mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

update and cleanup usr.sbin.dovecot profile

Browse source 
Adds #include <abstractions/dovecot-common> to the usr.sbin.dovecot
profile. Effectively this adds "deny capability block_suspend," which
is the only missing part from
https://bugs.launchpad.net/apparmor/+bug/1296667/

It also removes "capability setgid," (covered by
abstractions/dovecot-common) and "@{PROC}/filesystems r," (part of
abstractions/base).

Acked-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Christian Boltz 2014-12-22 17:49:28 +01:00
parent d07249969a
commit 05dd00aea8
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
profiles/apparmor.d/usr.sbin.dovecot
View file

@ -15,6 +15,7 @@
/usr/sbin/dovecot { /usr/sbin/dovecot {
#include <abstractions/authentication> #include <abstractions/authentication>
#include <abstractions/base> #include <abstractions/base>
#include <abstractions/dovecot-common>
#include <abstractions/mysql> #include <abstractions/mysql>
#include <abstractions/nameservice> #include <abstractions/nameservice>
#include <abstractions/ssl_certs> #include <abstractions/ssl_certs>
@ -25,7 +26,6 @@
capability fsetid, capability fsetid,
capability kill, capability kill,
capability net_bind_service, capability net_bind_service,
capability setgid,
capability setuid, capability setuid,
capability sys_chroot, capability sys_chroot,
@ -34,7 +34,6 @@
/etc/lsb-release r, /etc/lsb-release r,
/etc/SuSE-release r, /etc/SuSE-release r,
@{PROC}/@{pid}/mounts r, @{PROC}/@{pid}/mounts r,
@{PROC}/filesystems r,
/usr/bin/doveconf rix, /usr/bin/doveconf rix,
/usr/lib/dovecot/anvil Px, /usr/lib/dovecot/anvil Px,
/usr/lib/dovecot/auth Px, /usr/lib/dovecot/auth Px,