# Last Modified: Fri 05 Feb 2021 08:13:58 PM UTC
#include <tunables/global>

profile lokinet /usr/bin/lokinet {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability net_admin,
  capability net_bind_service,

  network inet dgram,
  network inet6 dgram,
  network netlink raw,

  /etc/loki/lokinet.ini r,
  /dev/net/tun rw,
  /usr/bin/lokinet mr,

  owner /{var/,}lib/lokinet/ rw,
  owner /{var/,}lib/lokinet/** rwk,
  owner ${HOME}/.lokinet/ rw,
  owner ${HOME}/.lokinet/** rwk,
  owner @{PROC}/@{pid}/task/@{pid}/comm rw,
  owner /tmp/lokinet.*/{**,} rw,

  #include if exists <local/usr.bin.lokinet>
}