mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 22:05:27 +00:00
Code Issues Releases Wiki Activity

Merge updated traceroute profile into 2.10 and 2.9 branch

Browse Source 
References: https://bugzilla.opensuse.org/show_bug.cgi?id=1057900


------------------------------------------------------------
revno: 3690 [merge]
committer: Steve Beattie <sbeattie@ubuntu.com>
branch nick: apparmor
timestamp: Wed 2017-08-09 08:57:36 -0700
message:
  traceroute profile: support TCP SYN for probes, quite net_admin request
  
  Merge from Vincas Dargis, approved by intrigeri.
  fix traceroute denies in tcp mode
  
  Acked-by: Steve Beattie <steve@nxnw.org>
------------------------------------------------------------


Backport to 2.10 and 2.9 branch

Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This commit is contained in:
Christian Boltz
2017-09-12 23:25:37 +02:00
parent 051f68a662
commit d62aaf0e1a
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
profiles/apparmor.d/usr.sbin.traceroute
View File

@@ -15,6 +15,7 @@
#include <abstractions/consoles>
#include <abstractions/nameservice>
deny capability net_admin, # noisy setsockopt() calls
capability net_raw,
network inet raw,
@@ -23,6 +24,7 @@
/usr/sbin/traceroute mrix,
/usr/bin/traceroute.db mrix,
@{PROC}/net/route r,
@{PROC}/sys/net/ipv4/{tcp_ecn,tcp_sack,tcp_timestamps,tcp_window_scaling} r,
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.traceroute>