From e6939f4968d50bff639882e5bc34d81ea462ff4e Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Mon, 7 Jul 2025 00:37:07 +0200
Subject: [PATCH] feat(profile): add pgrep.

---
 apparmor.d/groups/procps/pgrep      | 22 ++++++++++++++++++++++
 tests/integration/procps/pgrep.bats | 19 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 apparmor.d/groups/procps/pgrep
 create mode 100644 tests/integration/procps/pgrep.bats

diff --git a/apparmor.d/groups/procps/pgrep b/apparmor.d/groups/procps/pgrep
new file mode 100644
index 000000000..950aeb99e
--- /dev/null
+++ b/apparmor.d/groups/procps/pgrep
@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/pgrep
+profile pgrep @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/app/pgrep>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  @{PROC}/tty/drivers r,
+
+  include if exists <local/pgrep>
+}
+
+# vim:syntax=apparmor
diff --git a/tests/integration/procps/pgrep.bats b/tests/integration/procps/pgrep.bats
new file mode 100644
index 000000000..9fd6b92f8
--- /dev/null
+++ b/tests/integration/procps/pgrep.bats
@@ -0,0 +1,19 @@
+#!/usr/bin/env bats
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+load ../common
+
+@test "pgrep: Return PIDs of any running processes with a matching command string" {
+    pgrep systemd
+}
+
+@test "pgrep: Search for processes including their command-line options" {
+    pgrep --full 'systemd'
+}
+
+@test "pgrep: Search for processes run by a specific user" {
+    pgrep --euid root systemd-udevd
+}
+