3 commits

Author	SHA1	Message	Date
Christian Boltz	9fc8e43c67	abstractions: remove '#' from 'include if exists' ... This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'.	2020-05-30 19:53:49 +02:00
John Johansen	730db17607	policy: tag policy with the AppArmor 3.0 abi ... Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>	2020-05-29 00:23:17 -07:00
Jamie Strandboge	5583569a29	allow accessing the libnss-systemd VarLink sockets and DBus APIs ... https://systemd.io/USER_GROUP_API/ describes the libnss-systemd VarLink socket APIs: " When a client wants to look up a user or group record, it contacts all sockets bound in this directory in parallel, and enqueues the same query to each. The first positive reply is then returned to the application, or if all fail the last seen error is returned instead. (Alternatively a special Varlink service is available, io.systemd.Multiplexer which acts as frontend and will do the parallel queries on behalf of the client, drastically simplifying client development.) " This updates the nameservice abstraction to allow read/write on well-known systemd VarLink named sockets. In addition, allow lookups for systemd-exec's DynamicUsers via D-Bus References: - https://systemd.io/USER_GROUP_API/ - https://systemd.io/USER_RECORD/ - https://www.freedesktop.org/software/systemd/man/nss-systemd.html - https://www.freedesktop.org/software/systemd/man/systemd.exec.html - https://launchpad.net/bugs/1796911 - https://launchpad.net/bugs/1869024 Modified by John Johansen by: - moving rules nss-systemd include - replacing /proc/ with @{proc}/ - moving and merging commit 16f9f688 rules into nss-systemd include PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/480 PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/474 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <steve.beattie@canonical.com>	2020-04-16 10:21:04 -07:00