Hello, Am Freitag, 11. September 2015 schrieb Thomas E. Horner: > I have an Ubuntu dns/mail/web server running pretty all services in > AppArmor. I want to give back the modified profiles to the community > so please find them attached to this message.
Thanks! > Please do not hesitate to come back with questions in case i forgot > something! I had a first look at the profiles that we also ship in the AppArmor tarball. The diff is in the attached file, which also includes some questions (for example, I never needed /tmp/* for dovecot imap, so I'm wondering if it is really needed). Do you have answers to [some of] the questions in the attachment? ;-) BTW: The file might look like a patch, but is heavily edited (I cleaned up unchanged lines, moved lines etc.), so don't even try to apply it automatically using the "patch" tool ;-) I didn't check the additional profiles and those that we ship in the extra directory yet. I'll do that in the next days, and probably will have some more questions after reading them ;-) > Please note that few files reside in non-common places, > e.g. * the mysql database-files for each domain is stored in > /home/domainname.tld/database/ Just curious - how do you configure that in MySQL? Regards, Christian Boltz -- Kurz gefasst: /etc/crontab ist IMHO so nützlich wie eine Laus in einem Raumanzug - es juckt, aber Du kannst Dich nicht kratzen, es sei denn, Du bist Gott auf Deinem System. Und dann weisst Du noch nicht mal, ob Du anstelle der Laus Deine Nase amputiert hast. [Jan Trippler in suse-linux]
diff -u -p ../../apparmor.d/usr.lib.dovecot.auth ./usr.lib.dovecot.auth --- ../../apparmor.d/usr.lib.dovecot.auth 2015-03-18 23:37:48.181591982 +0100 +++ ./usr.lib.dovecot.auth 2015-04-08 11:33:53.000000000 +0200 @@ -1,44 +1,36 @@ -# Copyright (C) 2013 Christian Boltz -# Copyright (C) 2014 Christian Wittmer +# Author: Kees Cook <[email protected]> + # looks like the Ubuntu profile started on its own, but we should merge it nevertheless ;-) # never needed those capabilities - any idea why they are needed? + capability chown, + capability dac_override, # doesn't exist on openSUSE - and I'm surprised why the .../auth profile needs mr on .../dovecot-auth (symlink?) + /usr/lib/dovecot/dovecot-auth mr, + /var/spool/postfix/private/dovecot-auth w, # really all files in /run/dovecot? Looks too broad. + /{,var/}run/dovecot/** rw, + @{PROC}/*/mounts r, diff -u -p ../../apparmor.d/usr.lib.dovecot.imap ./usr.lib.dovecot.imap --- ../../apparmor.d/usr.lib.dovecot.imap 2015-08-09 13:55:59.286306192 +0200 +++ ./usr.lib.dovecot.imap 2015-04-07 10:23:12.000000000 +0200 /usr/lib/dovecot/imap { + /run/dovecot/config rw, # I never needed /tmp/*... # Also, would the 'owner' restriction be ok? + /tmp/* rw, diff -u -p ../../apparmor.d/usr.lib.dovecot.imap-login ./usr.lib.dovecot.imap-login --- ../../apparmor.d/usr.lib.dovecot.imap-login 2014-12-22 17:55:58.412760000 +0100 +++ ./usr.lib.dovecot.imap-login 2015-04-03 13:55:26.000000000 +0200 /usr/lib/dovecot/imap-login { # that looks too broad - do you need access to other files besides anvil? + /run/dovecot/* rw, - /{,var/}run/dovecot/anvil rw, diff -u -p ../../apparmor.d/usr.lib.dovecot.pop3 ./usr.lib.dovecot.pop3 --- ../../apparmor.d/usr.lib.dovecot.pop3 2014-09-10 22:00:36.616976000 +0200 +++ ./usr.lib.dovecot.pop3 2015-06-26 14:07:23.000000000 +0200 /usr/lib/dovecot/pop3 { + /run/dovecot/auth-master rw, + /run/dovecot/config rw, + /run/dovecot/mounts