<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif"> </div><div class="gmail_default" style="font-family:verdana,sans-serif">Hi It seems, that logrotate profile works. Everything is OK - no error or DENIED messages in log files etc. I'm testing this profile since four, five days. So, I just decided to paste the whole profile here, since I've added only a few rules. It should be easier to read and eventually change the logrotate profile in the future. Also, Mr Christian Boltz wrote, that in this case it's OK (see: <a href="https://lists.ubuntu.com/archives/apparmor/2016-November/010238.html">https://lists.ubuntu.com/archives/apparmor/2016-November/010238.html</a>). I think, that it's important to mention: I've changed the order of rules. For example: @{PROC} rules are now at the very end of a profile, capabilities are near the beginning after <abstractions/*> and so on. It just looks better and is easier to read, modify etc. That's just my opinion and it can be changed. I've decided to leave directories that are not in my system, but were in the default profile. They are marked with the '#' sign and described with a proper information about existence reason etc. If, for example there is an user using 'privoxy' - a privacy enhancing HTTP Proxy, he can just remove '#' sign and use one of these rules (of course depending on his architecture etc.): /var/lib/privoxy/log/** rwl, /var/lib64/privoxy/log/** rwl, One more thing about my comments: they are only for an informational purposes and should/could be removed. So, I hope that everything is okay even without using diff(1). Okay, so here's an updated 'etc.cron.daily.logrotate' profile (based on this one: <a href="https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/wily/apparmor/wily/view/head:/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate">https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/wily/apparmor/wily/view/head:/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate</a>): # Last Modified: Mon Dec 19 10:29:57 2016 # ------------------------------------------------------------------ # # Copyright (C) 2002-2006 Novell/SUSE # Copyright (C) 2016 Seth Arnold # Copyright (C) 2016 Daniel Curtis # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General # License published by the Free Software Foundation. # # ------------------------------------------------------------------ #include <tunables/global> /etc/cron.daily/logrotate { #include <abstractions/base> #include <abstractions/bash> #include <abstractions/nameservice> capability dac_override, capability dac_read_search, capability chown, capability fowner, capability fsetid, / r, /bin/sleep mrix, /bin/sed mixr, /bin/mv mixr, /bin/dash mrix, /bin/bash mrix, /bin/cat mrix, /bin/gzip mrix, /bin/kill mrix, /bin/logger mrix, /bin/true mrix, /usr/bin/head mrix, /usr/bin/killall mrix, /usr/sbin/invoke-rc.d mrix, /usr/sbin/logrotate mrix, </div><div class="gmail_default" style="font-family:verdana,sans-serif"> ## NOTE: please see 1., 2. </div><div class="gmail_default" style="font-family:verdana,sans-serif"> /sbin/initctl Ux, /sbin/runlevel Ux, /etc/cron.daily/logrotate r, /etc/logrotate.conf r, /etc/logrotate.d/ r, /etc/logrotate.d/* r, /etc/init.d/* mrix, /etc/lsb-base-logging.sh r, ## There is not such directory in 12.04 LTS. #/etc/subdomain.d/ r, /var/lib/logrotate/ r, /var/lib/logrotate/* rw, ## Handled by the previous rules. #/var/lib/logrotate.status rw, ## NOTE: it's a 32 bit system - so there is not lib64 directory. ## NOTE2: I'm not using privoxy. #/var/lib64/privoxy/log/** rwl, #/var/lib/privoxy/log/** rwl, ## NOTE3: Maybe it's better to use: #/var/lib{,64}/privoxy/log/** rwl, /var/log/ r, /var/log/** rwl, ## NOTE: there is not 'syslog.pid' but 'rsyslogd.pid' file #/{,var/}run/syslogd.pid r, /{,var/}run/rsyslogd.pid r, ## NOTE: I'm not using 'slrnpull', but maybe someone is. #/var/spool/slrnpull rw, #/var/spool/slrnpull/log* rwl, ## NOTE: I don't use samba and httpd, but maybe someone is. #/{run,var}/lock/samba r, #/{,var/}run/httpd.pid r, /tmp w, /tmp/file* wl, /tmp/logrot* rwl, /dev/tty rw, @{PROC} r, @{PROC}/[1-9]* r, } By the way: an official profile contains rule, which confused me: "/var/log r,". Does not should be there: "/var/log/ r,"? As we can see: missing "/". The same thing with: /etc/subdomain.d directory - I've added '/' to these rules. What do you think? The last and the most important thing: can someone check this profile; I mean from a security point of view? It's secure enough to use? Especially, I'm thinking about permissions for a /tmp directory ('rwl,' access) etc. </div><div class="gmail_default" style="font-family:verdana,sans-serif">Best regards. _____________ 1., 2.: <a href="https://lists.ubuntu.com/archives/apparmor/2016-December/010359.html">https://lists.ubuntu.com/archives/apparmor/2016-December/010359.html</a> <a href="https://lists.ubuntu.com/archives/apparmor/2016-December/010363.html">https://lists.ubuntu.com/archives/apparmor/2016-December/010363.html</a> </div><div class="gmail_default" style="font-family:verdana,sans-serif"> </div></div>