usr.bin.secure-time-sync

#include <tunables/global>

profile secure-time-sync /usr/{,local/}bin/secure-time-sync flags=(attach_disconnected) {
  #include <abstractions/base>
  #include <abstractions/bash>

  capability sys_time,

  network raw,
  network inet,
  network inet6,

  owner /dev/tty rw,

  owner /etc/ca-certificates/** r,
  owner /etc/ssl/** r,

  owner /etc/host.conf r,
  owner /etc/hosts r,
  owner /etc/nsswitch.conf r,
  owner /etc/passwd r,
  owner /etc/resolv.conf r,
  owner /etc/gai.conf r,

  /usr/bin/bash ix,
  /usr/bin/curl mrix,
  /usr/bin/date mrix,
  /usr/bin/grep mrix,
  /usr/bin/id mrix,
  /usr/bin/sed mrix,
  /usr/{,local/}bin/secure-time-sync r,
}