Because of the need to be stacking LSM aware, aa_getpeercon() calls
aa_enable to ensure that apparmor is enabled. Without the permission,
aa_getpeercon() fails, causing test failures.
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit fb773fec36)
Signed-off-by: John Johansen <john.johansen@canonical.com>
The aa_policy_cache test is using the system parser.conf file even
when the tests are set to use source. This can lead to failures
if the system parser.conf contain options not understood by
the source parser.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/653
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 1033e19171)
When using the in tree parser we should not be using the system
parser.conf file, as if the system apparmor is newer than the
tree being tested the parser.conf file could contain options not
understood by the in tree apparmor_parser.
Use --config-file to specify the default in tree parser.conf
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/653
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 5ac368bce7)
The sed command to manipulate the known cap list (base_cap_names.h) into
a format to match the generated_cap_names.h was buggy because the
trailing '}' would never match anything, leading to failures when built
against 5.8 kernel headers, due to it not replacing the base capabilities
correctly.
Fix this by removing the trailing '}" match and instead match the third
comma-delimited field that matches a capability name, and replace that.
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/596
(cherry picked from commit a7fc8bb500)
Signed-off-by: John Johansen <john.johansen@canonical.com>
The mnt_point and devices conditionals in mount rules are generally
paths and should have slashes filtered after variable expansion.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/607
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit a1978fb1b2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
Similar to unix addr rules, the dbus path conditional is more a path
than a profile name and should get its slashes filtered after variable
expansion.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/607
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 35f6d49ec6)
Signed-off-by: John Johansen <john.johansen@canonical.com>
Currently mount options type= and options= do not expand variables
but they should. Fix it.
Note: this does not treat either as paths because their use is
too device dependent for it to be safe to filter slashes.
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/99
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/638
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 882380ad3d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
While `include/sys/apparmor.h` makes use of `socklen_t`, it doesn't
include the `<sys/socket.h>` header to make its declaration available.
While this works on systems using glibc via transitive includes, it
breaks compilation on musl libc.
Fix the issue by including the header.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
(cherry picked from commit 47263a3a74)
Signed-off-by: John Johansen <john.johansen@canonical.com>
While `_aa_asprintf` is supposed to be of private visibility, it's used
by apparmor_parser and thus required to be visible when linking. This
commit thus adds it to the list of private symbols to make it available
for linking in apparmor_parser.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/643
Signed-off-by: Patrick Steinhardt <ps@pks.im>
(cherry picked from commit 9a8fee6bf1)
The parser is supposed to add a rule to profiles if they are a hat
or contain hats granting write access to the kernel interfaces
used to perform the change_hat operation.
Unfortunately the check is broken and currently won't add the
rule to hats (it does add it for the parent).
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/625
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 5b850c154f)
Refresh the postfix profiles in the 2.13 branch with (mostly) all changes in master.
The most important changes are:
* support having the `postfix/*` binaries in `/usr/lib/postfix/bin/` (like for example openSUSE has now)
* add profile names
* rename the profile files to `postfix-*`
* several "smaller" changes (especially added permissions), see the individual commits for all details
Note that some changes were not backported to the 2.13 branch:
* adding abi rules
* changing `#include` to `include`
* removal of "superfluous" rules covered by abstractions (dd4903efc6)
* removal of `peer=/usr/lib/postfix/...` rules
20/20 Revert renaming usr.lib.postfix.* to postfix.* in 2.13 branch
19/20 postfix-master: allow access to postlog socket
18/20 Allow to read icu *.dat files in postfix-related profiles
17/20 postfix/master needs to execute postfix/error
16/20 Add several permissions to the postfix.* profiles
15/20 adjust postfix profiles for openSUSE path
14/20 profiles/postfix-smtpd: Include ssl_certs, ssl_keys
13/20 profiles/postdrop: Allow reading from pickup socket
12/20 profiles/postfix-pickup: Allow reading from cleanup socket
11/20 postfix.local: Minor adjustments to make it work
10/20 postfix.*: Adapt for new queue names, and extra locking and r/w communication
9/20 postfix.tlsmgr: Connect to urandom and prng exchange
8/20 postfix.master: Change path of child processes
7/20 profiles/postfix: add locking perm to pid files
6/20 profiles: add a postfix dnsblog profile
5/20 profiles: add a postfix postscreen profile
4/20 profiles/postfix-master: grant signal+unix communication with children
3/20 profiles/postfix: use named profiles
2/20 profiles/postfix-master: use profile name instead of match pattern
1/20 allow locking /etc/aliases.db
Note: Backport Exception Requested by OpenSuse, updated profiles needed, on a 2.13 release
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/621
Acked-by: John Johansen <john.johansen@canonical.com>
On openSUSE Leap 15.1, the postfix binaries live in
/usr/lib/postfix/bin/ which was not covered in the postfix.* attachment
and mrix rules.
