mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-05 17:01:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/postfix-common

43 lines
1.2 KiB
Text
Raw Normal View History

Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# ------------------------------------------------------------------
#
# Copyright (C) 2002-2005 Novell/SUSE
profiles/postfix-master: use profile name instead of match pattern Convert postfix's master profile to use a named profile (postfix-master) rather than the exec path match pattern. Adjust postfix-common abstraction to take this into account. Rename profile name in the profiles/apparmor/profiles/extras/ directory to match the profile name. Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
2018-03-25 22:02:54 -07:00
# Copyright (C) 2015-2018 Canonical, Ltd.
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# used with postfix/*
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2020-05-05 00:08:39 -07:00
abi <abi/3.0>,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
capability setuid,
capability setgid,
r3527@dhcp-81: root | 2006-08-02 15:33:07 -0700 Fix up the m, U, and P stuff, and other misc fixes
2006-08-04 18:13:59 +00:00
capability sys_chroot,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
profiles: update postfix-common abstraction Update the postfix-common abstraction to cope with signal and unix socket mediation, update the access to the sasl library locations in a multiarch compliant way, and allow access to limited bits of the filesystem paths under which postfix chroots itself to (/var/spool/postfix/ on Ubuntu). Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-04-15 23:32:50 -07:00
# postfix's master can send us signals
profiles/postfix-master: use profile name instead of match pattern Convert postfix's master profile to use a named profile (postfix-master) rather than the exec path match pattern. Adjust postfix-common abstraction to take this into account. Rename profile name in the profiles/apparmor/profiles/extras/ directory to match the profile name. Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
2018-03-25 22:02:54 -07:00
signal receive peer=postfix-master,
profiles: update postfix-common abstraction Update the postfix-common abstraction to cope with signal and unix socket mediation, update the access to the sasl library locations in a multiarch compliant way, and allow access to limited bits of the filesystem paths under which postfix chroots itself to (/var/spool/postfix/ on Ubuntu). Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-04-15 23:32:50 -07:00
profiles/postfix-master: use profile name instead of match pattern Convert postfix's master profile to use a named profile (postfix-master) rather than the exec path match pattern. Adjust postfix-common abstraction to take this into account. Rename profile name in the profiles/apparmor/profiles/extras/ directory to match the profile name. Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
2018-03-25 22:02:54 -07:00
unix (send, receive) peer=(label=postfix-master),
profiles: update postfix-common abstraction Update the postfix-common abstraction to cope with signal and unix socket mediation, update the access to the sasl library locations in a multiarch compliant way, and allow access to limited bits of the filesystem paths under which postfix chroots itself to (/var/spool/postfix/ on Ubuntu). Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-04-15 23:32:50 -07:00
/etc/mailname r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/etc/postfix/*.cf r,
update some Postfix profiles - change abstractions/postfix-common to allow /etc/postfix/*.db k - add several permissions to postfix/error, postfix/lmtp and postfix/pipe - remove superfluous abstractions/kerberosclient from all postfix profiles - it's included via abstractions/nameservice Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk
2017-08-22 12:43:18 +02:00
/etc/postfix/*.db rk,
This patch adds a variable definition for the location of /proc in tunables/proc and modifies all users of /proc to use the variable instead. I also converted some uses of /proc/*/ to /proc/[0-9]*/ to be a little more restrictive, as well as removing some references to proc files that are already covered by abstractions/base (the removals in abstractions/bash seem justified as all uses of abstractions/bash are immediately preceded by abstractions/base).
2007-05-25 02:09:30 +00:00
@{PROC}/net/if_inet6 r,
r3527@dhcp-81: root | 2006-08-02 15:33:07 -0700 Fix up the m, U, and P stuff, and other misc fixes
2006-08-04 18:13:59 +00:00
/usr/lib/postfix/*.so mr,
profiles: update postfix-common abstraction Update the postfix-common abstraction to cope with signal and unix socket mediation, update the access to the sasl library locations in a multiarch compliant way, and allow access to limited bits of the filesystem paths under which postfix chroots itself to (/var/spool/postfix/ on Ubuntu). Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-04-15 23:32:50 -07:00
/usr/lib{,32,64}/sasl2/* mr,
/usr/lib{,32,64}/sasl2/ r,
/usr/lib/@{multiarch}/sasl2/* mr,
/usr/lib/@{multiarch}/sasl2/ r,
/var/spool/postfix/etc/* r,
/var/spool/postfix/lib/lib*.so* mr,
/var/spool/postfix/lib/@{multiarch}/lib*.so* mr,
postifx-common: Allow access to dynamicmaps, most seems to use it
2018-11-30 14:23:56 +01:00
/etc/postfix/dynamicmaps.cf.d/ r,
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:03:11 -08:00
abstractions: fix merge conflict resoltion typo Fix typo introduced when resolving a merge conflict for d9ab83281bfc ("Add support for local additions to abstractions") Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 04:34:03 -08:00
# Include additions to the abstraction
abstractions: remove '#' from 'include if exists' This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'.
2020-05-30 19:46:08 +02:00
include if exists <abstractions/postfix-common.d>
Reference in a new issue Copy permalink