abi <abi/4.0>,

include <tunables/global>

profile /netbird/client flags=(attach_disconnected.path=/att/netbird-client/) {
  include <abstractions/netbird>
  include <abstractions/ssl_certs>

  /etc/netbird/*config.json rwlk,

  /var/lib/netbird/*state.json rwlk,
  /var/lib/netbird/active_profile.json rwlk,
  /var/lib/netbird/resolv.conf rwlk,
  /var/lib/netbird/** rwlk,

  /var/log/netbird/client.log rw,

  /etc/resolv.conf rwlk,
  /etc/resolv.conf.original.netbird rwlk,

  /run/netbird.sock rwlk,

  network inet,
  network inet6,
  network netlink,

  capability sys_admin,
  capability net_admin,
  capability net_raw,
  capability bpf,
  capability perfmon,
  capability net_bind_service,

  deny /etc/logrotate.d/ r,

  # why?
  deny /run/udev/data/* r,

  /etc/machine-id r,

  /proc/sys/kernel/hostname r,
  /proc/@{pids}/mountinfo r,
  /proc/@{pids}/cgroup r,
  /proc/sys/kernel/osrelease r,
  /proc/sys/net/core/somaxconn r,

  /proc/sys/net/ipv4/conf/all/src_valid_mark rw,
  /proc/sys/net/ipv4/conf/all/rp_filter r,
  /proc/sys/net/ipv4/conf/*/rp_filter r,
  /proc/sys/net/ipv4/ip_forward rw,

  /sys/block/ r,
  /sys/class/net/ r,

  /sys/devices/virtual/dmi/id/product_name r,
  /sys/devices/virtual/dmi/id/sys_vendor r,
  /sys/devices/virtual/dmi/id/product_version r,
  /sys/devices/virtual/dmi/id/product_serial r,
  /sys/devices/virtual/dmi/id/product_sku r,
  /sys/devices/virtual/dmi/id/product_uuid r,
  /sys/devices/virtual/dmi/id/board_name r,
  /sys/devices/virtual/dmi/id/board_vendor r,
  /sys/devices/virtual/dmi/id/board_version r,
  /sys/devices/virtual/dmi/id/board_serial r,
  /sys/devices/virtual/dmi/id/board_asset_tag r,
  /sys/devices/virtual/dmi/id/chassis_type r,
  /sys/devices/virtual/dmi/id/chassis_vendor r,
  /sys/devices/virtual/dmi/id/chassis_version r,
  /sys/devices/virtual/dmi/id/chassis_serial r,
  /sys/devices/virtual/dmi/id/chassis_asset_tag r,
  /sys/devices/virtual/dmi/id/bios_vendor r,
  /sys/devices/virtual/dmi/id/bios_version r,
  /sys/devices/virtual/dmi/id/bios_date r,
  /sys/firmware/dmi/tables/DMI r,
  /sys/devices/pci0000:00/**/nvme/nvme*/model r,
  /sys/devices/pci0000:00/**/nvme/nvme*/*/{dev,size} r,
  /sys/devices/pci0000:00/**/virtio*/vendor r,
  /sys/devices/pci0000:00/**/virtio*/net/*/address r,
  /sys/devices/pci0000:00/**/virtio*/block/*/{size,dev} r,

  /att/netbird-client/run/dbus/system_bus_socket rw,

  include if exists <local/netbird-client>
}
