[apparmor] [patch] nscd profile

Seth Arnold seth.arnold at canonical.com
Tue Mar 5 18:43:37 UTC 2013


On Tue, Mar 05, 2013 at 07:25:46PM +0100, Christian Boltz wrote:
> Hello,
> 
> the following patch is the result of last night's discussion on IRC.
> (Well, at least for me it was night ;-)
> 
> 
> I propose this patch for trunk and the 2.8 branch.
> 
> 
> Add missing permissions to the nscd profile. 
> Also deny capability block_suspend because nobody can imagine why it 
> would be needed.
> 
> References: https://bugzilla.novell.com/show_bug.cgi?id=807104

Acked-by: Seth Arnold <seth.arnold at canonical.com>

> === modified file 'profiles/apparmor.d/usr.sbin.nscd'
> --- profiles/apparmor.d/usr.sbin.nscd   2013-01-02 23:34:38 +0000
> +++ profiles/apparmor.d/usr.sbin.nscd   2013-03-05 00:47:51 +0000
> @@ -16,6 +16,7 @@
>    #include <abstractions/nameservice>
>    #include <abstractions/ssl_certs>
>  
> +  deny capability block_suspend,
>    capability net_bind_service,
>    capability setgid,
>    capability setuid,
> @@ -31,9 +32,9 @@
>    /{,var/}run/.nscd_socket wl,
>    /{,var/}run/avahi-daemon/socket w,
>    /{,var/}run/nscd/ rw,
> -  /{,var/}run/nscd/db* wl,
> +  /{,var/}run/nscd/db* rwl,
>    /{,var/}run/nscd/socket wl,
> -  /var/{cache,run}/nscd/{passwd,group,services,hosts} rw,
> +  /var/{cache,run}/nscd/{passwd,group,services,hosts,netgroup} rw,
>    /{,var/}run/{nscd/,}nscd.pid rwl,
>    /var/log/nscd.log rw,
>    @{PROC}/@{pid}/fd/ r,
> @@ -41,6 +42,7 @@
>    @{PROC}/@{pid}/maps r,
>    @{PROC}/@{pid}/mounts r,
>    @{PROC}/filesystems r,
> +  @{PROC}/sys/vm/overcommit_memory r,
>  
>    # Site-specific additions and overrides. See local/README for details.
>    #include <local/usr.sbin.nscd>
> 
> 
> 
> 
> 
> Regards,
> 
> Christian Boltz
> -- 
> > Ich hab letztens nen Film gesehen, in dem sich zwei Irre unterhalten 
> > haben. Da hat der eine den anderen auch nicht verstanden.
> Stimmt, hast Recht. Wann haben wir übrigens wieder Freigang? ;)
> [> Martin Borchert und Bernd Brodesser in suse-linux]
> 
> 
> -- 
> AppArmor mailing list
> AppArmor at lists.ubuntu.com
> Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20130305/dd8e3b35/attachment.pgp>


More information about the AppArmor mailing list