#include <tunables/global>

/usr/bin/cobblerd {
  #include <abstractions/base>
  #include <abstractions/python>
  #include <abstractions/nameservice>
  #include <abstractions/p11-kit>

  # capabilities
  capability dac_override,
  
  # cobbler configuration
  /etc/cobbler/ r,
  /etc/cobbler/** r,
  /var/lib/cobbler/** rwk,
  /usr/share/cobbler/** rw,

  # pxe
  /var/lib/tftpboot/** r,
  /var/lib/tftpboot/pxelinux.cfg/** rw,
  
  # 'r' is needed when using imfile
  /var/log/cobbler/** rw,

  # apport
  /etc/default/apport r,

  # distro info
  /usr/share/distro-info/ubuntu.csv r,

  # other
  /etc/lsb-release r,
  /etc/debian_version r,
  /usr/bin/lsb_release rix,
  /etc/xinetd.d/tftp r,
  /bin/dash rmix,

  # apt
  /etc/apt/apt.conf.d/ r,
  /etc/apt/apt.conf.d/** r,

  # daemon
  /usr/bin/cobblerd r,
}