mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-29 13:28:19 +00:00
profiles: Add a hosts_access abstraction
Host files accessed by tcp_wrapper can reference other files, from man 5 hosts.allow ``` A string that begins with a '/' character is treated as a file name. A host name or address is matched if it matches any host name or address pattern listed in the named file. The file format is zero or more lines with zero or more host name or address patterns separated by whitespace. A file name pattern can be used anywhere a host name or address pattern can be used. ``` This means adding a file to hosts requires updating multiple profiles Add a hosts abstraction so users only have to modify a single location. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/605 Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1864466 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Christian Boltz <apparmor@cboltz.de>
This commit is contained in:
John Johansen
parent
e1ba76375b
commit
eb8f9302aa
17
profiles/apparmor.d/abstractions/hosts_access
Normal file
17
profiles/apparmor.d/abstractions/hosts_access
Normal file
@ -0,0 +1,17 @@
|
||||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020 Canonical Ltd.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
/etc/hosts.deny r,
|
||||
/etc/hosts.allow r,
|
||||
|
||||
include if exists <abstractions/hosts_access.d>
|
||||
@ -24,6 +24,7 @@ profile syslog-ng /{usr/,}{bin,sbin}/syslog-ng {
|
||||
include <abstractions/mysql>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/python>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
@ -47,8 +48,6 @@ profile syslog-ng /{usr/,}{bin,sbin}/syslog-ng {
|
||||
/etc/syslog-ng/conf.d/ r,
|
||||
/etc/syslog-ng/conf.d/* r,
|
||||
@{PROC}/kmsg r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/hosts.allow r,
|
||||
/{usr/,}{bin,sbin}/syslog-ng mr,
|
||||
@{sys}/devices/system/cpu/online r,
|
||||
/usr/share/syslog-ng/** r,
|
||||
|
||||
@ -48,14 +48,13 @@ profile dovecot-dovecot-lda /usr/lib/dovecot/dovecot-lda flags=(attach_disconnec
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/user-tmp>
|
||||
include <abstractions/postfix-common>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
/etc/aliases rw, # newaliases is a symlink to sendmail, so it's
|
||||
/etc/aliases.db rw, # actually the same binary
|
||||
/etc/fstab r,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/mail/* r,
|
||||
/etc/mail/statistics rw,
|
||||
/etc/mtab r,
|
||||
|
||||
@ -15,13 +15,12 @@ include <tunables/global>
|
||||
profile portmap /{usr/,}sbin/portmap {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability net_bind_service,
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
|
||||
/etc/bindresvport.blacklist r,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/{usr/,}sbin/portmap rmix,
|
||||
}
|
||||
|
||||
@ -9,6 +9,7 @@ include <tunables/global>
|
||||
include <abstractions/dbus>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/perl>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
@ -44,8 +45,6 @@ include <tunables/global>
|
||||
/etc/cups/printcap rw,
|
||||
/etc/cups/ssl rw,
|
||||
/etc/cups/yes/* rw,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
@{PROC}/meminfo r,
|
||||
@{PROC}/sys/dev/parport/** r,
|
||||
/sys/class/usb r,
|
||||
|
||||
@ -15,6 +15,7 @@ include <tunables/global>
|
||||
/usr/sbin/dhcpd {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability dac_override,
|
||||
capability net_bind_service,
|
||||
@ -29,8 +30,6 @@ include <tunables/global>
|
||||
/db/dhcpd.leases* lrw,
|
||||
/etc/dhcpd.conf r,
|
||||
/etc/named.d/* r,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
@{PROC}/net/dev r,
|
||||
/usr/sbin/dhcpd rmix,
|
||||
/var/lib/dhcp/{db/,}dhcpd{6,}.leases* rwl,
|
||||
|
||||
@ -21,13 +21,12 @@ include <tunables/global>
|
||||
include <abstractions/mysql>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/user-tmp>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability dac_override,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/my.cnf r,
|
||||
/etc/my.cnf.d/ r,
|
||||
/etc/my.cnf.d/*.cnf r,
|
||||
|
||||
@ -22,14 +22,13 @@ include <tunables/global>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/user-tmp>
|
||||
include <abstractions/postfix-common>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
/usr/bin/procmail Px,
|
||||
|
||||
/etc/aliases.db rw,
|
||||
/etc/aliases rw,
|
||||
/etc/fstab r,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/ldap.conf r,
|
||||
/etc/mail/* r,
|
||||
/etc/mail/statistics rw,
|
||||
|
||||
@ -15,13 +15,12 @@ include <tunables/global>
|
||||
/usr/sbin/sendmail.sendmail {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
@{PROC}/loadavg r,
|
||||
/etc/aliases rw,
|
||||
/etc/aliases.db rw,
|
||||
/etc/fstab r,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/ldap.conf r,
|
||||
/etc/mail/statistics rw,
|
||||
/etc/mail/* r,
|
||||
|
||||
@ -25,6 +25,7 @@ include <tunables/global>
|
||||
include <abstractions/libpam-systemd>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/wutmp>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability sys_chroot,
|
||||
capability sys_resource,
|
||||
@ -54,8 +55,6 @@ include <tunables/global>
|
||||
/dev/urandom r,
|
||||
/etc/default/locale r,
|
||||
/etc/environment r,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/modules.conf r,
|
||||
/etc/security/** r,
|
||||
/etc/ssh/** r,
|
||||
|
||||
@ -17,13 +17,12 @@ include <tunables/global>
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
/dev/urandom r,
|
||||
/etc/environment r,
|
||||
/etc/fstab r,
|
||||
/etc/ftpusers r,
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/mtab r,
|
||||
/etc/shells r,
|
||||
/etc/vsftpd.* r,
|
||||
|
||||
@ -15,13 +15,12 @@ include <tunables/global>
|
||||
/usr/sbin/xinetd {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/hosts_access>
|
||||
|
||||
capability net_bind_service,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
/etc/hosts.allow r,
|
||||
/etc/hosts.deny r,
|
||||
/etc/xinetd.conf r,
|
||||
/etc/xinetd.d r,
|
||||
/etc/xinetd.d/* r,
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user