mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge Fix access to Fips 140-2 library integrity files

Browse source 
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/595
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This commit is contained in:
John Johansen 2020-08-31 17:41:11 +00:00
commit cc97494528
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
profiles/apparmor.d/abstractions/base
View file

@ -75,6 +75,11 @@
/{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so* mr,
/{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so* mr,
# FIPS-140-2 versions of some crypto libraries need to access their
# associated integrity verification file, or they will abort.
/{usr/,}lib{,32,64}/.lib*.so*.hmac r,
/{usr/,}lib/@{multiarch}/.lib*.so*.hmac r,
# /dev/null is pretty harmless and frequently used
/dev/null rw,
# as is /dev/zero

4
tests/regression/apparmor/mkprofile.pl
View file

@ -101,6 +101,10 @@ sub gen_default_rules() {
# give every profile access to /dev/urandom (propolice, etc.)
gen_file("/dev/urandom:r");
# give every profile access to FIPS hmac files in /lib and /usr/lib
gen_file("/{usr/,}lib{,32,64}/.lib*.so*.hmac:r");
gen_file("/{usr/,}lib/{,**/}.lib*.so*.hmac:r");
}
sub gen_elf_binary($) {