From a5c308f9c55e6f04da889675e435502dbcde53ef Mon Sep 17 00:00:00 2001
From: Michael Rash <mbr@cipherdyne.org>
Date: Sun, 18 Aug 2013 22:58:10 -0400
Subject: [PATCH] Added AppArmor policy

This commit adds an AppArmor policy that is known to work in Debian and Ubuntu
systems.  The original version of this policy was contributed by Radostan Riedel
to the fwknop mailing list.
---
 extras/apparmor/usr.sbin.fwknopd | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 extras/apparmor/usr.sbin.fwknopd

diff --git a/extras/apparmor/usr.sbin.fwknopd b/extras/apparmor/usr.sbin.fwknopd
new file mode 100644
index 00000000..e00a0eab
--- /dev/null
+++ b/extras/apparmor/usr.sbin.fwknopd
@@ -0,0 +1,31 @@
+# Last Modified: Sun Aug 18 22:54:57 2013
+# Assumes fwknopd was built with:
+#    './configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var'
+#include <tunables/global>
+
+/usr/sbin/fwknopd {
+  #include <abstractions/base>
+
+  capability ipc_lock,
+  capability net_admin,
+  capability net_raw,
+
+  network inet raw,
+  network packet raw,
+
+  /bin/dash rix,
+  /bin/bash rix,
+  /etc/fwknop/access.conf r,
+  /etc/fwknop/fwknopd.conf r,
+  /etc/nsswitch.conf r,
+  /etc/passwd r,
+  /etc/protocols r,
+  /root/.gnupg/* rw,
+  /run/fwknop/ rw,
+  /run/fwknop/* rwk,
+  /sbin/xtables-multi rix,
+  /usr/bin/gpg rix,
+  /usr/sbin/fwknopd mr,
+  /var/cache/nscd/passwd r,
+
+}