James Troup has proposed merging lp:~elmo/apparmor-profiles/bprobe into lp:apparmor-profiles.
Requested reviews: AppArmor Developers (apparmor-dev) For more details, see: https://code.launchpad.net/~elmo/apparmor-profiles/bprobe/+merge/127090 An apparmor profile for bprobe, the client side agent of Boundary (http://boundary.com/). bprobe uses libpcap, so the profile looks superficially similar to tcpdump but is more restrictive. I've included versions for 8.04, 10.04 and 12.04, i.e. all current LTSes. All have been tested and are in use in production. -- https://code.launchpad.net/~elmo/apparmor-profiles/bprobe/+merge/127090 Your team AppArmor Developers is requested to review the proposed merge of lp:~elmo/apparmor-profiles/bprobe into lp:apparmor-profiles.
=== added file 'ubuntu/10.04/usr.local.bin.bprobe' --- ubuntu/10.04/usr.local.bin.bprobe 1970-01-01 00:00:00 +0000 +++ ubuntu/10.04/usr.local.bin.bprobe 2012-09-29 03:20:23 +0000 @@ -0,0 +1,43 @@ +# vim:syntax=apparmor +# Author: James Troup <[email protected]> + +#include <tunables/global> + +/usr/local/bin/bprobe { + #include <abstractions/base> + #include <abstractions/nameservice> + + capability net_admin, + capability net_raw, + capability setgid, + capability setuid, + capability sys_module, + + network packet dgram, + network packet raw, + + /usr/local/bin/bprobe mr, + /usr/local/lib/lib*so* mr, + + /etc/bprobe/* r, + /var/run/bprobe.pid w, + + # These files are used to determine basic system information + # that's sent up to Boundary and used in e.g. dynamic groups + /etc/issue r, + /sys/devices/system/cpu/ r, + /sys/devices/system/cpu/cpu[0-9]*/cpufreq/cpuinfo_max_freq r, + + # for finding an interface + @{PROC}/[0-9]*/net/dev r, + /sys/class/net/ r, + + # for tracing USB bus, which libpcap supports + /dev/usbmon* r, + /dev/bus/usb/ r, + /dev/bus/usb/** r, + /sys/bus/usb/devices/ r, + + # for USB probing (see libpcap-1.1.x/pcap-usb-linux.c:probe_devices()) + /dev/bus/usb/**/[0-9]* w, +} === added file 'ubuntu/12.04/usr.local.bin.bprobe' --- ubuntu/12.04/usr.local.bin.bprobe 1970-01-01 00:00:00 +0000 +++ ubuntu/12.04/usr.local.bin.bprobe 2012-09-29 03:20:23 +0000 @@ -0,0 +1,42 @@ +# vim:syntax=apparmor +# Author: James Troup <[email protected]> + +#include <tunables/global> + +/usr/local/bin/bprobe { + #include <abstractions/base> + #include <abstractions/nameservice> + + capability net_admin, + capability net_raw, + capability setgid, + capability setuid, + capability sys_module, + + network packet dgram, + network packet raw, + + /usr/local/bin/bprobe mr, + /usr/local/lib/lib*so* mr, + + /etc/bprobe/* r, + /run/bprobe.pid w, + + # These two files are used to determine basic system information + # that's sent up to Boundary and used in e.g. dynamic groups + /etc/issue r, + /sys/devices/system/cpu/ r, + + # for finding an interface + @{PROC}/[0-9]*/net/dev r, + /sys/class/net/ r, + + # for tracing USB bus, which libpcap supports + /dev/usbmon* r, + /dev/bus/usb/ r, + /dev/bus/usb/** r, + /sys/bus/usb/devices/ r, + + # for USB probing (see libpcap-1.1.x/pcap-usb-linux.c:probe_devices()) + /dev/bus/usb/**/[0-9]* w, +} === added file 'ubuntu/8.04/usr.local.bin.bprobe' --- ubuntu/8.04/usr.local.bin.bprobe 1970-01-01 00:00:00 +0000 +++ ubuntu/8.04/usr.local.bin.bprobe 2012-09-29 03:20:23 +0000 @@ -0,0 +1,42 @@ +# vim:syntax=apparmor +# Author: James Troup <[email protected]> + +#include <tunables/global> + +/usr/local/bin/bprobe { + #include <abstractions/base> + #include <abstractions/nameservice> + + capability net_admin, + capability net_raw, + capability setgid, + capability setuid, + capability sys_module, + + network packet dgram, + network packet raw, + + /usr/local/bin/bprobe mr, + /usr/local/lib/lib*so* mr, + + /etc/bprobe/* r, + /var/run/bprobe.pid w, + + # These two files are used to determine basic system information + # that's sent up to Boundary and used in e.g. dynamic groups + /etc/issue r, + /sys/devices/system/cpu/ r, + + # for finding an interface + @{PROC}/net/dev r, + /sys/class/net/ r, + + # for tracing USB bus, which libpcap supports + /dev/usbmon* r, + /dev/bus/usb/ r, + /dev/bus/usb/** r, + /sys/bus/usb/devices/ r, + + # for USB probing (see libpcap-1.1.x/pcap-usb-linux.c:probe_devices()) + /dev/bus/usb/**/[0-9]* w, +}
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
