mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-06 09:21:00 +01:00
4244737f65
lsb_release fails on Debian Sid: ``` $ sudo aa-exec -p lsb_release lsb_release /usr/bin/lsb_release: 70: cut: Permission denied /usr/bin/lsb_release: 70: cut: Permission denied ``` ``` $ sudo aa-exec -p lsb_release lsb_release -h /usr/bin/lsb_release: 11: cat: Permission denied ``` ``` type=AVC msg=audit(1669540199.087:2680): apparmor="DENIED" operation="exec" profile="lsb_release" name="/usr/bin/cut" pid=17419 comm="lsb_release" requested_mask="x" denied_mask="x" fsuid=0 ouid=0FSUID="root" OUID="root" ``` ``` type=AVC msg=audit(1669540392.244:2944): apparmor="DENIED" operation="exec" profile="lsb_release" name="/usr/bin/cat" pid=17847 comm="lsb_release" requested_mask="x" denied_mask="x" fsuid=0 ouid=0FSUID="root" OUID="root" ``` Update profile to allow lsb_release script to invoke required executables. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/953 Approved-by: Christian Boltz <apparmor@cboltz.de> Merged-by: Christian Boltz <apparmor@cboltz.de> (cherry picked from commit495f68c797)f596a176lsb_release: allow cat and cut
54 lines
1.3 KiB
Text
54 lines
1.3 KiB
Text
# Note: This profile does not specify an attachment path because it is
|
|
# intended to be used only via "Px -> lsb_release" exec transitions from
|
|
# other profiles. We want to confine the lsb_release(1) utility when it
|
|
# is invoked from other confined applications, but not when it is used
|
|
# in regular (unconfined) shell scripts or run directly by the user.
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
# Do not attach to /usr/bin/lsb_release by default
|
|
profile lsb_release {
|
|
include <abstractions/base>
|
|
include <abstractions/python>
|
|
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
|
|
/dev/tty rw,
|
|
|
|
/usr/bin/lsb_release r,
|
|
/usr/bin/python3.{1,}[0-9] mr,
|
|
|
|
/etc/debian_version r,
|
|
/etc/default/apport r,
|
|
/etc/dpkg/origins/** r,
|
|
/etc/lsb-release r,
|
|
/etc/lsb-release.d/ r,
|
|
|
|
/{usr/,}bin/bash ixr,
|
|
/{usr/,}bin/dash ixr,
|
|
/usr/bin/basename ixr,
|
|
/usr/bin/dpkg-query ixr,
|
|
/usr/bin/cat ixr,
|
|
/usr/bin/cut ixr,
|
|
/usr/bin/getopt ixr,
|
|
/usr/bin/sed ixr,
|
|
/usr/bin/tr ixr,
|
|
|
|
# TODO - many more permissions needed for this to work
|
|
deny /usr/bin/apt-cache x,
|
|
|
|
/usr/bin/ r,
|
|
/usr/include/python*/pyconfig.h r,
|
|
/usr/share/distro-info/** r,
|
|
/usr/share/dpkg/** r,
|
|
/usr/share/terminfo/** r,
|
|
/var/lib/dpkg/** r,
|
|
|
|
# file_inherit
|
|
deny /tmp/gtalkplugin.log w,
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
include if exists <local/lsb_release>
|
|
}
|