On Wed, 13 Jan 2016 at 13:04:00 +0100, intrigeri wrote:
> Just curious, how can I trigger them locally?
After further investigation of this issue, libnl-3-200 is actually
pulled into confined processes on my system via libnss-gw-name. So
I think this should actually be part of the nameservice abstraction,
and I'd like to suggest this alternative patch:
--- apparmor_2.10-3_amd64/etc/apparmor.d/abstractions/nameservice
2016-01-25 23:24:22.000000000 +0000
+++ /etc/apparmor.d/abstractions/nameservice 2016-02-02 13:49:52.929534484
+0000
@@ -93,3 +93,7 @@
# interface details
@{PROC}/@{pid}/net/route r,
+
+ # libnl-3-200 via libnss-gw-name
+ @{PROC}/@{pid}/net/psched r,
+ /etc/libnl-*/classid r,
Regards,
S
