On Mon, Nov 17, 2014 at 08:36:33PM +0100, Christian Boltz wrote: > Hello, > > Am Montag, 17. November 2014 schrieb Seth Arnold: > > On Sun, Nov 16, 2014 at 03:05:31PM +0100, Christian Boltz wrote: > > > Notes and questions: > > > There are some differences to abstractions/nameservice: > > > - abstractions/nameservice allows "host" instead of "hosts". Is this > > > really correct/intentional or is it a bug in the abstraction? > > > > Looks like a bug: http://codesearch.debian.net/search?q=nscd%2Fhost > > I tracked this down to > > revno: 1293 > committer: Jamie Strandboge <[email protected]> > branch nick: master > timestamp: Wed 2009-11-04 14:25:42 -0600 > message: > pull in Ubuntu updates to profiles/apparmor.d > > with quite some changes to abstractions/nameservice - one of them was > - /var/db/nscd/{passwd,group,services,hosts} r, > + /var/{db,cache,run}/nscd/{passwd,group,services,host} r, > > I'm slightly surprised that we managed to keep this bug for 3 years > without any complaints or bugreports ;-)
nscd is not as popular as it once was; I'm not sure there'd be much point in caching /etc/hosts anyhow. > Nevertheless, I propose the following patch (for trunk and 2.8). > Note that this will remove permissions for ..../nscd/host file, but it's > extremely unlikely that such a file exists. Acked-by: Seth Arnold <[email protected]> for both trunk and 2.8. Thanks > === modified file 'profiles/apparmor.d/abstractions/nameservice' > --- profiles/apparmor.d/abstractions/nameservice 2014-09-03 19:21:31 > +0000 > +++ profiles/apparmor.d/abstractions/nameservice 2014-11-17 19:28:15 > +0000 > @@ -47,7 +47,7 @@ > # to vast speed increases when working with network-based lookups. > /{,var/}run/.nscd_socket rw, > /{,var/}run/nscd/socket rw, > - /{var/db,var/cache,var/run,run}/nscd/{passwd,group,services,host} r, > + /{var/db,var/cache,var/run,run}/nscd/{passwd,group,services,hosts} r, > # nscd renames and unlinks files in it's operation that clients will > # have open > /{,var/}run/nscd/db* rmix, > > > Regards, > > Christian Boltz > -- > Also, ich hab mit win3.11 (damals war ich 2 jahre alt) angefangen und > hab dann alle Win-versionen erlebt, bis xp. Das war entgültig zuviel. > Danach war Schluss. Jetzt nur noch SuSE Linux. > [Soeren Wengerowsky in suse-linux] > > > -- > AppArmor mailing list > [email protected] > Modify settings or unsubscribe at: > https://lists.ubuntu.com/mailman/listinfo/apparmor >
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
