apparmor.d -> profiles

profiles/ip

@@ -0,0 +1,55 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2019-2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+# When "ip netns" is issued, the following error will be printed:
+#  "Failed name lookup - disconnected path" error=-13 profile="ip" name="".
+@{exec_path} = /{usr/,}bin/ip
+profile ip @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  # To be able to manage network interfaces.
+  capability net_admin,
+
+  # Needed?
+  #capability sys_admin,
+  audit deny capability sys_module,
+
+  network netlink raw,
+
+  @{exec_path} mrix,
+
+  mount options=(rw, rshared)   -> /{var/,}run/netns/,
+  mount options=(rw, rslave)    -> /,
+  mount options=(rw, bind)    / -> /{var/,}run/netns/*,
+  mount options=(rw, bind)    /etc/netns/firefox/resolv.conf -> /etc/resolv.conf,
+  mount fstype=sysfs            -> /sys/,
+
+  umount @{run}/netns/*,
+  umount /sys/,
+
+  /etc/iproute2/{,**} r,
+
+  / r,
+  owner @{run}/netns/ rw,
+        @{run}/netns/* rw,
+  /etc/netns/*/ r,
+
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/net/dev_mcast r,
+  owner @{PROC}/@{pid}/net/igmp{,6} r,
+  owner @{PROC}/sys/net/ipv{4,6}/route/flush w,
+
+  include if exists <local/ip>
+}