Re: [apparmor] IPv6 support in various profiles

2012-04-17 Thread John Johansen
On 04/05/2012 01:47 PM, Christian Boltz wrote: > Hello, > sorry for the delay, very busy lately for some reason :/ > should we check all profiles if they need inet6 added? > yes, thanks for bringing this up > (Note that I don't have an IPv6 setup here, so I can't test it.) > > > A quick grep

Re: [apparmor] [patch] libapparmor: add support for ip addresses and ports

2012-04-17 Thread Steve Beattie
On Fri, Apr 13, 2012 at 05:24:49PM -0700, John Johansen wrote: > On 04/13/2012 05:07 PM, Christian Boltz wrote: > > Am Freitag, 6. April 2012 schrieb Steve Beattie: > >> Bugs: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/800826 > >> https://bugzilla.novell.com/show_bug.cgi?id=755923 >

Re: [apparmor] [patch] make tftp server for dnsmasq working

2012-04-17 Thread John Johansen
On 04/17/2012 01:00 PM, Seth Arnold wrote: > I'd like to voice my opposition for putting this style of tool in any > automatic position -- it feels as dirty as SELinux's relabeling daemon to me, > to give some idea of how much I dislike it -- by putting policy in > application configuration file

Re: [apparmor] [patch] make tftp server for dnsmasq working

2012-04-17 Thread Seth Arnold
I'd like to voice my opposition for putting this style of tool in any automatic position -- it feels as dirty as SELinux's relabeling daemon to me, to give some idea of how much I dislike it -- by putting policy in application configuration files we lose the ability to confine incorrect configur

Re: [apparmor] [patch] make tftp server for dnsmasq working

2012-04-17 Thread Christian Boltz
Hello, Am Montag, 16. April 2012 schrieb Steve Beattie: > The ideal solution would be something integrated into the dnsmasq init > script process that parses out the dnsmasq config enough to determine > the tftproot and sets a variable in an included file for the profile > before loading both the

[apparmor] [Bug 984300] [NEW] confined applications can't read /sys/module/apparmor/parameteres without capability mount

2012-04-17 Thread John Johansen
Public bug reported: /sys/module/apparmor/parameteres contains information about apparmor's availability but can not be accessed without capability mount. This requires that we expose this information via another mechanism as well, probably via the apparmorfs ** Affects: apparmor Importance