r, # hmm, it never needed /tmp/* on my servers... # Also, would the 'owner' restriction be ok? + /tmp/* rw, diff -u -p ../../apparmor.d/usr.lib.dovecot.pop3-login ./usr.lib.dovecot.pop3-login --- ../../apparmor.d/usr.lib.dovecot.pop3-login 2014-09-10 22:00:36.616976000 +0200 +++ ./usr.lib.dovecot.pop3-login 2015-04-03 13:54:43.000000000 +0200 /usr/lib/dovecot/pop3-login { # I never needed this - and it looks too broad. Which of the files does it really need? + /run/dovecot/* rw, diff -u -p ../../apparmor.d/usr.sbin.apache2 ./usr.sbin.apache2 --- ../../apparmor.d/usr.sbin.apache2 2014-10-15 20:19:34.705810000 +0200 +++ ./usr.sbin.apache2 2015-09-10 13:46:15.000000000 +0200 /usr/sbin/apache2 { + #include <abstractions/apache2-common> + #include <abstractions/consoles> + #include <abstractions/kerberosclient> + #include <abstractions/mysql> + #include <abstractions/openssl> + #include <abstractions/perl> + #include <abstractions/php5> + #include <abstractions/python> + #include <abstractions/ssl_certs> + #include <abstractions/user-tmp> + #include <apache2.d> + capability chown, + capability sys_resource, + /usr/lib/passenger/agents/PassengerWatchdog rPx, # looks wrong - @{PROC}/@{pid} is a directory, so it should end with / (and that could also mean the rule is superfluous) + @{PROC}/@{pid} r, + @{PROC}/@{pid}/** r, ^DEFAULT_URI { + #include <abstractions/mysql> + #include <abstractions/nameservice> + #include <abstractions/perl> + #include <abstractions/php5> + #include <abstractions/python> + #include <abstractions/ssl_certs> + #include <abstractions/user-tmp> # that contains quite some internal information - any idea why you need this? + @{PROC}/*/smaps r, } ^HANDLING_UNTRUSTED_INPUT { # that's much too permissive for HANDLING_UNTRUSTED_INPUT + #include <abstractions/mysql> + #include <abstractions/nameservice> + #include <abstractions/perl> + #include <abstractions/php5> + #include <abstractions/python> + #include <abstractions/ssl_certs> + #include <abstractions/user-tmp> } diff -u -p ../../apparmor.d/usr.sbin.dovecot ./usr.sbin.dovecot --- ../../apparmor.d/usr.sbin.dovecot 2014-12-22 17:55:58.412760000 +0100 +++ ./usr.sbin.dovecot 2015-04-09 13:45:42.000000000 +0200 /usr/sbin/dovecot { # lots of differences, which are probably caused by ix vs Px diffs # and therefore hard to merge. # The easiest way would be to use the profiles from the AppArmor tarball # and then report missing bits ;-) + #include <abstractions/wutmp> + + capability audit_write, + # Allow sending signals to unconfined processes + signal (send) peer=unconfined, + # Allow sending signals to dovecot auth + signal (send) peer=/usr/lib/dovecot/auth, + # Allow us to signal ourselves + signal peer=@{profile_name}, + # Checking for PID existence is quite common so add it by default for now + signal (receive, send) set=("exists"), + + /etc/hosts.allow r, + /etc/hosts.deny r, - /etc/lsb-release r, - /etc/SuSE-release r, - @{PROC}/@{pid}/mounts r, + /lib{,32,64}/** mr, + @{PROC}/filesystems r, + @{PROC}/meminfo r, /usr/bin/doveconf rix, - /usr/lib/dovecot/anvil Px, - /usr/lib/dovecot/auth Px, - /usr/lib/dovecot/config Px, - /usr/lib/dovecot/dict Px, - /usr/lib/dovecot/dovecot-auth Pxmr, - /usr/lib/dovecot/imap Pxmr, - /usr/lib/dovecot/imap-login Pxmr, - /usr/lib/dovecot/lmtp Px, - /usr/lib/dovecot/log Px, - /usr/lib/dovecot/managesieve Px, - /usr/lib/dovecot/managesieve-login Pxmr, + /usr/lib/dovecot/anvil