#include <tunables/global>

profile docker-custom flags=(attach_disconnected,mediate_deleted) {
  /wait Ux,
  network,
  file,
  # Host (privileged) processes may send signals to container processes.
  signal (receive) peer=unconfined,
  # Container processes may send signals amongst themselves.
  signal (send,receive) peer=docker-custom,
  deny @{PROC}/* w,   # deny write for all files directly in /proc (not in a subdir)
  # deny write to files not in /proc/<number>/** or /proc/sys/**
  deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9/]*}/** w,
  deny @{PROC}/sys/[^k]** w,  # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
  deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w,  # deny everything except shm* in /proc/sys/kernel/
  deny @{PROC}/sysrq-trigger rwklx,
  deny @{PROC}/kcore rwklx,
  deny mount,
  deny /sys/[^f]*/** wklx,
  deny /sys/f[^s]*/** wklx,
  deny /sys/fs/[^c]*/** wklx,
  deny /sys/fs/c[^g]*/** wklx,
  deny /sys/fs/cg[^r]*/** wklx,
  deny /sys/firmware/** rwklx,
  deny /sys/kernel/security/** rwklx,
  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
  ptrace (trace,read,tracedby,readby) peer=docker-custom,


  /usr/local/openjdk-11/bin/java cix -> docker-spring,

  profile docker-spring flags=(attach_disconnected,mediate_deleted) {
    deny /** x,

    # Custom java
    /usr/local/openjdk-*/bin/java mr,
    /usr/local/openjdk-*/lib/*/*.so mr,
    /usr/local/openjdk-*/lib/*.so mr,
  	# abstraction base
  	# {{{
  	#
  	#
  	/dev/log		w,
  	/dev/random		r,
  	/dev/urandom		r,
  	# ld.so.cache and ld are used to load shared libraries; they are best
  	# available everywhere
  	/etc/ld.so.cache               mr,
  	/etc/ld.so.conf                r,
  	/etc/ld.so.conf.d/{,*.conf}    r,
  	/etc/ld.so.preload             r,
  	/{usr/,}lib{,32,64}/ld{,32,64}-*.so   mr,
  	/{usr/,}lib/@{multiarch}/ld{,32,64}-*.so    mr,
  	/{usr/,}lib/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
  	/{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
  	/opt/*-linux-uclibc/lib/ld-uClibc*so* mr,

  	# we might as well allow everything to use common libraries
  	/{usr/,}lib{,32,64}/**                r,
  	/{usr/,}lib{,32,64}/**.so*       mr,
  	/{usr/,}lib/@{multiarch}/**            r,
  	/{usr/,}lib/@{multiarch}/**.so*   mr,
  	/{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so*    mr,
  	/{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so*    mr,

  	# /dev/null is pretty harmless and frequently used
  	/dev/null                      rw,
  	# as is /dev/zero
  	/dev/zero                      rw,
  	# recent glibc uses /dev/full in preference to /dev/null for programs
  	# that don't have open fds at exec()
  	/dev/full                      rw,

    	# Allow unconfined processes to send us signals by default
    	signal (receive) peer=unconfined,

  	# Allow us to signal ourselves
  	signal peer=@{profile_name},
  	###
  	#
  	#
  	# }}}



  	# name service section
  	# Many programs wish to perform nameservice-like operations, such as
  	# looking up users by name or id, groups by name or id, hosts by name
  	# or IP, etc. These operations may be performed through files, dns,
  	# NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
  	/etc/group              r,
  	/etc/host.conf          r,
  	/etc/hosts              r,
  	/etc/nsswitch.conf      r,
  	/etc/gai.conf           r,
  	/etc/passwd             r,
  	/etc/protocols          r,

  	# libtirpc (used for NIS/YP login) needs this
  	/etc/netconfig r,

  	# interface details
  	@{PROC}/@{pid}/net/route r,

  	# proc section
  	owner /proc/cgroups r,
  	owner /proc/sys/vm/overcommit_memory r,
  	@{PROC}/@{pid}/coredump_filter rw,


  	# java specific
  	# and custom
  	/**/*.jar	r,
  	/**		r,
  	/etc/java-*/ 	r,
  	/etc/java-**/*	r,

  	# global tmp directories
  	owner /var/tmp/**     rwkl,
  	/var/tmp/             rw,
  	owner /tmp/**         rwkl,
  	/tmp/                 rw,
  }
}
