abi <abi/4.0>,

include <tunables/global>

profile blocky /usr/bin/blocky {
  include <abstractions/base>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>

  /usr/bin/blocky rm,

  /etc/blocky/config.yaml r,

  network inet,
  network inet6,
  network netlink raw,

  capability net_bind_service,

  /proc/@{pids}/{cgroup,mountinfo} r,
  /proc/sys/net/core/somaxconn r,

  /etc/hostname r,

  owner /var/lib/blocky/ r,
  owner /var/lib/blocky/** rwlk,

  include if exists <local/blocky>
}
