#include <tunables/global>

{{ launch_script }} {
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/nameservice>
  #include <abstractions/ubuntu-browsers.d/java>
  #include <abstractions/user-tmp>

  /etc/ssl/certs/** r,
  /etc/timezone r,
  /usr/bin/dash ix,
  /usr/lib/jvm/java-{{ java_version }}-openjdk-{{ ansible_local.dpkg.architecture }}/bin/java mrix,
  /usr/lib/jvm/java-{{ java_version }}-openjdk-{{ ansible_local.dpkg.architecture }}/lib/server/classes.jsa mr,
  /usr/share/java/java-atk-wrapper.jar r,
  {{ launch_script }} r,
  /proc/sys/net/core/somaxconn r,
  /proc/sys/net/ipv4/tcp_fastopen r,
  owner /proc/@{pid}/cgroup rw,
  owner /proc/@{pid}/coredump_filter rw,
  /proc/@{pid}/net/if_inet6 r,
  /proc/@{pid}/net/ipv6_route r,
  owner /proc/@{pid}/mountinfo r,
  owner /tmp/libnetty_transport_native_epoll_x86_*.so mrw,
  owner {{ installation_directory }}/server.*.jar r,
  owner {{ data_directory }}/ rw,
  owner {{ data_directory }}/** rwk,

}