<commit_before>package apparmor

import (
	"text/template"
)

var lxcProfileTpl = template.Must(template.New("lxcProfile").Parse(`#include <tunables/global>
profile "{{ .name }}" flags=(attach_disconnected,mediate_deleted) {
  ### Base profile
  capability,
  dbus,
  file,
  network,
  umount,

  # Hide common denials
  deny mount options=(ro, remount) -> /,
  deny mount options=(ro, remount, silent) -> /,

  # Allow normal signal handling
  signal (receive),
  signal peer=@{profile_name},

  # Allow normal process handling
  ptrace (readby),
  ptrace (tracedby),
  ptrace peer=@{profile_name},

  # Handle binfmt
  mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
  deny /proc/sys/fs/binfmt_misc/{,**} rwklx,

  # Handle cgroupfs
  mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,

  # Handle configfs
  mount fstype=configfs -> /sys/kernel/config/,
  deny /sys/kernel/config/{,**} rwklx,

  # Handle debugfs
  mount fstype=debugfs -> /sys/kernel/debug/,
  deny /sys/kernel/debug/{,**} rwklx,

  # Handle efivarfs
  mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
  deny /sys/firmware/efi/efivars/{,**} rwklx,

  # Handle tracefs
  mount fstype=tracefs -> /sys/kernel/tracing/,
  deny /sys/kernel/tracing/{,**} rwklx,

  # Handle fuse
  mount fstype=fuse,
  mount fstype=fuse.*,
  mount fstype=fusectl -> /sys/fs/fuse/connections/,

  # Handle hugetlbfs
  mount fstype=hugetlbfs,

  # Handle mqueue
  mount fstype=mqueue,

  # Handle proc
  mount fstype=proc -> /proc/,
  deny /proc/bus/** wklx,
  deny /proc/kcore rwklx,
  deny /proc/sysrq-trigger rwklx,
  deny /proc/acpi/** rwklx,
  deny /proc/sys/fs/** wklx,

  # Handle securityfs (access handled separately)
  mount fstype=securityfs -> /sys/kernel/security/,

  # Handle sysfs (access handled below)
  mount fstype=sysfs -> /sys/,
  mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,

  # Handle tmpfs
  mount fstype=tmpfs,
<commit_msg>lxd/apparmor: remove spaces between mount options for consistency<commit_after>package apparmor

import (
	"text/template"
)

var lxcProfileTpl = template.Must(template.New("lxcProfile").Parse(`#include <tunables/global>
profile "{{ .name }}" flags=(attach_disconnected,mediate_deleted) {
  ### Base profile
  capability,
  dbus,
  file,
  network,
  umount,

  # Hide common denials
  deny mount options=(ro,remount) -> /,
  deny mount options=(ro,remount,silent) -> /,

  # Allow normal signal handling
  signal (receive),
  signal peer=@{profile_name},

  # Allow normal process handling
  ptrace (readby),
  ptrace (tracedby),
  ptrace peer=@{profile_name},

  # Handle binfmt
  mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
  deny /proc/sys/fs/binfmt_misc/{,**} rwklx,

  # Handle cgroupfs
  mount options=(ro,nosuid,nodev,noexec,remount,strictatime) -> /sys/fs/cgroup/,

  # Handle configfs
  mount fstype=configfs -> /sys/kernel/config/,
  deny /sys/kernel/config/{,**} rwklx,

  # Handle debugfs
  mount fstype=debugfs -> /sys/kernel/debug/,
  deny /sys/kernel/debug/{,**} rwklx,

  # Handle efivarfs
  mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
  deny /sys/firmware/efi/efivars/{,**} rwklx,

  # Handle tracefs
  mount fstype=tracefs -> /sys/kernel/tracing/,
  deny /sys/kernel/tracing/{,**} rwklx,

  # Handle fuse
  mount fstype=fuse,
  mount fstype=fuse.*,
  mount fstype=fusectl -> /sys/fs/fuse/connections/,

  # Handle hugetlbfs
  mount fstype=hugetlbfs,

  # Handle mqueue
  mount fstype=mqueue,

  # Handle proc
  mount fstype=proc -> /proc/,
  deny /proc/bus/** wklx,
  deny /proc/kcore rwklx,
  deny /proc/sysrq-trigger rwklx,
  deny /proc/acpi/** rwklx,
  deny /proc/sys/fs/** wklx,

  # Handle securityfs (access handled separately)
  mount fstype=securityfs -> /sys/kernel/security/,

  # Handle sysfs (access handled below)
  mount fstype=sysfs -> /sys/,
  mount options=(rw,nosuid,nodev,noexec,remount) -> /sys/,

  # Handle tmpfs
  mount fstype=tmpfs,

{'fraction_non_alphanumeric': 0.145748987854251, 'fraction_numerical': 0.0, 'mean_word_length': 3.623391812865497, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 31, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6787508', 'n_tokens_mistral': 1541, 'n_tokens_neox': 1510, 'n_words': 319}