usr.sbin.openvpn

# vim:syntax=apparmor

#include <tunables/global>

profile openvpn /usr/sbin/openvpn {
  #include <abstractions/base>
  #include <abstractions/openssl>
#  #include <abstractions/nameservice>   # embedded, but more relaxed
  #include <abstractions/3rd/nameservice-strict>

  capability net_admin,
  capability setuid,
  capability setgid,

  /etc/openvpn/server.conf              r,
  /etc/openvpn/server.{crt,key}         r,
  /etc/openvpn/[cC][aA].crt             r, # ca.crt, CA.crt, cA.crt
  /etc/openvpn/dh{,[0-9]*[0-9]}.pem     r, # dh.pem, dh2048.pem, dh1secret9.pem
  /etc/openvpn/ta{,[0-9]*[0-9]}.key     r,
  /etc/openvpn/client{,-*}.conf         r, # client.conf, client-tcp.conf, client-any.conf
  /etc/openvpn/auth-userpass.txt        r,

  /dev/net/tun rw,

  @{PROC}/@{pid}/net/route r,

  /var/log/openvpn/openvpn-status.log           rw,
  /var/log/openvpn/openvpn.log                  rw,
  /var/log/openvpn/ipp.txt                      rw,
  /{,var/}run/openvpn/server.pid                rw,
  /{,var/}run/openvpn/client{,-*}.pid           rw,
  /{,var/}run/openvpn/client{,-*}.status        rw,

  /{,usr/}bin/ip Cx,
  profile ip /{,usr/}bin/ip {
    /{,usr/}bin/ip r,
    #include <abstractions/base>

    capability net_admin,

    /var/log/openvpn/openvpn.log w,
  }

#  #include <local/usr.sbin.openvpn>
}