From 1aa8b429823d50e235a5503ae2c08e48ffd2d939 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sun, 13 Apr 2025 21:09:10 +0200
Subject: [PATCH] feat(profile): add initial version of dpkg-maintscript-helper

---
 apparmor.d/groups/apt/dpkg-maintscript-helper | 41 +++++++++++++++++++
 dists/flags/main.flags                        |  1 +
 2 files changed, 42 insertions(+)
 create mode 100644 apparmor.d/groups/apt/dpkg-maintscript-helper

diff --git a/apparmor.d/groups/apt/dpkg-maintscript-helper b/apparmor.d/groups/apt/dpkg-maintscript-helper
new file mode 100644
index 000000000..b7d8675e8
--- /dev/null
+++ b/apparmor.d/groups/apt/dpkg-maintscript-helper
@@ -0,0 +1,41 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/dpkg-maintscript-helper
+profile dpkg-maintscript-helper @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} mr,
+
+  @{sh_path} rix,
+  @{bin}/basename rix,
+  @{bin}/dpkg rCx -> dpkg,
+
+  /usr/share/dpkg/sh/* r,
+
+  profile dpkg {
+    include <abstractions/base>
+    include <abstractions/consoles>
+    include <abstractions/common/apt>
+
+    capability dac_read_search,
+
+    @{bin}/dpkg mr,
+    @{bin}/dpkg-query rpx,
+
+    /etc/dpkg/dpkg.cfg r,
+    /etc/dpkg/dpkg.cfg.d/{,*} r,
+
+    include if exists <local/dpkg-maintscript-helper_dpkg>
+  }
+
+  include if exists <local/dpkg-maintscript-helper>
+}
+
+# vim:syntax=apparmor
diff --git a/dists/flags/main.flags b/dists/flags/main.flags
index 894945f2e..453d5f73a 100644
--- a/dists/flags/main.flags
+++ b/dists/flags/main.flags
@@ -86,6 +86,7 @@ dmsetup complain
 dockerd attach_disconnected,complain
 dolphin complain
 downloadhelper complain
+dpkg-maintscript-helper complain
 dpkg-script-apparmor complain
 dpkg-script-man complain
 dpkg-script-udev complain