Tor AppArmor Profile

#include <tunables/global>

/usr/sbin/tor {
  #include <abstractions/base>

  network tcp,

  # XXX: Why does Tor need UDP?
  network dgram,
  #deny network dgram,

  capability setgid,
  capability setuid,

  /etc/tor/* r,
  /usr/share/tor/** r,
  owner /var/lib/tor/** rwk,
  owner /var/log/tor/* w,
  owner /var/run/tor/tor.pid w,
}