup,cont),

--- a/openproject/apparmor.txt
+++ b/openproject/apparmor.txt
@@ -3,7 +3,11 @@
 profile openproject_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile openproject_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/organizr/apparmor.txt
+++ b/organizr/apparmor.txt
@@ -3,7 +3,11 @@
 profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,8 +22,6 @@ profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/photoprism/apparmor.txt
+++ b/photoprism/apparmor.txt
@@ -3,7 +3,14 @@
 profile photoprism flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_rawio,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile photoprism flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability dac_override,
-  capability sys_admin,
-  capability dac_read_search,
-  capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/piwigo/apparmor.txt
+++ b/piwigo/apparmor.txt
@@ -3,7 +3,13 @@
 profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/plex/apparmor.txt
+++ b/plex/apparmor.txt
@@ -3,7 +3,13 @@
 profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/portainer/apparmor.txt
+++ b/portainer/apparmor.txt
@@ -3,7 +3,11 @@
 profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/postgres_15/apparmor.txt
+++ b/postgres_15/apparmor.txt
@@ -3,7 +3,11 @@
 profile postgres_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile postgres_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/prowlarr/apparmor.txt
+++ b/prowlarr/apparmor.txt
@@ -3,7 +3,13 @@
 profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/qbittorrent/apparmor.txt
+++ b/qbittorrent/apparmor.txt
@@ -3,7 +3,14 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,16 +25,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability chown,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability net_admin,
-  capability dac_override,
-  capability net_bind_service,
-  capability net_broadcast,
-  capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/radarr/apparmor.txt
+++ b/radarr/apparmor.txt
@@ -3,7 +3,13 @@
 profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/readarr/apparmor.txt
+++ b/readarr/apparmor.txt
@@ -3,7 +3,13 @@
 profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/requestrr/apparmor.txt
+++ b/requestrr/apparmor.txt
@@ -3,7 +3,13 @@
 profile requestrr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile requestrr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/resiliosync/apparmor.txt
+++ b/resiliosync/apparmor.txt
@@ -3,7 +3,14 @@
 profile resiliosync_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile resiliosync_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/sabnzbd/apparmor.txt
+++ b/sabnzbd/apparmor.txt
@@ -3,7 +3,13 @@
 profile sabnzbd_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile sabnzbd_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/scrutiny/apparmor.txt
+++ b/scrutiny/apparmor.txt
@@ -3,7 +3,14 @@
 profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_rawio,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability dac_override,
-  capability sys_admin,
-  capability dac_read_search,
-  capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/seafile/apparmor.txt
+++ b/seafile/apparmor.txt
@@ -3,7 +3,14 @@
 profile seafile_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile seafile_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/seerr/apparmor.txt
+++ b/seerr/apparmor.txt
@@ -3,7 +3,11 @@
 profile seerr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile seerr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/social_to_mealie/apparmor.txt
+++ b/social_to_mealie/apparmor.txt
@@ -3,7 +3,11 @@
 profile social_to_mealie_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile social_to_mealie_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/sonarr/apparmor.txt
+++ b/sonarr/apparmor.txt
@@ -3,7 +3,13 @@
 profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/spotweb/apparmor.txt
+++ b/spotweb/apparmor.txt
@@ -3,7 +3,11 @@
 profile spotweb_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile spotweb_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/tandoor_recipes/apparmor.txt
+++ b/tandoor_recipes/apparmor.txt
@@ -3,7 +3,11 @@
 profile tandoor_recipes_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile tandoor_recipes_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/tdarr/apparmor.txt
+++ b/tdarr/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_tdarr flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_tdarr flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/teamspeak/apparmor.txt
+++ b/teamspeak/apparmor.txt
@@ -3,7 +3,11 @@
 profile teamspeak_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile teamspeak_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/transmission/apparmor.txt
+++ b/transmission/apparmor.txt
@@ -3,7 +3,13 @@
 profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/transmission_openvpn/apparmor.txt
+++ b/transmission_openvpn/apparmor.txt
@@ -3,7 +3,14 @@
 profile db21ed7f_transmission_openvpn flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +25,6 @@ profile db21ed7f_transmission_openvpn flags=(attach_disconnected,mediate_deleted
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/ubooquity/apparmor.txt
+++ b/ubooquity/apparmor.txt
@@ -3,7 +3,13 @@
 profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/unpackerr/apparmor.txt
+++ b/unpackerr/apparmor.txt
@@ -3,7 +3,13 @@
 profile unpackerr_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile unpackerr_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/webtop_kde/apparmor.txt
+++ b/webtop_kde/apparmor.txt
@@ -3,7 +3,13 @@
 profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -18,12 +24,6 @@ profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/webtrees/apparmor.txt
+++ b/webtrees/apparmor.txt
@@ -3,7 +3,13 @@
 profile webtrees_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
  file,
  signal,
  mount,
@@ -17,8 +23,6 @@ profile webtrees_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/wger/apparmor.txt
+++ b/wger/apparmor.txt
@@ -3,7 +3,11 @@
 profile wger_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile wger_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/whatsapper/apparmor.txt
+++ b/whatsapper/apparmor.txt
@@ -3,7 +3,11 @@
 profile gitea_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile gitea_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/whoogle/apparmor.txt
+++ b/whoogle/apparmor.txt
@@ -3,7 +3,11 @@
 profile whoogle-search_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -18,12 +22,6 @@ profile whoogle-search_addon flags=(attach_disconnected,mediate_deleted) {
  network netlink raw,
  network unix dgram,

