2006-04-11 21:52:54 +00:00
|
|
|
# ------------------------------------------------------------------
|
|
|
|
|
#
|
2009-11-04 14:25:42 -06:00
|
|
|
# Copyright (C) 2002-2009 Novell/SUSE
|
|
|
|
|
# Copyright (C) 2009 Canonical Ltd.
|
2006-04-11 21:52:54 +00:00
|
|
|
#
|
|
|
|
|
# This program is free software; you can redistribute it and/or
|
|
|
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
|
|
|
# License published by the Free Software Foundation.
|
|
|
|
|
#
|
|
|
|
|
# ------------------------------------------------------------------
|
|
|
|
|
|
2020-05-05 00:08:39 -07:00
|
|
|
abi <abi/3.0>,
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
# some services update wtmp, utmp, and lastlog with per-user
|
|
|
|
|
# connection information
|
2011-08-16 12:26:44 +02:00
|
|
|
/var/log/lastlog rwk,
|
abstractions: Add missing rule in wutmp abstraction
Currently the wutmp abstraction has the following rules:
/var/log/lastlog rwk,
/var/log/wtmp wk,
@{run}/utmp rwk,
According to what I see in my apparmor profiles, just a few apps want
to interact with the files listed above, especially with the
/var/log/wtmp . But when the apps do this, they sometimes want the
read access to this file. An example could be the last command. Is
there any reason for not having the r in the rule? The second thing
is the file /var/log/btmp (which isn't included in the
abstracion). Whenever I see an app, which wants to access the
/var/log/wtmp file, it also tries to interact with the /var/log/btmp
file, for instance lightdm/sddm or su . Most of the time they need
just wk permissions, but sometimes apps need also r on this file, an
example could be the lastb command, which is just a link to last.
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/152
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/724
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-03-14 11:49:08 -07:00
|
|
|
/var/log/wtmp rwk,
|
|
|
|
|
/var/log/btmp rwk,
|
2020-02-13 11:02:49 +02:00
|
|
|
@{run}/utmp rwk,
|
2019-01-24 03:03:11 -08:00
|
|
|
|
|
|
|
|
# Include additions to the abstraction
|
2020-05-30 19:46:08 +02:00
|
|
|
include if exists <abstractions/wutmp.d>
|