# Copyright 1999-2026. WebPros International GmbH. All rights reserved.
# Plesk additions/overrides for the OS-vendored proftpd AppArmor profile.
# Merged into /etc/apparmor.d/proftpd via its `include if exists <local/proftpd>`.
# Ubuntu 26.04+: the stock profile assumes /etc/proftpd/** and omits DAC bypass;
# Plesk uses /etc/proftpd.conf and reads /etc/shadow for PAM auth.

  # main config + drop-in includes
  /etc/proftpd.conf r,
  /etc/proftpd.d/ r,
  /etc/proftpd.d/** r,

  # mod_delay timing table (locked and written at login)
  /var/proftpd.delay rwk,

  # TLS material
  /opt/psa/admin/conf/httpsd.pem r,
  /opt/psa/etc/dhparams2048.pem r,

  # Plesk FTP logs
  /var/log/plesk/ r,
  /var/log/plesk/ftp_tls.log w,
  /var/log/plesk/xferlog w,

  # pam_systemd / logind session setup
  /run/systemd/io.systemd.Login rw,
  unix (bind) type=stream addr="@*/bus/in.proftpd/system",

  # PAM auth reads /etc/shadow and traverses user home dirs.
  # Read/search bypass only; dac_override intentionally not granted.
  capability dac_read_search,
