On 2016-04-20 05:17 PM, Matthew Dawson wrote: >> === modified file 'profiles/apparmor/profiles/extras/usr.sbin.sshd' >> --- profiles/apparmor/profiles/extras/usr.sbin.sshd 2013-01-05 06:31:00 > +0000 >> +++ profiles/apparmor/profiles/extras/usr.sbin.sshd 2016-01-02 13:44:20 > +0000 >> @@ -2,6 +2,8 @@ >> # >> # Copyright (C) 2002-2005 Novell/SUSE >> # Copyright (C) 2012 Canonical Ltd. >> +# Copyright (C) 2016 Christian Boltz >> +# Copyright (C) 2016 Evgeni Golov >> # >> # This program is free software; you can redistribute it and/or >> # modify it under the terms of version 2 of the GNU General Public >> @@ -26,14 +28,17 @@ >> capability sys_resource, >> capability sys_tty_config, >> capability net_bind_service, >> + capability net_admin, > > sshd doesn't actually require the net_admin capability. libpam-systemd tries > to use it if available to set the send/receive buffers size, but will fall > back to a non-privileged version if it fails. Considering what net_admin > would allow, I suggest removing it from the list (I'm running without it on > my > test apparmor server with no problems so far).
Interesting, I've updated [1] and it works well on all the systems I tested could test it. Thanks, Simon 1: https://code.launchpad.net/~sdeziel/apparmor/usr.sbin.sshd-refresh/+merge/282088
signature.asc
Description: OpenPGP digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
