# SPDX-License-Identifier: GPL-3.0-only
# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
# AppArmor profile for varuna-daemon (paranoid mode, enterprise tier — INV-9)
# Packaged at: /usr/share/varuna/paranoid/apparmor/varuna-paranoid
# Installed to: /etc/apparmor.d/varuna-paranoid (activated via `varuna systemd configure --apparmor`)
#
# Deny TCP/UDP: varuna-daemon communicates exclusively via unix sockets
# Allow journald: unix dgram to /run/systemd/journal/socket for structured logging

#include <tunables/global>

profile varuna-paranoid /usr/bin/varunad {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # Binary
  /usr/bin/varunad                  mr,

  # Embedded Ruby runtime
  /opt/varuna/embedded/bin/ruby     mr,
  /opt/varuna/embedded/lib/**       mr,
  /opt/varuna/app/**                mr,

  # Config read
  @{HOME}/.config/varuna/**         r,
  @{HOME}/.config/systemd/user/varuna-daemon.service.d/ r,
  @{HOME}/.config/systemd/user/varuna-daemon.service.d/** r,

  # State read+write (TUI socket, event log, sparkline cache)
  @{HOME}/.local/state/varuna/**    rw,
  /run/user/@{uid}/varuna/**        rw,

  # Systemd journal (structured log sink)
  /run/systemd/journal/socket       w,

  # User database (getpwuid for HOME resolution)
  /etc/passwd                       r,
  /etc/group                        r,

  # proc: own PID only (matches ProtectProc=invisible + ProcSubset=pid)
  /proc/@{pid}/status               r,
  /proc/@{pid}/stat                 r,

  # Deny everything else
  deny network tcp,
  deny network udp,
  deny @{HOME}/.ssh/**,
  deny @{HOME}/.gnupg/**,
}
