Package: msmtp Version: 1.6.6-1 Severity: wishlist Dear maintainer,
Please find a patch that ships an Apparmor [1] profile for msmtp's binary. Since Debian is planing to have Apparmor enabled by default [2] I thought it was a good time to submit this profile and reduce my local delta :) The profile was written with wide compatibility in mind and tested in my environment but it's possible that I missed some rules, if so, please let me know. If you decide to ship this profile, I would be glad to assist with any bug triage (related or not to Apparmor). Regards, Simon 1: https://wiki.debian.org/AppArmor 2: https://lists.debian.org/debian-devel/2017/08/msg00090.html
commit f9da17b83befa81877010427ee9fe4866bd56731 (HEAD -> msmtp-apparmor) Author: Simon Deziel <[email protected]> Date: Sat Dec 2 15:54:33 2017 -0500 Ship an Apparmor profile Signed-off-by: Simon Deziel <[email protected]> diff --git a/debian/README.Debian b/debian/README.Debian index e3fec4c..d2ed8d4 100644 --- a/debian/README.Debian +++ b/debian/README.Debian @@ -32,6 +32,16 @@ following rules in your ~/.vimrc: autocmd BufRead ~/.msmtprc set filetype=msmtp autocmd BufRead /etc/msmtprc set filetype=msmtp +Apparmor +======== + +/usr/bin/msmtp ships with an Apparmor profile restricting what the binary can +access. If you notice Apparmor denial logs in dmesg, please report them as +bugs or if they are specific to your environment, please add local rules to +/etc/apparmor.d/local/usr.bin.msmtp and reload the main profile with: + + # apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.msmtp + msmtp as a Mail Transport Agent =============================== diff --git a/debian/msmtp.dirs b/debian/msmtp.dirs index 4b2c48d..59f40c6 100644 --- a/debian/msmtp.dirs +++ b/debian/msmtp.dirs @@ -1,2 +1,3 @@ usr/share/vim/addons/syntax usr/share/vim/registry +etc/apparmor.d diff --git a/debian/msmtp.install b/debian/msmtp.install index d9dfd2d..c027ce4 100644 --- a/debian/msmtp.install +++ b/debian/msmtp.install @@ -2,3 +2,4 @@ debian/tmp/usr/bin/msmtp debian/tmp/usr/share/locale scripts/vim/msmtp.vim usr/share/vim/addons/syntax debian/msmtp.yaml usr/share/vim/registry +debian/usr.bin.msmtp etc/apparmor.d/ diff --git a/debian/rules b/debian/rules index 63002e9..3481874 100755 --- a/debian/rules +++ b/debian/rules @@ -36,6 +36,7 @@ override_dh_auto_build: override_dh_auto_install: $(MAKE) -C build install DESTDIR=$(CURDIR)/debian/tmp + dh_apparmor --profile-name=usr.bin.msmtp -p msmtp override_dh_link: # hook to create a symlink between /usr/share/doc/msmtp-gnome diff --git a/debian/usr.bin.msmtp b/debian/usr.bin.msmtp new file mode 100644 index 0000000..c2d87ac --- /dev/null +++ b/debian/usr.bin.msmtp @@ -0,0 +1,31 @@ +# Author: Simon Deziel <[email protected]> + +#include <tunables/global> + +/usr/bin/msmtp { + #include <abstractions/base> + #include <abstractions/nameservice> + #include <abstractions/p11-kit> + #include <abstractions/ssl_certs> + #include <abstractions/ssl_keys> + + /usr/bin/msmtp r, + /etc/aliases r, + /etc/msmtprc r, + /etc/netrc r, + owner @{HOME}/.msmtp* r, + owner @{HOME}/.netrc r, + owner @{HOME}/.tls-crls r, + + /tmp/ rw, + owner /tmp/msmtp* rw, + + # to type password interactively + owner /dev/pts/[0-9]* rw, + + # secret helpers + /usr/bin/secret-tool PUx, + /usr/bin/gpg{,2} PUx, + + #include <local/usr.bin.msmtp> +}
signature.asc
Description: OpenPGP digital signature
