Hello, the following patch is the result of last night's discussion on IRC. (Well, at least for me it was night ;-)
I propose this patch for trunk and the 2.8 branch. Add missing permissions to the nscd profile. Also deny capability block_suspend because nobody can imagine why it would be needed. References: https://bugzilla.novell.com/show_bug.cgi?id=807104 === modified file 'profiles/apparmor.d/usr.sbin.nscd' --- profiles/apparmor.d/usr.sbin.nscd 2013-01-02 23:34:38 +0000 +++ profiles/apparmor.d/usr.sbin.nscd 2013-03-05 00:47:51 +0000 @@ -16,6 +16,7 @@ #include <abstractions/nameservice> #include <abstractions/ssl_certs> + deny capability block_suspend, capability net_bind_service, capability setgid, capability setuid, @@ -31,9 +32,9 @@ /{,var/}run/.nscd_socket wl, /{,var/}run/avahi-daemon/socket w, /{,var/}run/nscd/ rw, - /{,var/}run/nscd/db* wl, + /{,var/}run/nscd/db* rwl, /{,var/}run/nscd/socket wl, - /var/{cache,run}/nscd/{passwd,group,services,hosts} rw, + /var/{cache,run}/nscd/{passwd,group,services,hosts,netgroup} rw, /{,var/}run/{nscd/,}nscd.pid rwl, /var/log/nscd.log rw, @{PROC}/@{pid}/fd/ r, @@ -41,6 +42,7 @@ @{PROC}/@{pid}/maps r, @{PROC}/@{pid}/mounts r, @{PROC}/filesystems r, + @{PROC}/sys/vm/overcommit_memory r, # Site-specific additions and overrides. See local/README for details. #include <local/usr.sbin.nscd> Regards, Christian Boltz -- > Ich hab letztens nen Film gesehen, in dem sich zwei Irre unterhalten > haben. Da hat der eine den anderen auch nicht verstanden. Stimmt, hast Recht. Wann haben wir übrigens wieder Freigang? ;) [> Martin Borchert und Bernd Brodesser in suse-linux] -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