-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,

 # S6-Overlay
  /init ix,
--- a/xteve/apparmor.txt
+++ b/xteve/apparmor.txt
@@ -3,7 +3,11 @@
 profile xteve_addon flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
  file,
  signal,
  mount,
@@ -17,8 +21,6 @@ profile xteve_addon flags=(attach_disconnected,mediate_deleted) {
  network inet6,
  network netlink raw,
  network unix dgram,
-  capability setgid,
-  capability setuid,


 # S6-Overlay
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Alexandre	965a26e306	Merge pull request #2587 from alexbelgium/copilot/review-apparmor-permissions-addons Replace blanket AppArmor `capability,` with specific per-addon capabilities	2026-03-17 09:09:09 +01:00
copilot-swe-agent[bot]	3c53e69161	Replace blanket capability, with specific capabilities in all AppArmor profiles Remove overly permissive blanket `capability,` rule (grants ALL Linux capabilities) from 107 addon AppArmor profiles. Replace with only the specific capabilities each addon needs based on its config.yaml `privileged` field. Base capabilities for all addons: setuid, setgid, chown, fowner, dac_override Additional capabilities mapped from config.yaml privileged list: - SYS_ADMIN -> sys_admin - DAC_READ_SEARCH -> dac_read_search - NET_ADMIN -> net_admin - NET_RAW -> net_raw - SYS_RAWIO -> sys_rawio - SYS_TIME -> sys_time - SYS_RESOURCE -> sys_resource Addons with full_access: true (portainer_agent) retain blanket capability. Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>	2026-03-17 07:42:05 +00:00
Alexandre	3ae0bbb9ba	nobuild corrext	2026-03-17 08:33:19 +01:00
copilot-swe-agent[bot]	8156916179	Initial plan	2026-03-17 07:33:06 +00:00
Alexandre	92369f4607	nobuild	2026-03-17 08:31:13 +01:00
github-actions	8870083a45	GitHub bot: changelog	2026-03-17 07:29:21 +00:00
Alexandre	317d13c294	nobuild Added TMP_DIR and updated NETALERTX_CONFIG_FILE and NETALERTX_DB_FILE paths.	2026-03-17 08:29:13 +01:00
Alexandre	34ea41913e	Use /config for location to allow access	2026-03-17 08:27:07 +01:00
github-actions	0ed5974d1a	GitHub bot: changelog	2026-03-17 06:06:28 +00:00
Alexandre	66be252470	Merge pull request #2585 from adamoutler/master Fix: correct multiple configuration issues in NetAlertX	2026-03-17 07:03:54 +01:00
root	382988a9e7	lint issues	2026-03-16 16:15:40 -04:00
root	1ebaf6e011	Update with proper configuration	2026-03-16 15:04:32 -04:00