# Installed to /etc/apparmor.d/local/usr.bin.swtpm
#
# WHY THIS IS NEEDED
#
# Ubuntu ships an AppArmor profile for swtpm that permits libvirt's paths
# and essentially nothing else: /run/libvirt/qemu/swtpm/*.sock,
# /var/lib/libvirt/swtpm/**, and a couple of others. This suite does not
# use libvirt, so a TPM socket under /run/owuivm was refused with
# "Could not open UnixIO socket: Permission denied" - which reads like a
# file-mode problem and is not one. Nothing appears in dmesg for it
# either, because the profile denies quietly.
#
# Windows 11 will not install without a TPM, so this is the difference
# between having a Windows machine and not.
#
# <local/...> is the profile's own documented extension point, so this
# survives a swtpm package update in a way that editing the shipped
# profile would not.
#
# Narrow on purpose: one directory, whose contents are per-session TPM
# state that is thrown away with the session.
owner /run/owuivm/** rwk,
/run/owuivm/*/swtpm.sock rwk,