csplogger-apparmor.toml

# name of the profile, we will auto prefix with `docker-`
# so the final profile name will be `docker-csplogger-apparmor`
Name = "csplogger-apparmor"

[Filesystem]
# read only paths for the container
ReadOnlyPaths = [
	"/bin/**",
	"/boot/**",
	"/dev/**",
	"/etc/**",
	"/lib/**",
	"/lib64/**",
	"/media/**",
	"/mnt/**",
	"/opt/**",
	"/proc/**",
	"/root/**",
	"/sbin/**",
	"/srv/**",
	"/tmp/**",
	"/sys/**",
	"/usr/**",
]

# paths where you want to log on write
LogOnWritePaths = [
	"/**"
]

# paths where you can write
WritablePaths = [
	"/home/csplogger-agent/csplogger/databases"
]

# allowed executable files for the container
AllowExec = [
]


# denied executable files
DenyExec = [
	"/bin/**",
	"/sbin/**",
	"/usr/sbin/**",
]

# allowed capabilities
[Capabilities]
Allow = [
]

[Network]
# if you don't need to ping in a container, you can probably
# set Raw to false and deny network raw
Raw = false
Packet = false
Protocols = [
	"tcp"
]