rix, + /usr/lib/dovecot/auth mrPx, + /usr/lib/dovecot/config rix, + /usr/lib/dovecot/imap mrPx, + /usr/lib/dovecot/imap-login mrPx, + /usr/lib/dovecot/log rix, /usr/lib/dovecot/pop3 Px, /usr/lib/dovecot/pop3-login mrPx, /usr/lib/dovecot/ssl-build-param rix, - /usr/lib/dovecot/ssl-params Px, + /usr/lib/dovecot/ssl-params rix, + /usr/lib/dovecot/tcpwrap rix, /usr/sbin/dovecot mrix, - /usr/share/dovecot/protocols.d/ r, - /usr/share/dovecot/protocols.d/** r, + /usr/share/dovecot/** r, - /var/lib/dovecot/ w, + /var/lib/dovecot/ rw, - /var/lib/dovecot/* rwkl, + /var/lib/dovecot/** rwlk, - /var/spool/postfix/private/auth w, - /var/spool/postfix/private/dovecot-lmtp w, } diff -u -p ../../apparmor.d/usr.sbin.nscd ./usr.sbin.nscd --- ../../apparmor.d/usr.sbin.nscd 2014-12-01 21:58:52.543947957 +0100 +++ ./usr.sbin.nscd 2015-09-04 08:33:19.000000000 +0200 + @{PROC}/@{pid}/maps r, diff -u -p ../../apparmor.d/usr.sbin.ntpd ./usr.sbin.ntpd --- ../../apparmor.d/usr.sbin.ntpd 2015-08-25 14:02:18.133896868 +0200 +++ ./usr.sbin.ntpd 2015-02-06 16:24:35.000000000 +0100 @@ -1,7 +1,9 @@ +# vim:syntax=apparmor +# Updated for Ubuntu by: Jamie Strandboge <[email protected]> # sounds like "Jamie should upstream the Ubuntu patches" ;-) /usr/sbin/ntpd flags=(attach_disconnected) { + #include <abstractions/user-tmp> + /etc/ntp.conf.dhcp r, # hmm, drift files in /etc/ ? + /etc/ntp.drift rwl, + /etc/ntp.drift.TEMP rwl, - /etc/ntp/step-tickers r, + /etc/ntp/** r, # see my pending patch - this might be a candidate for a deny rule (unless you have an idea why this could be useful) + /{usr/,usr/local/,}{s,}bin/ r, # do you have *drift files besides ntp.drift? + /var/lib/ntp/*drift rw, + /var/lib/ntp/*drift.TEMP rw, - /var/lib/ntp/ntp.drift rw, - /var/lib/ntp/ntp.drift.TEMP rw, + /var/lib/ntp/ntp.conf.dhcp r, + /var/log/ntpd w, + /var/log/ntpstats/clockstats* rwl, + /var/log/ntpstats/protostats* rwl, + /var/log/ntpstats/rawstats* rwl, + /var/log/ntpstats/sysstats* rwl, + /{,var/}run/samba/ntp_signd/socket rw, + @{PROC}/*/net/if_inet6 r, + @{PROC}/net/if_inet6 r, # Profiles not checked yet: Only in .: sbin.dhclient -> extras Only in .: usr.bin.freshclam -> extras Only in .: usr.bin.memcached Only in .: usr.bin.procmail -> extras Only in .: usr.lib.passenger.agents.PassengerWatchdog Only in .: usr.lib.postgresql.bin.postgres Only in .: usr.lib.sm.bin.sendmail Only in .: usr.local.sbin.fv_milter Only in .: usr.local.sbin.fv_milter-queued Only in .: usr.local.sbin.ss5 Only in .: usr.local.sendmail.wrapper Only in .: usr.sbin.clamav-milter Only in .: usr.sbin.clamd -> compare with cboltz profile Only in .: usr.sbin.logcheck Only in .: usr.sbin.mysqld -> extras Only in .: usr.sbin.named -> compare with cboltz profile Only in .: usr.sbin.opendkim Only in .: usr.sbin.rsyslogd -> compare with openSUSE extra profile Only in .: usr.sbin.saslauthd Only in .: usr.sbin.snmpd Only in .: usr.sbin.spamass-milter Only in .: usr.sbin.spamd Only in .: usr.sbin.sshd -> extras Only in .: usr.sbin.tcpdump Only in .: usr.sbin.useradd -> extras Only in .: usr.sbin.userdel -> extras Only in .: usr.sbin.vsftpd -> extras + cboltz Only in .: usr.sbin.xinetd -> extras Only in .: var.lib.dcc.libexec.dccifd Only in abstractions/: apache2-hat-common Only in abstractions/: dbus-login # looks like you should cleanup those two: Only in abstractions/: php5.dpkg-dist Only in abstractions/: php5.thor vim:ft=diff
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
