abi <abi/3.0>,

include <tunables/global>

profile kea-dhcp6 /usr/sbin/kea-dhcp6 {
  include <abstractions/base>
  include <abstractions/nameservice>

  # for MySQL access, localhost
  include <abstractions/mysql>
  include <abstractions/openssl>

  network inet dgram,
  network inet stream,
  network netlink raw,
  network packet raw,

  /etc/gss/mech.d/ r,
  /etc/gss/mech.d/* r,

  /etc/kea/ r,
  /etc/kea/** r,
  /usr/sbin/kea-dhcp6 mr,
  /usr/sbin/kea-lfc Px,

  owner /run/kea/kea-dhcp6.kea-dhcp6.pid w,
  owner /run/lock/kea/logger_lockfile rwk,

  # Control sockets
  # Before LP: #1863100, these were in /tmp. For compatibility, let's keep both
  # locations
  owner /{tmp,run/kea}/kea6-ctrl-socket w,
  owner /{tmp,run/kea}/kea6-ctrl-socket.lock rwk,

  owner /var/lib/kea/kea-dhcp6-serverid rw,

  # this includes .completed, .output, .pid, .[0-9]
  owner /var/lib/kea/kea-leases6.csv* rw,

  owner /var/log/kea/kea-dhcp6.log rw,
  owner /var/log/kea/kea-dhcp6.log.[0-9]* rw,
  owner /var/log/kea/kea-dhcp6.log.lock rwk,

}