apparmor/profiles/apparmor.d/abstractions/mdns

# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # mdnsd
  /etc/mdns.allow r,
  /etc/nss_mdns.conf r,
  /{,var/}run/mdnsd w,
Bug 167798 - misc profile modifications from darix -- mlmmj, lighttpd, oidentd profiles in extras/, new postfix helpers in complain mode (enabled), split apart nameservice a little (non destructively), add new abstractions for python, ruby, and php5, add web-data and svn-repositories data-centric abstractions 2006-05-02 00:25:47 +00:00			`# ------------------------------------------------------------------`
			`#`
			`# Copyright (C) 2002-2006 Novell/SUSE`
			`#`
			`# This program is free software; you can redistribute it and/or`
			`# modify it under the terms of version 2 of the GNU General Public`
			`# License published by the Free Software Foundation.`
			`#`
			`# ------------------------------------------------------------------`

			`# mdnsd`
abstractions: add /etc/mdns.allow to /etc/apparmor.d/abstractions/mdns In focal users of mdns get denials in apparmor confined applications. An exampel can be found in the original bug below. It seems it is a common pattern, see https://github.com/lathiat/nss-mdns#etcmdnsallow Therefore I'm asking to add /etc/mdns.allow r, to the file /etc/apparmor.d/abstractions/mdns" by default. --- original bug --- Many repetitions of audit: type=1400 audit(1585517168.705:63): apparmor="DENIED" operation="open" profile="/usr/sbin/chronyd" name="/etc/mdns.allow" pid=1983815 comm="chronyd" requested_mask="r" denied_mask="r" fsuid=123 ouid=0 in log. I use libnss-mdns for .local name resolution, so /etc/nsswitch.conf contains hosts: files mdns [NOTFOUND=return] myhostname dns and /etc/mnds.allow contains the domains to resolve with mDNS (in may case, "local." and "local"; see /usr/share/doc/libnss-mdns/README.html.) Presumably cronyd calls a gethostbyX() somewhere, thus eventually trickling down through the name service switch and opening /etc/mdns.allow, which the AppArmor profile in the chrony package does not allow. Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1869629 Signed-off-by: John Johansen <john.johansen@canonical.com> (cherry picked from commit eeac8c11c935edf9eea2bed825af6c57e9fb52e3) 2020-03-31 21:01:21 -07:00			`/etc/mdns.allow r,`
Bug 167798 - misc profile modifications from darix -- mlmmj, lighttpd, oidentd profiles in extras/, new postfix helpers in complain mode (enabled), split apart nameservice a little (non destructively), add new abstractions for python, ruby, and php5, add web-data and svn-repositories data-centric abstractions 2006-05-02 00:25:47 +00:00			`/etc/nss_mdns.conf r,`
update for /var/run -> /run udev transition. For compatibility, distributions (eg Ubuntu) are providing a symlink from /var/run to /run, so our profiles should handle both situations. 2011-07-14 07:57:57 -05:00			`/{,var/}run/mdnsd w,`