abi <abi/3.0>,

include <tunables/global>
profile avahi-daemon /usr/{bin,sbin}/avahi-daemon flags=(complain) {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/dbus>
  include <abstractions/nameservice>

  capability chown,
  capability dac_override,
  capability kill,
  capability setuid,
  capability setgid,
  capability sys_chroot,

  network netlink dgram,

  /etc/avahi/ r,
  /etc/avahi/avahi-daemon.conf r,
  /etc/avahi/hosts r,
  /etc/avahi/services/ r,
  /etc/avahi/services/*.service r,
  @{PROC}/@{pid}/fd/ r,
  @{PROC}/1/environ r,
  @{PROC}/cmdline r,
  @{PROC}/sys/kernel/osrelease r,
  /usr/{bin,sbin}/avahi-daemon mr,
  /usr/share/avahi/introspection/*.introspect r,
  /usr/share/dbus-1/interfaces/org.freedesktop.Avahi.*.xml r,
  @{run}/avahi-daemon/ w,
  @{run}/avahi-daemon/pid krw,
  @{run}/avahi-daemon/socket w,
  @{run}/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.sbin.avahi-daemon>
}