[apparmor] [patch] Dovecot profile: change Px to mrPx for /usr/lib/dovecot/*

[Christian Boltz]

Hello,

some of the /usr/lib/dovecot/* rules already have mrPx permissions,
while others don't.

With a more recent kernel, I noticed that at least auth, config, dict,
lmtp, pop3 and ssl-params need mrPx instead of just Px (confirmed by the
audit.log and actual breakage caused by the missing mr permissions).

The mr additions for anvil, log and managesieve are just a wild guess,
but I would be very surprised if they don't need mr.


I propose this patch for trunk, 2.10 and 2.9.


[ dovecot-mr.diff ]

=== modified file 'profiles/apparmor.d/usr.sbin.dovecot'
--- profiles/apparmor.d/usr.sbin.dovecot        2016-11-29 20:35:14 +0000
+++ profiles/apparmor.d/usr.sbin.dovecot        2017-01-29 00:02:49 +0000
@@ -36,21 +36,21 @@
   /etc/SuSE-release r,
   @{PROC}/@{pid}/mounts r,
   /usr/bin/doveconf rix,
-  /usr/lib/dovecot/anvil Px,
-  /usr/lib/dovecot/auth Px,
-  /usr/lib/dovecot/config Px,
-  /usr/lib/dovecot/dict Px,
+  /usr/lib/dovecot/anvil mrPx,
+  /usr/lib/dovecot/auth mrPx,
+  /usr/lib/dovecot/config mrPx,
+  /usr/lib/dovecot/dict mrPx,
   /usr/lib/dovecot/dovecot-auth Pxmr,
   /usr/lib/dovecot/imap Pxmr,
   /usr/lib/dovecot/imap-login Pxmr,
-  /usr/lib/dovecot/lmtp Px,
-  /usr/lib/dovecot/log Px,
-  /usr/lib/dovecot/managesieve Px,
+  /usr/lib/dovecot/lmtp mrPx,
+  /usr/lib/dovecot/log mrPx,
+  /usr/lib/dovecot/managesieve mrPx,
   /usr/lib/dovecot/managesieve-login Pxmr,
-  /usr/lib/dovecot/pop3 Px,
+  /usr/lib/dovecot/pop3 mrPx,
   /usr/lib/dovecot/pop3-login Pxmr,
   /usr/lib/dovecot/ssl-build-param rix,
-  /usr/lib/dovecot/ssl-params Px,
+  /usr/lib/dovecot/ssl-params mrPx,
   /usr/sbin/dovecot mrix,
   /usr/share/dovecot/protocols.d/   r,
   /usr/share/dovecot/protocols.d/** r,



Regards,

Christian Boltz
-- 
<Ohmmmmm> Heiliger St.Tux öffne mir die Augen, welche durch jahrelangen
Missbrauch von KleinSoftFenster 3.1 - XP mit Fehlermeldungen zuge-
pflastert wurden, damit ich sehend werde für die Wunder des Reiches
das da heißt LINUX.</Ohmmmmm> (Heike Hautz in dcoulm)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20170129/6d35984c/attachment.pgp>