[apparmor] unbound profile / chown

[Simon Deziel]

On 2016-05-29 03:52 PM, Christian Boltz wrote:
>>> Do we need to explicitely "deny capability chown," in the profile?
>>
>> Since the original issue remains, I think it should be re-added [1].
> 
> Thanks, merged.

Thank you.

>> In the meantime, you might want to try to the chroot feature :)
>>
>>   chroot: "/var/lib/unbound"
> 
> You probably know what happens if someone tells me "you might want to 
> try ...". If not, have a look at 
> https://bugzilla.opensuse.org/show_bug.cgi?id=982145

We've been through something similar on Debian/Ubuntu. The solution was
to augment the init script to setup the chroot then pass the in-chroot
path of the config file to unbound-checkconf.

The Debian maintainer has written a helper script [1] to factor this out
of the init script. Adding a "check_config" action to it would probably
make it suitable for reuse in your systemd unit.

Regards,
Simon

1:
https://anonscm.debian.org/cgit/pkg-dns/unbound.git/tree/debian/package-helper


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20160529/57618313/attachment.pgp>