mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

Deny CAP_SYS_ADMIN and cleanup profile

Browse Source 
Signed-off-by: john-breton <john.breton@canonical.com>
This commit is contained in:
john-breton 2025-04-22 07:19:13 -04:00
parent 0e8afc278d
commit 2e88bcf9f3
No known key found for this signature in database
GPG Key ID: F294825506581F28
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
profiles/apparmor.d/nslookup
View File

@ -16,25 +16,26 @@ include <tunables/global>
profile nslookup /usr/bin/nslookup { profile nslookup /usr/bin/nslookup {
include <abstractions/base> include <abstractions/base>
include <abstractions/terminfo>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/terminfo>
# requested on < plucky, no apparent impact if excluded but included as a sanity case # Requested on < plucky by libuv (bind9 dependency), no functional impact from denial
capability sys_admin, deny capability sys_admin,
# needed for network queries # Needed for network queries
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
# Read access is requested to the following locations during bare `nslookup`
/usr/bin/nslookup mr, /usr/bin/nslookup mr,
# read access is requested to the following locations during bare `nslookup`
/proc/version_signature r, /proc/version_signature r,
/sys/kernel/mm/transparent_hugepage/enabled r, /sys/kernel/mm/transparent_hugepage/enabled r,
# `nslookup` performs reads to its own thread often, needed for expected functionality # `nslookup` performs reads to its own thread often, needed for expected functionality
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/nslookup> include if exists <local/nslookup>
} }