From ac481f142ee874d9dfd551f98a2916250723d10b Mon Sep 17 00:00:00 2001 From: Jamie Strandboge Date: Thu, 21 Aug 2014 07:27:07 -0500 Subject: [PATCH] Allow /var/lib/extrausers/group and /var/lib/extrausers/passwd 'read' in order to work with libnss-extrausers Acked-By: Jamie Strandboge Acked-by: Seth Arnold --- profiles/apparmor.d/abstractions/nameservice | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/profiles/apparmor.d/abstractions/nameservice b/profiles/apparmor.d/abstractions/nameservice index e0530780d..e7c78687b 100644 --- a/profiles/apparmor.d/abstractions/nameservice +++ b/profiles/apparmor.d/abstractions/nameservice @@ -21,6 +21,11 @@ /etc/passwd r, /etc/protocols r, + # When using libnss-extrausers, the passwd and group files are merged from + # an alternate path + /var/lib/extrausers/group r, + /var/lib/extrausers/passwd r, + # When using sssd, the passwd and group files are stored in an alternate path # and the nss plugin also needs to talk to a pipe /var/lib/sss/mc/group r,