[apparmor] [patch] nscd profile
Seth Arnold
seth.arnold at canonical.com
Tue Mar 5 18:43:37 UTC 2013
On Tue, Mar 05, 2013 at 07:25:46PM +0100, Christian Boltz wrote:
> Hello,
>
> the following patch is the result of last night's discussion on IRC.
> (Well, at least for me it was night ;-)
>
>
> I propose this patch for trunk and the 2.8 branch.
>
>
> Add missing permissions to the nscd profile.
> Also deny capability block_suspend because nobody can imagine why it
> would be needed.
>
> References: https://bugzilla.novell.com/show_bug.cgi?id=807104
Acked-by: Seth Arnold <seth.arnold at canonical.com>
> === modified file 'profiles/apparmor.d/usr.sbin.nscd'
> --- profiles/apparmor.d/usr.sbin.nscd 2013-01-02 23:34:38 +0000
> +++ profiles/apparmor.d/usr.sbin.nscd 2013-03-05 00:47:51 +0000
> @@ -16,6 +16,7 @@
> #include <abstractions/nameservice>
> #include <abstractions/ssl_certs>
>
> + deny capability block_suspend,
> capability net_bind_service,
> capability setgid,
> capability setuid,
> @@ -31,9 +32,9 @@
> /{,var/}run/.nscd_socket wl,
> /{,var/}run/avahi-daemon/socket w,
> /{,var/}run/nscd/ rw,
> - /{,var/}run/nscd/db* wl,
> + /{,var/}run/nscd/db* rwl,
> /{,var/}run/nscd/socket wl,
> - /var/{cache,run}/nscd/{passwd,group,services,hosts} rw,
> + /var/{cache,run}/nscd/{passwd,group,services,hosts,netgroup} rw,
> /{,var/}run/{nscd/,}nscd.pid rwl,
> /var/log/nscd.log rw,
> @{PROC}/@{pid}/fd/ r,
> @@ -41,6 +42,7 @@
> @{PROC}/@{pid}/maps r,
> @{PROC}/@{pid}/mounts r,
> @{PROC}/filesystems r,
> + @{PROC}/sys/vm/overcommit_memory r,
>
> # Site-specific additions and overrides. See local/README for details.
> #include <local/usr.sbin.nscd>
>
>
>
>
>
> Regards,
>
> Christian Boltz
> --
> > Ich hab letztens nen Film gesehen, in dem sich zwei Irre unterhalten
> > haben. Da hat der eine den anderen auch nicht verstanden.
> Stimmt, hast Recht. Wann haben wir übrigens wieder Freigang? ;)
> [> Martin Borchert und Bernd Brodesser in suse-linux]
>
>
> --
> AppArmor mailing list
> AppArmor at lists.ubuntu.com
> Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20130305/dd8e3b35/attachment.pgp>
More information about the AppArmor
mailing list