mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-08 18:31:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/nss-systemd

31 lines
1.1 KiB
Text
Raw Normal View History

allow accessing the libnss-systemd VarLink sockets and DBus APIs https://systemd.io/USER_GROUP_API/ describes the libnss-systemd VarLink socket APIs: " When a client wants to look up a user or group record, it contacts all sockets bound in this directory in parallel, and enqueues the same query to each. The first positive reply is then returned to the application, or if all fail the last seen error is returned instead. (Alternatively a special Varlink service is available, io.systemd.Multiplexer which acts as frontend and will do the parallel queries on behalf of the client, drastically simplifying client development.) " This updates the nameservice abstraction to allow read/write on well-known systemd VarLink named sockets. In addition, allow lookups for systemd-exec's DynamicUsers via D-Bus References: - https://systemd.io/USER_GROUP_API/ - https://systemd.io/USER_RECORD/ - https://www.freedesktop.org/software/systemd/man/nss-systemd.html - https://www.freedesktop.org/software/systemd/man/systemd.exec.html - https://launchpad.net/bugs/1796911 - https://launchpad.net/bugs/1869024 Modified by John Johansen by: - moving rules nss-systemd include - replacing /proc/ with @{proc}/ - moving and merging commit 16f9f688 rules into nss-systemd include PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/480 PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/474 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <steve.beattie@canonical.com>
2020-04-06 16:09:50 -05:00
# ------------------------------------------------------------------
#
# Copyright (C) 2002-2009 Novell/SUSE
# Copyright (C) 2009-2011 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2020-05-05 00:08:39 -07:00
abi <abi/3.0>,
allow accessing the libnss-systemd VarLink sockets and DBus APIs https://systemd.io/USER_GROUP_API/ describes the libnss-systemd VarLink socket APIs: " When a client wants to look up a user or group record, it contacts all sockets bound in this directory in parallel, and enqueues the same query to each. The first positive reply is then returned to the application, or if all fail the last seen error is returned instead. (Alternatively a special Varlink service is available, io.systemd.Multiplexer which acts as frontend and will do the parallel queries on behalf of the client, drastically simplifying client development.) " This updates the nameservice abstraction to allow read/write on well-known systemd VarLink named sockets. In addition, allow lookups for systemd-exec's DynamicUsers via D-Bus References: - https://systemd.io/USER_GROUP_API/ - https://systemd.io/USER_RECORD/ - https://www.freedesktop.org/software/systemd/man/nss-systemd.html - https://www.freedesktop.org/software/systemd/man/systemd.exec.html - https://launchpad.net/bugs/1796911 - https://launchpad.net/bugs/1869024 Modified by John Johansen by: - moving rules nss-systemd include - replacing /proc/ with @{proc}/ - moving and merging commit 16f9f688 rules into nss-systemd include PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/480 PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/474 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <steve.beattie@canonical.com>
2020-04-06 16:09:50 -05:00
# libnss-systemd
#
# https://systemd.io/USER_GROUP_API/
# https://systemd.io/USER_RECORD/
# https://www.freedesktop.org/software/systemd/man/nss-systemd.html
#
# Allow User/Group lookups via common VarLink socket APIs. Applications need
# to either consult all of them or the io.systemd.Multiplexer frontend.
@{run}/systemd/userdb/ r,
@{run}/systemd/userdb/io.systemd.Multiplexer rw,
@{run}/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users
@{run}/systemd/userdb/io.systemd.Home rw, # systemd-home dirs
@{run}/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS
@{PROC}/sys/kernel/random/boot_id r,
abstractions: remove '#' from 'include if exists' This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'.
2020-05-30 19:46:08 +02:00
include if exists <abstractions/nss-systemd.d>
Reference in a new issue Copy permalink