usr.lib.systemd.systemd-timesyncd

# vim:syntax=apparmor

#include <tunables/global>

# adjust in local
@{ETC_DIRS} = /etc /var/local/etc
#include if exists <local/tunables/3rd/usr.lib.systemd.systemd-timesyncd>

profile systemd_timesyncd /{,usr/}lib/systemd/systemd-timesyncd {                             # Debian
#profile systemd_timesyncd /{,usr/}lib/systemd/systemd-timesyncd flags=(attach_disconnected) { # Ubuntu
  #include <abstractions/base>
  #include <abstractions/3rd/nameservice-strict>

  capability sys_time,

  @{ETC_DIRS}/adjtime         r,
  /etc/systemd/timesyncd.conf r,

  owner @{PROC}/@{pid}/stat               r,
        @{PROC}/@{pid}/sched              r,
        @{PROC}/cmdline                   r,
        @{PROC}/sys/kernel/random/boot_id r,
        @{PROC}/sys/kernel/osrelease      r,

  owner /var/lib/systemd/timesync/clock           rw,
  owner /{,var/}run/systemd/timesync/synchronized rw,

  # Ubuntu
  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,

  /{,var/}run/systemd/journal/socket rw,
  /{,var/}run/systemd/notify         rw,
  /{,var/}run/dbus/system_bus_socket rw,

  dbus send
       bus=system
       path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
       member={Hello,RequestName}
       peer=(name=org.freedesktop.DBus),

  dbus bind
       bus=system
       name=org.freedesktop.timesync1,

  #include if exists <local/usr.lib.systemd.systemd-timesyncd>
}