# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# NEEDS-VARIABLE: devtools

# Well known programs used in various development shells. Only programs that are
# safe to allow running from a shell dev environment are allowed here. Profile
# must exist, and may have more permissions than the shell it is coming from.

  abi <abi/4.0>,

  priority=1 @{bin}/aa-log                    px,
  priority=1 @{bin}/apparmor-language-server  px,
  priority=1 @{bin}/claude                    px,
  priority=1 @{bin}/docker                    px,
  priority=1 @{bin}/dpkg-query                px,
  priority=1 @{bin}/gh                        px,
  priority=1 @{bin}/git                       px,
  priority=1 @{bin}/glab                      px,
  priority=1 @{bin}/htop                      px,
  priority=1 @{bin}/ip                        px, #aa:lint ignore=sbin
  priority=1 @{bin}/journalctl                px -> child-journalctl-read,
  priority=1 @{bin}/lscpu                     px,
  priority=1 @{bin}/man                       px,
  priority=1 @{bin}/podman                    px,
  priority=1 @{bin}/ps                        px,
  priority=1 @{bin}/ssh                       px,
  priority=1 @{bin}/top                       px,
  priority=1 @{sbin}/ip                       px,

  # Well known shells tools
             @{bin}/starship pux,
  priority=1 @{user_cache_dirs}/gitstatus/gitstatusd{,-*} px,
  priority=1 /usr/share/zsh-theme-powerlevel{9,10}k/gitstatus/usrbin/gitstatusd{,-*} px,

  include if exists <abstractions/devrun.d>

# vim:syntax=apparmor
