mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

merge https://code.launchpad.net/~intrigeri/apparmor/dnsmasq-better-confine-libvirt-leaseshelper/+merge/267822

Browse source 
from intrigery:
  dnsmasq profile: extract confinement of libvirt_leaseshelper into a dedicated sub-profile.

Acked-by: Christian Boltz <apparmor@cboltz.de>
This commit is contained in:
Christian Boltz 2015-12-30 22:09:07 +01:00
commit 9e6be07e7d
1 changed files with 21 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
profiles/apparmor.d/usr.sbin.dnsmasq
View file

@ -57,19 +57,16 @@
@{TFTP_DIR}/ r,
@{TFTP_DIR}/** r,
# libvirt config, lease and hosts files for dnsmasq
# libvirt config and hosts file for dnsmasq
/var/lib/libvirt/dnsmasq/ r,
/var/lib/libvirt/dnsmasq/* r,
/var/lib/libvirt/dnsmasq/*.leases rw,
/var/lib/libvirt/dnsmasq/*.status* rw,
# libvirt pid files for dnsmasq
/{,var/}run/libvirt/network/ r,
/{,var/}run/libvirt/network/*.pid rw,
# libvirt lease helper
/usr/lib{,64}/libvirt/libvirt_leaseshelper ix,
/{,var/}run/leaseshelper.pid rwk,
/usr/lib{,64}/libvirt/libvirt_leaseshelper Cx -> libvirt_leaseshelper,
# lxc-net pid and lease files
/{,var/}run/lxc/dnsmasq.pid rw,
@ -81,6 +78,25 @@
/{,var/}run/NetworkManager/dnsmasq.conf r,
/{,var/}run/NetworkManager/dnsmasq.pid w,
profile libvirt_leaseshelper {
#include <abstractions/base>
/etc/libnl-3/classid r,
owner @{PROC}/@{pid}/net/psched r,
owner @{PROC}/@{pid}/status r,
/sys/devices/system/cpu/ r,
/sys/devices/system/node/ r,
/sys/devices/system/node/*/meminfo r,
# libvirt lease and status files for dnsmasq
/var/lib/libvirt/dnsmasq/*.leases rw,
/var/lib/libvirt/dnsmasq/*.status* rw,
/{,var/}run/leaseshelper.pid rwk,
}
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.dnsmasq>
}