mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 01:57:43 +00:00
Code Issues Releases Wiki Activity

Merge profiles/apparmor.d: add nslookup profile

Browse Source 
Add AA profile for `nslookup`. This profile has been tested on the latest plucky `nslookup` version `9.20.4-3ubuntu1` (ultimately part of `dnsutils`). Functionality has been exercised as much as possible, including basic record lookups, querying specific DNS servers, performing reverse DNS lookups, querying a CNAME, querying an MX record, querying a txt record, querying a DNSSEC-related record, performing IPv4 & IPv6 lookups, and overriding to use a custom resolver. These tests were performed through command parsing and the interactive terminal mode. AFAIK, upstream does not have a test suite available for `nslookup`

Signed-off-by: john-breton <john.breton@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1619
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Merged-by: Maxime Bélair <maxime.belair@canonical.com>
This commit is contained in:
Maxime Bélair 2025-05-12 12:42:34 +00:00
commit f38f156a76
1 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
profiles/apparmor.d/nslookup Normal file
View File

@ -0,0 +1,41 @@
# -*- mode: apparmor; -*-
# ------------------------------------------------------------------
#
# Copyright (C) 2025 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim: ft=apparmor
abi <abi/4.0>,
include <tunables/global>
profile nslookup /usr/bin/nslookup {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/terminfo>
# Requested on < plucky by libuv (bind9 dependency), no functional impact from denial
deny capability sys_admin,
# Needed for network queries
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
# Read access is requested to the following locations during bare `nslookup`
/usr/bin/nslookup mr,
/proc/version_signature r,
/sys/kernel/mm/transparent_hugepage/enabled r,
# `nslookup` performs reads to its own thread often, needed for expected functionality
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/nslookup>
}