/etc/apparmor.d/dhcpcd

dhcpcd apparmor profile

# vim:syntax=apparmor

#include <tunables/global>

profile dhcpcd /{usr/,}{sbin,bin}/dhcpcd {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability chown,
  capability net_admin,
  capability net_raw,
  capability kill,
  capability sys_chroot,
  capability setgid,
  capability setuid,
  # capability sys_admin,

  network packet dgram,
  network inet raw,
  network inet6 raw,

  /dev/pts/* rw,

  /etc/dhcpcd.{conf,duid,secret} r,
  /etc/ld.so.cache r,
  /etc/udev/udev.conf r,

  /proc/*/net/if_inet6 r,
  /proc/sys/net/ipv{4,6}/conf/*/* rw,
  /proc/sys/net/ipv6/neigh/** rw,
  /proc/sys/kernel/hostname r,
  /sys/devices/virtual/net/** rw,

  /{var/,}run/dhcpcd rwlk,
  /{var/,}run/dhcpcd/ rwlk,
  /{var/,}run/dhcpcd{-*,}.pid rwk,
  /{var/,}run/dhcpcd.sock rw,
  /{var/,}run/dhcpcd.unpriv.sock rw,
  /{var/,}run/udev/data/* r,
  /run/dhcpcd/hook-state/** rw,
  /run/dhcpcd/* rwk,
  /run/systemd/timesyncd.conf.d/dhcpcd-* rw,

  /sys/devices/*/*/{*/,}net/*/uevent r,
  /sys/devices/virtual/net/*/uevent r,
  /sys/devices/**/net/eth*/uevent r,

  /{usr/,}bin/dash ix,
  /{usr/,}bin/dash mrix,
  /usr/bin/rm ix,
  /usr/bin/sed ix,
  /usr/bin/cmp ix,
  /usr/bin/cat ix,
  /usr/bin/chmod ix,
  /usr/bin/systemctl ix,

  /usr/lib/dhcpcd/dev/udev.so rm,
  /usr/lib/ld-*.so rm,
  /usr/lib/libc-*.so rm,

  # Trust hooks and run the wrapper unconfined
  /usr/lib/dhcpcd/dhcpcd-run-hooks Uxr,

  /var/lib/dhcpcd/** rwlk,
  /var/lib/dhcpcd/*.lease6 rw,
  /var/db/dhcpcd-*.lease rw,
  /var/db/dhcpcd/** rw,
  /{usr/,}{sbin,bin}/dhcpcd mrix,

  /usr/lib/x86_64-linux-gnu/libc.so.6 rm,
  /usr/lib/x86_64-linux-gnu/* rm,
  /etc/ld.so.cache rm,

  /etc/resolv.conf rw,

  /usr/lib/dhcpcd rwlk,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.dhcpcd>
}