<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> HI It's my current profile for Postgresql-11.1 running on Gentoo Linux, where /media/bazy/db/postgresql*/ is custom locations for SQL datadir. > # Last Modified: Thu Jan 17 18:26:07 2019 > #include <tunables/global> > > profile postgres /usr/lib{32,64,}/postgresql-1*/bin/postgres flags=(attach_disconnected) { > #include <abstractions/base> > #include <abstractions/consoles> > #include <abstractions/nameservice> > #include <abstractions/openssl> > #include <abstractions/postgresql> > #include <abstractions/private-files> > #include <abstractions/ssl_certs> > #include <abstractions/ssl_keys> > #include <abstractions/sslcerty> > > capability dac_override, > capability dac_read_search, > capability setgid, > capability setuid, > capability sys_chroot, > > network inet dgram, > network inet stream, > network inet6 dgram, > network inet6 stream, > > signal, > > unix (create, send, receive ), > unix (getattr, getopt, setopt, shutdown), > > /** r, > /dev/null rw, > /dev/zero rw, > /etc/postgresql-*/ r, > /etc/postgresql-*/** r, > /etc/ssl/postgresql/* r, > /lib{,32,64}/ld-*.so mr, > /lib{,32,64}/libc-*.so mr, > /lib{,32,64}/libdl-*.so mr, > /lib{,32,64}/libm-*.so mr, > /lib{,32,64}/libnss_files-*.so mr, > /lib{,32,64}/libpam.so.* mr, > /lib{,32,64}/libpthread-*.so mr, > /lib{,32,64}/libresolv-*.so mr, > /lib{,32,64}/librt-*.so mr, > /lib{,32,64}/libz.so* mr, > /media/bazy/db/postgresql*/ rw, > /media/bazy/db/postgresql*/** rwlk, > /usr/lib{,32,64}/binutils/** mr, > /usr/lib{,32,64}/gcc/** mr, > /usr/lib{,32,64}/gconv/gconv-modules.cache mr, > /usr/lib{,32,64}/libcrypto.so* mr, > /usr/lib{,32,64}/libicudata.so.* mr, > /usr/lib{,32,64}/libicuuc.so.* mr, > /usr/lib{,32,64}/libssl.so* mr, > /usr/lib{,32,64}/libxml2.so.* mr, > /usr/lib{,32,64}/locale/** mr, > /usr/lib{,32,64}/postgresql-*/** mrix, > /usr/share/locale/** mr, > /usr/share/postgresql-*/** mr, > /var/log/postgresql/* w, > /{,var/}run/postgresql rw, > /{,var/}run/postgresql/** rwk, > @{PROC}/@{pid}/net/if_inet6 r, > @{PROC}/@{pid}/net/ipv6_route r, > @{PROC}/filesystems r, > @{PROC}/sys/vm/overcommit_memory r, > owner / rw, > owner /dev/shm/PostgreSQL.* mrwlk, > owner /tmp/** rwk, > owner @{PROC}/@{pid}/cmdline r, > owner @{PROC}/@{pid}/fd/ r, > owner @{PROC}/@{pid}/fd/* r, > owner @{PROC}/@{pid}/maps r, > owner @{PROC}/@{pid}/mountinfo r, > owner @{PROC}/@{pid}/stat r, > owner @{PROC}/@{pid}/statm r, > owner @{PROC}/@{pid}/status r, > owner @{PROC}/@{pid}/task/[0-9]*/stat r, > > } Postgresql is run by daemontools: >root 6895 0.0 0.0 4224 760 ? S 06:55 0:00 supervise postgresql11 >postgres 17476 0.0 0.3 90732 28264 ? S 07:08 0:00 /usr/bin/postmaster11 -D /etc/postgresql-11 --data-directory=/media/bazy/db/postgresql/data11 -N 512 -B 1024 >postgres 17483 0.0 0.0 52988 2668 ? Ss 07:08 0:00 postgres: logger >postgres 17485 0.0 0.0 90732 3148 ? Ss 07:08 0:00 postgres: checkpointer >postgres 17486 0.0 0.0 90868 3148 ? Ss 07:08 0:00 postgres: background writer >postgres 17487 0.0 0.0 90732 4440 ? Ss 07:08 0:00 postgres: walwriter >postgres 17488 0.0 0.0 91540 5912 ? Ss 07:08 0:00 postgres: autovacuum launcher >postgres 17489 0.0 0.0 55084 2636 ? Ss 07:08 0:00 postgres: stats collector >postgres 17490 0.0 0.0 91376 5920 ? Ss 07:08 0:00 postgres: logical replication launcher Cheers <div class="moz-cite-prefix">W dniu 22.03.2019 o 15:07, Espresso Beanies pisze: </div> <blockquote type="cite" cite="mid:CAOeD169J-zEZRoYX4nZpRFWV81rjBX5k6x9Hka9jwLypLtUeiw@mail.gmail.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr"> <div dir="ltr">I'm trying to develop an Apparmor profile for PostgreSQL 10 based on the existing profile here (<a href="https://gitlab.com/apparmor/apparmor-profiles/blob/master/ubuntu/18.04/usr.lib.postgresql.bin.postgres" moz-do-not-send="true">https://gitlab.com/apparmor/apparmor-profiles/blob/master/ubuntu/18.04/usr.lib.postgresql.bin.postgres</a>) however when I go to generate the profile based on the postgres executable location, I get the following results: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> # Last Modified: Fri Mar 22 09:59:25 2019 #include <tunables/global> /usr/lib/postgresql/10/bin/postgres { #include <abstractions/base> /lib/x86_64-linux-gnu/ld-*.so mr, /usr/lib/postgresql/10/bin/postgres mr, owner /etc/postgresql/10/main/postgresql.conf r, }</blockquote> <div> </div> <div>There seems to be a number of things absent from the profile itself and since PostgreSQL 10, there also appear to be a number of new locations that contains resources that the program uses. I find these fun and I'd like to do more, but I want to make sure they're created properly.</div> <div> </div> <div>Thanks! </div> </div> </div> <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> </body> </html>