#include profile haproxy /usr/sbin/haproxy { #include #include #include #include #include capability net_bind_service, capability setgid, capability setuid, capability kill, capability sys_resource, capability sys_chroot, # those are needed for the stats socket creation capability chown, capability fowner, capability fsetid, network inet tcp, network inet6 tcp, /etc/haproxy/* r, /usr/sbin/haproxy rmix, /var/lib/haproxy/stats rwl, /var/lib/haproxy/stats.*.bak rwl, /var/lib/haproxy/stats.*.tmp rwl, /{,var/}run/haproxy.pid rw, /{,var/}run/haproxy-master.sock* rwlk, # Site-specific additions and overrides. See local/README for details. #include if exists #include if exists }