The base abstraction for unix sockets uses peer=(addr=none) with getattr, getopt, setopt and shutdown. This was added based on incorrect logging in early iterations of the abstract kernel patches which have since been fixed. These options don't make sense with peer=(addr=none), so drop that.
Acked-By: Jamie Strandboge <[email protected]> -- Jamie Strandboge http://www.ubuntu.com/
Author: Jamie Strandboge <[email protected]> Description: the base abstraction for unix sockets uses peer=(addr=none) with getattr, getopt, setopt and shutdown. This was added based on incorrect logging in early iterations of the abstract kernel patches which have since been fixed. These options don't make sense with peer=(addr=none), so drop that. Index: apparmor-2.8.96~2652/profiles/apparmor.d/abstractions/base =================================================================== --- apparmor-2.8.96~2652.orig/profiles/apparmor.d/abstractions/base +++ apparmor-2.8.96~2652/profiles/apparmor.d/abstractions/base @@ -136,8 +136,8 @@ # Allow us to create abstract and anonymous sockets unix (create), - # Allow us to getattr, getopt, setop and shutdown for anonymous sockets - unix (getattr, getopt, setopt, shutdown) peer=(addr=none), + # Allow us to getattr, getopt, setop and shutdown on unix sockets + unix (getattr, getopt, setopt, shutdown), # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked # filesystems generally. This does not appreciably decrease security with
signature.asc
Description: OpenPGP digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
