[apparmor] [patch] winbindd profile: allow dac_override

[Steve Beattie]

On Wed, Aug 03, 2016 at 01:57:53PM +0200, Christian Boltz wrote:
> This is needed to delete kerberos ccache files, for details see
> https://bugzilla.opensuse.org/show_bug.cgi?id=990006#c5
> 
> I propose this patch for trunk, 2.10 and 2.9.

Acked-by: Steve Beattie <steve at nxnw.org> for all 3 branches. Thanks!

> [ winbind-dac_override.diff ]
> 
> === modified file 'profiles/apparmor.d/usr.sbin.winbindd'
> --- profiles/apparmor.d/usr.sbin.winbindd       2015-07-30 20:03:02 +0000
> +++ profiles/apparmor.d/usr.sbin.winbindd       2016-07-26 19:15:17 +0000
> @@ -7,6 +7,7 @@
>  
>    deny capability block_suspend,
>  
> +  capability dac_override,
>    capability ipc_lock,
>    capability setuid,
>  

-- 
Steve Beattie
<sbeattie at ubuntu.com>
http://NxNW.org/~steve/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20160803/fa8ce81e/attachment.pgp>