On Tue, Mar 05, 2013 at 07:25:46PM +0100, Christian Boltz wrote: > Hello, > > the following patch is the result of last night's discussion on IRC. > (Well, at least for me it was night ;-) > > > I propose this patch for trunk and the 2.8 branch. > > > Add missing permissions to the nscd profile. > Also deny capability block_suspend because nobody can imagine why it > would be needed. > > References: https://bugzilla.novell.com/show_bug.cgi?id=807104
Acked-by: Seth Arnold <[email protected]> > === modified file 'profiles/apparmor.d/usr.sbin.nscd' > --- profiles/apparmor.d/usr.sbin.nscd 2013-01-02 23:34:38 +0000 > +++ profiles/apparmor.d/usr.sbin.nscd 2013-03-05 00:47:51 +0000 > @@ -16,6 +16,7 @@ > #include <abstractions/nameservice> > #include <abstractions/ssl_certs> > > + deny capability block_suspend, > capability net_bind_service, > capability setgid, > capability setuid, > @@ -31,9 +32,9 @@ > /{,var/}run/.nscd_socket wl, > /{,var/}run/avahi-daemon/socket w, > /{,var/}run/nscd/ rw, > - /{,var/}run/nscd/db* wl, > + /{,var/}run/nscd/db* rwl, > /{,var/}run/nscd/socket wl, > - /var/{cache,run}/nscd/{passwd,group,services,hosts} rw, > + /var/{cache,run}/nscd/{passwd,group,services,hosts,netgroup} rw, > /{,var/}run/{nscd/,}nscd.pid rwl, > /var/log/nscd.log rw, > @{PROC}/@{pid}/fd/ r, > @@ -41,6 +42,7 @@ > @{PROC}/@{pid}/maps r, > @{PROC}/@{pid}/mounts r, > @{PROC}/filesystems r, > + @{PROC}/sys/vm/overcommit_memory r, > > # Site-specific additions and overrides. See local/README for details. > #include <local/usr.sbin.nscd> > > > > > > Regards, > > Christian Boltz > -- > > Ich hab letztens nen Film gesehen, in dem sich zwei Irre unterhalten > > haben. Da hat der eine den anderen auch nicht verstanden. > Stimmt, hast Recht. Wann haben wir übrigens wieder Freigang? ;) > [> Martin Borchert und Bernd Brodesser in suse-linux] > > > -- > AppArmor mailing list > [email protected] > Modify settings or unsubscribe at: > https://lists.ubuntu.com/mailman/listinfo/apparmor >
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
