Control: tag -1 + patch Hi,
Here is your patch, along with patches for a few minor things that lintian picked up. Best, nicoo On Mon, Jul 04, 2016 at 04:27:39PM -0400, Robert Edmonds wrote: > > Hi, nicoo: > > I'd be happy to ship an apparmor profile for unbound in the Debian > package. Can you please send a patch that applies to the master branch > of the packaging repository? > > https://anonscm.debian.org/cgit/pkg-dns/unbound.git/ > > -- > Robert Edmonds > [email protected] >
From 9813632bbf8a7200c8a162025a560a6cf9f62687 Mon Sep 17 00:00:00 2001 From: Nicolas Braud-Santoni <[email protected]> Date: Fri, 5 Aug 2016 21:02:57 +0200 Subject: [PATCH 1/4] Ship AppArmor profile Closes #518002 --- debian/apparmor-profile | 45 +++++++++++++++++++++++++++++++++++++++++++++ debian/control | 2 ++ debian/rules | 5 +++++ 3 files changed, 52 insertions(+) create mode 100644 debian/apparmor-profile diff --git a/debian/apparmor-profile b/debian/apparmor-profile new file mode 100644 index 0000000..a351c5c --- /dev/null +++ b/debian/apparmor-profile @@ -0,0 +1,45 @@ +# Author: Simon Deziel +# vim:syntax=apparmor +#include <tunables/global> + +/usr/sbin/unbound { + #include <abstractions/base> + #include <abstractions/nameservice> + #include <abstractions/openssl> + + # needlessly chown'ing the PID + deny capability chown, + + capability net_bind_service, + capability setgid, + capability setuid, + capability sys_chroot, + capability sys_resource, + + # root trust anchor + owner /var/lib/unbound/root.key* rw, + + # root hints from dns-data-root + /usr/share/dns/root.* r, + + # non-chrooted paths + /etc/unbound/** r, + owner /etc/unbound/*.key* rw, + audit deny /etc/unbound/unbound_control.{key,pem} rw, + audit deny /etc/unbound/unbound_server.key w, + + # chrooted paths + /var/lib/unbound/** r, + owner /var/lib/unbound/**/*.key* rw, + audit deny /var/lib/unbound/**/unbound_control.{key,pem} rw, + audit deny /var/lib/unbound/**/unbound_server.key w, + + /usr/sbin/unbound mr, + + /{,var/}run/{unbound/,}unbound.pid rw, + + # Unix control socket + /{,var/}run/unbound.ctl rw, + + #include <local/usr.sbin.haveged> +} diff --git a/debian/control b/debian/control index be935c8..c39f5b2 100644 --- a/debian/control +++ b/debian/control @@ -9,6 +9,7 @@ Build-Depends: autotools-dev, bison, debhelper (>= 9~), + dh-apparmor, dh-autoreconf, dh-python, dh-systemd, @@ -82,6 +83,7 @@ Depends: ${shlibs:Depends}, Enhances: munin-node, +Suggests: apparmor Description: validating, recursive, caching DNS resolver Unbound is a recursive-only caching DNS server which can perform DNSSEC validation of results. It implements only a minimal amount of authoritative diff --git a/debian/rules b/debian/rules index 3aa274d..cef57e7 100755 --- a/debian/rules +++ b/debian/rules @@ -105,6 +105,11 @@ binary-arch: build dh_python2 --no-guessing-versions dh_strip dh_compress -Xusr/share/doc/unbound/examples/unbound.conf + + mkdir -p debian/unbound/etc/apparmor.d + cp debian/apparmor-profile debian/unbound/etc/apparmor.d/usr.sbin.unbound + dh_apparmor --profile-name=usr.sbin.unbound -punbound + dh_fixperms dh_makeshlibs dh_installdeb -- 2.8.1
From 520b0b1a0ce651a6e64a0ecd7607120bf3832c11 Mon Sep 17 00:00:00 2001 From: Nicolas Braud-Santoni <[email protected]> Date: Fri, 5 Aug 2016 21:07:55 +0200 Subject: [PATCH 2/4] debian/control: Use HTTPS for Vcs-Git link --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index c39f5b2..bac3cf3 100644 --- a/debian/control +++ b/debian/control @@ -28,7 +28,7 @@ Build-Depends: Standards-Version: 3.9.6 Homepage: https://www.unbound.net/ Vcs-Browser: https://anonscm.debian.org/cgit/pkg-dns/unbound.git -Vcs-Git: git://anonscm.debian.org/pkg-dns/unbound.git +Vcs-Git: https://anonscm.debian.org/git/pkg-dns/unbound.git Package: libunbound-dev Section: libdevel -- 2.8.1
From 091b55a6c0f1ab3621618ec85f9ee23aff9f0326 Mon Sep 17 00:00:00 2001 From: Nicolas Braud-Santoni <[email protected]> Date: Fri, 5 Aug 2016 21:13:39 +0200 Subject: [PATCH 3/4] Add documentation to the systemd unit file --- debian/unbound.service | 1 + 1 file changed, 1 insertion(+) diff --git a/debian/unbound.service b/debian/unbound.service index 549c8fe..7c1210a 100644 --- a/debian/unbound.service +++ b/debian/unbound.service @@ -1,5 +1,6 @@ [Unit] Description=Unbound DNS server +Documentation=man:unbound(8) After=network.target Before=nss-lookup.target Wants=nss-lookup.target -- 2.8.1
From d486dedc3077053fe80f5186d1a210c6c984c54d Mon Sep 17 00:00:00 2001 From: Nicolas Braud-Santoni <[email protected]> Date: Fri, 5 Aug 2016 21:15:18 +0200 Subject: [PATCH 4/4] Bump Standards-Version to 3.9.8 No change required --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index bac3cf3..9ab7b6a 100644 --- a/debian/control +++ b/debian/control @@ -25,7 +25,7 @@ Build-Depends: protobuf-c-compiler, python-all-dev (>= 2.6.6-3~), swig, -Standards-Version: 3.9.6 +Standards-Version: 3.9.8 Homepage: https://www.unbound.net/ Vcs-Browser: https://anonscm.debian.org/cgit/pkg-dns/unbound.git Vcs-Git: https://anonscm.debian.org/git/pkg-dns/unbound.git -- 2.8.1
signature.asc
Description: PGP signature
