[apparmor] [PATCH 2/4] profiles: Add strict session bus abstraction
jamie at canonical.com
Thu Jan 9 21:03:23 UTC 2014
On 01/09/2014 02:28 PM, Tyler Hicks wrote:
> On 2014-01-07 16:39:44, Jamie Strandboge wrote:
>> On 01/03/2014 04:26 PM, Tyler Hicks wrote:
>>> Move the file rule from the existing permissive session bus abstraction
>>> into a new strict session bus abstraction.
>> Thanks for all these! This is a really good idea. Sorry for not responding sooner.
> No problem! I thought you'd like these patches since they should make
> some of your profiles smaller. :)
>>> diff --git a/profiles/apparmor.d/abstractions/dbus-session b/profiles/apparmor.d/abstractions/dbus-session
>>> index 76a7bbf..2eda4e0 100644
>>> --- a/profiles/apparmor.d/abstractions/dbus-session
>>> +++ b/profiles/apparmor.d/abstractions/dbus-session
>>> - /usr/bin/dbus-launch ix,
>>> diff --git a/profiles/apparmor.d/abstractions/dbus-session-strict b/profiles/apparmor.d/abstractions/dbus-session-strict
>>> + /usr/bin/dbus-launch ix,
>> First off, can we change this to be 'Pix'?
> IMO, modifying this rule should happen separate from this patch set. (but that
> doesn't mean we can't discuss it...)
> It used to be Pix. Take a look at r1722. Here's the commit message:
> profiles/apparmor.d/abstractions/dbus-session: Per discussion with John
> Johansen, use 'ix' instead of 'Pix' for dbus-launch since if someone happens to
> define a profile for dbus-launch and it is loosely confined, then users of this
> abstraction could end up launching a program via dbus-launch in a less confined
> manner than intended. This sort of thing should not be possible via an
> abstraction (and people are always free to profile using Pix if they prefer).
> Would 'Pix -> dbus_launch', as you suggest below, fix the problem that John
> pointed out? I think it would but I'm not 100% sure.
Thanks for bringing this up-- I forgot about this commit. Let's keep it as 'ix'
for now (see John's response).
Jamie Strandboge http://www.ubuntu.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 901 bytes
Desc: OpenPGP digital signature
More information about the AppArmor