# UniFi Endpoint: allow wg-quick to read the tmpfs-staged WireGuard config.
#
# The privileged helper writes /run/UniFi-Endpoint/wg/<iface>.conf at mode
# 0600 root:root in a 0700 root:root directory before invoking
# `wg-quick up <path>`. Stock Ubuntu profile (/etc/apparmor.d/wg-quick)
# only grants reads under /etc/wireguard/**, so wg-quick gets EACCES on
# our path even though it runs as root via pkexec - AppArmor denials
# apply regardless of uid.
#
# The tmpfs path is deliberate (see WgOps.cs class comment): credentials
# must not survive reboot, which rules out /etc/wireguard/. This local
# override is pulled in by the upstream `include if exists <local/wg-quick>`
# at the bottom of the profile, so the package upgrade path is automatic
# once /etc/apparmor.d/wg-quick is reloaded.

  /run/UniFi-Endpoint/wg/ r,
  /run/UniFi-Endpoint/wg/** r,
