mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 22:35:35 +00:00
Code Issues Releases Wiki Activity

merge https://code.launchpad.net/~intrigeri/apparmor/dnsmasq-better-confine-libvirt-leaseshelper/+merge/267822

Browse Source 
from intrigery:
  dnsmasq profile: extract confinement of libvirt_leaseshelper into a dedicated sub-profile.

Acked-by: Christian Boltz <apparmor@cboltz.de>
This commit is contained in:
Christian Boltz
2015-12-30 22:09:07 +01:00
parent 514977f779 036e3adfa1
commit 9e6be07e7d
1 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
profiles/apparmor.d/usr.sbin.dnsmasq
View File

@@ -57,19 +57,16 @@
@{TFTP_DIR}/ r, @{TFTP_DIR}/ r,
@{TFTP_DIR}/** r, @{TFTP_DIR}/** r,
# libvirt config, lease and hosts files for dnsmasq # libvirt config and hosts file for dnsmasq
/var/lib/libvirt/dnsmasq/ r, /var/lib/libvirt/dnsmasq/ r,
/var/lib/libvirt/dnsmasq/* r, /var/lib/libvirt/dnsmasq/* r,
/var/lib/libvirt/dnsmasq/*.leases rw,
/var/lib/libvirt/dnsmasq/*.status* rw,
# libvirt pid files for dnsmasq # libvirt pid files for dnsmasq
/{,var/}run/libvirt/network/ r, /{,var/}run/libvirt/network/ r,
/{,var/}run/libvirt/network/*.pid rw, /{,var/}run/libvirt/network/*.pid rw,
# libvirt lease helper # libvirt lease helper
/usr/lib{,64}/libvirt/libvirt_leaseshelper ix, /usr/lib{,64}/libvirt/libvirt_leaseshelper Cx -> libvirt_leaseshelper,
/{,var/}run/leaseshelper.pid rwk,
# lxc-net pid and lease files # lxc-net pid and lease files
/{,var/}run/lxc/dnsmasq.pid rw, /{,var/}run/lxc/dnsmasq.pid rw,
@@ -81,6 +78,25 @@
/{,var/}run/NetworkManager/dnsmasq.conf r, /{,var/}run/NetworkManager/dnsmasq.conf r,
/{,var/}run/NetworkManager/dnsmasq.pid w, /{,var/}run/NetworkManager/dnsmasq.pid w,
profile libvirt_leaseshelper {
#include <abstractions/base>
/etc/libnl-3/classid r,
owner @{PROC}/@{pid}/net/psched r,
owner @{PROC}/@{pid}/status r,
/sys/devices/system/cpu/ r,
/sys/devices/system/node/ r,
/sys/devices/system/node/*/meminfo r,
# libvirt lease and status files for dnsmasq
/var/lib/libvirt/dnsmasq/*.leases rw,
/var/lib/libvirt/dnsmasq/*.status* rw,
/{,var/}run/leaseshelper.pid rwk,
}
# Site-specific additions and overrides. See local/README for details. # Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.dnsmasq> #include <local/usr.sbin.dnsmasq>
} }