# MarlinOS rsyslog: allow mmenrich/mmwake (ex-wake, ADR-0075) plugins + libraries.
# /usr/lib/rsyslog/* rm covers every plugin .so (mmenrich.so, mmwake.so, mmsigma.so);
# the /var/db/wake data path is retained (CTI .thrt distribution dir, unchanged).
/usr/lib/rsyslog/ r,
/usr/lib/rsyslog/* rm,
/usr/lib/liblognorm.so* rm,
/usr/lib/libwake.so* rm,
/usr/lib/libmaxminddb.so* rm,
/var/db/wake/ r,
/var/db/wake/** r,
/var/db/wake/ r,
# flock (AppArmor "k"). prev_live_open takes LOCK_EX before it sizes
# /var/db/wake/prev.live. Read and write alone leave a 0-byte file and
# the publisher never runs. Same grant the stock profile uses on its spool.
/var/db/wake/** rwk,
/var/log/wake/ rw,
/var/log/wake/** rw,
# impstats "resource-usage" stat counts the daemon's own open fds by
# listing @{PROC}/@{pid}/fd/.  Without this grant the in:impstats thread
# logs an AppArmor "error reading /proc/<pid>/fd : Permission denied"
# denial every stats interval (60s).  Directory read only — impstats
# counts the entries, it never opens the fd targets.
@{PROC}/@{pid}/fd/ r,
