Index: npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-dagent
===================================================================
--- npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-dagent	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
+++ npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-dagent	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
@@ -0,0 +1,32 @@
+#include <tunables/global>
+
+/usr/sbin/kopano-dagent {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+  #include <abstractions/python>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability setgid,
+  capability setuid,
+
+  @{PROC}/@{pid}/task/@{tid}/comm rw,
+  @{PROC}/@{pid}/cmdline r,
+
+  /etc/gai.conf r,
+  /etc/gss/mech.d/ r,
+  /etc/gss/mech.d/*.conf r,
+  /etc/kopano/dagent.cfg r,
+
+  /usr/share/kopano-dagent/python/*.py{,c} r,
+
+  /var/lib/kopano/dagent/plugins/ r,
+
+  /etc/mapi/ r,
+  /etc/mapi/* r,
+
+  /run/kopano/dagent.pid rw,
+  /var/log/kopano/dagent.log rw,
+}
Index: npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-search
===================================================================
--- npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-search	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
+++ npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-search	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
@@ -0,0 +1,49 @@
+#include <tunables/global>
+
+/usr/sbin/kopano-search {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/python>
+  #include <abstractions/user-tmp>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability setgid,
+  capability setuid,
+
+  @{PROC}/@{pid}/cmdline r,
+  @{PROC}/@{pid}/mounts r,
+  @{PROC}/@{pid}/status r,
+  @{PROC}/@{pid}/task/@{tid}/comm rw,
+
+  deny /usr/lib/python2.7/dist-packages/kopano_search/*.pyc w,
+
+  # FIXME: it would be nice if search would use search- like pa
+  /dev/shm/* rwl,
+
+  /etc/gss/mech.d/ r,
+  /etc/gss/mech.d/*.conf r,
+
+  /lib/x86_64-linux-gnu/ld-*.so mr,
+  /usr/bin/python2.7 ix,
+  /usr/sbin/kopano-search r,
+
+  /etc/kopano/search.cfg r,
+
+  /bin/dash Pix,
+  /bin/rm Pix,
+  /sbin/ldconfig Pix,
+
+  /etc/mapi/ r,
+  /etc/mapi/kopano.inf r,
+  /etc/mapi/zcontacts.inf r,
+
+  /run/kopano/search.pid rw,
+  /run/kopano/search.pid.lock lrw,
+  /run/kopano/search.sock rw,
+  /run/kopano/*.*-* rw,
+
+  /var/lib/kopano/search/** rwlk,
+  /var/log/kopano/search.log rw,
+}
Index: npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-server
===================================================================
--- npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-server	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
+++ npl/mailserver/kopano_conf/example-config/apparmor.d/usr.sbin.kopano-server	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
@@ -0,0 +1,40 @@
+#include <tunables/global>
+
+/usr/sbin/kopano-server {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+  #include <abstractions/mysql>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability setgid,
+  capability setuid,
+
+  network tcp,
+
+  /etc/kopano/debian-db.cfg r,
+  /etc/kopano/server.cfg r,
+
+  @{PROC}/@{pid}/task/@{tid}/comm rw,
+
+  /run/kopano/prio.sock rw,
+  /run/kopano/server.pid rw,
+  /run/kopano/server.sock rw,
+
+  /usr/lib/x86_64-linux-gnu/kopano/*.so m,
+
+  /var/lib/kopano/attachments/ r,
+  /var/lib/kopano/attachments/** rw,
+  /var/log/kopano/server.log rw,
+
+  /etc/kopano/userscripts/* Cxr -> kopano_userscripts,
+
+  # There's little we can do if the server is allowed to run
+  # arbitrary scripts
+  profile kopano_userscripts {
+    file,
+    network,
+  }
+}
Index: npl/mailserver/kopano_conf/example-config/ldap.cfg
===================================================================
--- npl/mailserver/kopano_conf/example-config/ldap.cfg	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
+++ npl/mailserver/kopano_conf/example-config/ldap.cfg	(revision 1163be4bf981a8724c99a3990fcf4e43b12eb510)
@@ -0,0 +1,63 @@
+##############################################################
+#  LDAP DIRECTORY USER PLUGIN SETTINGS
+#
+
+# Select implementation.
+# If you have any reason to override settings from /usr/share/kopano/*.cfg,
+# do so at the end of this (/etc-resident) config file.
+#
+!include /usr/share/kopano/ldap.openldap.cfg
+#!include /usr/share/kopano/ldap.active-directory.cfg
+
+# LDAP host name/IP address
+ldap_host = localhost
+
+# LDAP port
+# Optional, default = 389
+# Use 636 for ldaps
+#ldap_port = 389
+
+# LDAP protocol
+# Optional, default = ldap
+# use 'ldaps' for Implicit SSL encryption. Make sure /etc/ldap/ldap.conf is
+# configured correctly with TLS_CACERT
+#ldap_protocol = ldap
+
+# LDAP URI
+# Optional, override ldap_host, ldap_port and ldap_protocol if set
+# e.g. ldaps://servername:port. You may also specify multiple space-separated
+# URIs
+#ldap_uri =
+
+# The charset that strings are stored in on the LDAP server. Normally this
+# is utf-8, but this can differ according to your setup. The charset specified
+# here must be supported by your iconv(1) setup. See iconv -l for all charset
+#ldap_server_charset = utf-8
+
+# The DN of the user to bind as for normal operations (not used for
+# authentication if ldap_authentication_method is set to "bind".
+# When empty, uses anonymous binding.
+# The userPassword attribute must be readable for this user if the
+# ldap_authentication_method option is set to password.
+ldap_bind_user =
+
+# LDAP bind password
+ldap_bind_passwd =
+
+# The timeout for network operations in seconds
+#ldap_network_timeout = 30
+
+# ldap_page_size limits the number of results from a query that will be downloaded at a time.
+# Default ADS MaxPageSize is 1000.
+#ldap_page_size = 1000
+
+##########
+# Object settings
+
+# Top level search base, every object should be available under this tree
+ldap_search_base =
+
+# Use custom defined LDAP property mappings
+# This is not a requirement for most environments but allows custom mappings of
+# special LDAP properties to custom MAPI attributes
+#!propmap /etc/kopano/ldap.propmap.cfg
