mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 06:16:03 +00:00
Code Issues Releases Wiki Activity

traceroute profile: support TCP SYN for probes, quite net_admin request

Browse Source 
Merge from Vincas Dargis, approved by intrigeri.
fix traceroute denies in tcp mode

Acked-by: Steve Beattie <steve@nxnw.org>
This commit is contained in:
Steve Beattie
2017-08-09 08:57:36 -07:00
parent 77c2e27e6c 5b5da2b010
commit cfe2854740
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
profiles/apparmor.d/usr.sbin.traceroute
View File

@@ -15,6 +15,7 @@
#include <abstractions/consoles>
#include <abstractions/nameservice>
deny capability net_admin, # noisy setsockopt() calls
capability net_raw,
network inet raw,
@@ -23,6 +24,7 @@
/usr/sbin/traceroute mrix,
/usr/bin/traceroute.db mrix,
@{PROC}/net/route r,
@{PROC}/sys/net/ipv4/{tcp_ecn,tcp_sack,tcp_timestamps,tcp_window_scaling} r,
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.traceroute>