diff --git a/profiles/apparmor.d/nc.openbsd b/profiles/apparmor.d/nc.openbsd new file mode 100644 index 000000000..61a41d6e9 --- /dev/null +++ b/profiles/apparmor.d/nc.openbsd @@ -0,0 +1,27 @@ +#------------------------------------------------------------------ +# Copyright (C) 2024 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +#------------------------------------------------------------------ +# vim: ft=apparmor + +abi , + +include + +profile nc.openbsd /usr/bin/nc.openbsd { + include + include + + file rw /**, + + # we need to enable all networking in order to allow DCCP (this also allows unix sockets) + network, + + /usr/bin/nc.openbsd mr, + + # Site-specific additions and overrides. See local/README for details. + include if exists +} diff --git a/tests/profiles/nc.openbsd/task.yaml b/tests/profiles/nc.openbsd/task.yaml new file mode 100644 index 000000000..80e10e5b9 --- /dev/null +++ b/tests/profiles/nc.openbsd/task.yaml @@ -0,0 +1,12 @@ +summary: smoke test for the nc.openbsd profile +execute: | + # IPv4, IPv6 + nc -4 -l 4321 & (echo "hi" | nc -4 -q 0 127.0.0.1 4321) + nc -6 -l 4321 & (echo "hi" | nc -6 -q 0 ::1 4321) + + # UNIX sockets + nc -l -U /tmp/socket & (echo "hi" | nc -q 0 -U /tmp/socket) + nc -l -U '@tmpsocket' & (echo "hi" | nc -q 0 -U '@tmpsocket') + + # The profile is attached based on the program path. + "$SPREAD_PATH"/tests/bin/actual-profile-of nc.openbsd | MATCH 'nc.openbsd \(enforce\)'