(cherry picked from commit f668f31bf0)
This gets us to the local process now, which comes next.
(cherry picked from commit 02528133d2)
Note: this cherry-pick doesn't include the removal of the path-based
signal and unix rules in postfix-master.
Grant the ability to communicate with the postfix named child profiles
via signals and unix sockets. Include the path-based match names as
a fallback on upgrades.
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 35d84895fe)
Convert all the postfix subprocesses to using named profiles instead of
path match profiles, and adjust exec paths for newer debian/ubuntu
releses. Rename profiles to match profile names.
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 39ca2adff6)
Convert postfix's master profile to use a named profile
(postfix-master) rather than the exec path match pattern. Adjust
postfix-common abstraction to take this into account. Rename profile
name in the profiles/apparmor/profiles/extras/ directory to match
the profile name.
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 01648c6a61)
Another instance of using libvirt_leaseshelper without having
libexec access. As addressed in the previous patch.
issue: https://gitlab.com/apparmor/apparmor/-/issues/87
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit e731b8a335)
The error:
type=AVC msg=audit(1585403559.846:34317577): apparmor="DENIED" operation="exec" profile="/usr/sbin/dnsmasq" name="/usr/libexec/libvirt_leaseshelper" pid=7162 comm="sh" requested_mas
k="x" denied_mask="x" fsuid=0 ouid=0
type=AVC msg=audit(1585403559.846:34317578): apparmor="DENIED" operation="open" profile="/usr/sbin/dnsmasq" name="/usr/libexec/libvirt_leaseshelper" pid=7162 comm="sh" requested_mas
k="r" denied_mask="r" fsuid=0 ouid=0
Looks like the path to libvirt_leasehelper is incorrect usr.sbin.dnsmasq, at least in gentoo. Patching the file fixes the problem:
issue: https://gitlab.com/apparmor/apparmor/-/issues/87
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 28fce5f76d)
This is a partial backport of eb8f9302aa (only adding the abstraction) to the 2.13 branch.
Note that the 2.13 version of the abstraction doesn't have
* the abi rule
* the `include if exists <abstractions/hosts_access.d>`
because both are new in master and would cause interesting\[tm\] problems with the 2.13 tools.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/612
Acked-by: John Johansen <john.johansen@canonical.com>
This is a partial backport of eb8f9302aa
(only adding the abstraction) to the 2.13 branch.
Note that the 2.13 version of the abstraction doesn't have
- the abi rule
- the `include if exists <abstractions/hosts_access.d>`
because both are new in master and would cause interesting[tm] problems
with the 2.13 tools.
Add support for CAP BPF and PERFMON
Backport from !578 the subset of patches that convert the parser to a pregenerated list of capability names instead of a dynamically generated list.
The dynamically generated list is still created and compared to the pregenerated list and the build will fail if new capabilities are added to the dynamically generated list that are not in the pregenerated list.
This enables the parser to support new capabilities like CAP BPF and PERFMON that are might not be in the kernel that the parser is being built against.
This patch series adds support CAP BPF and PERFMON in the pregenerated list of capabilities
See merge request apparmor/apparmor!594
prologue.inc:settest() in same cases invokes a sed command that uses
'~' as a pattern separator, on things that can contain filesystem
paths. However, in the debian/ubuntu world, '~' can be used in version
strings, particularly for pre-release versions, and when this happens
and the version is embedded in the path, the sed command breaks
because of the extraneous separator. Fix this by using '#' as a
separator, which has the benefit of being considered a comment if
accidentally interpreted by a shell.
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/599
(cherry picked from commit efc6590409)
Signed-off-by: John Johansen <john.johansen@canonical.com>
The autogenerated capabilities comparison needs to be updated if the
capability_table structure changes. Add a note by the structure to
make sure the Makefile will get updated if the structure is changed.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/597
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
(backported from commit 139fac6062)
There are currently two capability name tables the one that is
autogenerated and an internal hardcoded name table.
Now that the autogenerated table has been converted to a base
static table we can drop the internal static table. This
removes the chance of getting the tables getting out of sync.
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit fb9c5f9bcf)
The static cap sys_log declaration is no longer needed as
base_cap_names.h contains it and ensures that it will always be
present.
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit fdba3a571c)
The auto-generated cap_names.h has problems when the parser if the
parser is built against a kernel with a smaller capability list than
the kernel policy is being compiled for.
Moving to a pre-generated list lets us support all capabilities even
when we build against older kernels. However we don't want to only use
the pre-generated list as that would make it too easy to miss when a
new capability has been added.
Keep auto generating the caps list and compare it to the pre-generated
caps list so we can detect when new capabilities are added, and fail
the build so that the pre-generated list can be updated. We screen the
diff for only additions so that the parser can continue to build on
older kernels that don't have the full capability list without errors.
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 270fb0a2b2)
