#include <tunables/global>

# AppArmor profile for an LXC container running inside the Coven.
# File: /etc/apparmor.d/lxc/lxc-sorcery-essence
#
# This profile is the "Immutable Vault". It allows containers to READ
# from the Tomb (to run their software) but strictly forbids WRITING,
# LINKING, or DELETING. A compromised container cannot poison the
# global Essence store.

profile lxc-sorcery-essence flags=(attach_disconnected, mediate_deleted) {
  #include <abstractions/lxc/container-default>

  # 1. Global Essence Store Access (READ ONLY)
  #    Prevents any container from modifying the master hashes
  /var/lib/sorcery/tomb/                   r,
  /var/lib/sorcery/tomb/**                 r,
  /var/lib/sorcery/essences/               r,
  /var/lib/sorcery/essences/**             r,

  # 2. Deny all write/append/link/rename/delete attempts
  deny /var/lib/sorcery/tomb/**            wklx,
  deny /var/lib/sorcery/essences/**        wklx,

  # 3. Allow BoltDB read-only access for local manifest verification
  /var/lib/sorcery/state/state.db          r,

  # 4. Allow the Sorcery-Go engine binary to execute
  /usr/local/bin/sorcery                   rix,
  /usr/local/bin/warding                   rix,
  /usr/local/bin/gaze                      rix,

  # 5. Allow writes only inside the container's own rootfs
  /var/lib/lxc/*/rootfs/**                 rwkl,
}