mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-06 09:21:00 +01:00
eeac8c11c9
In focal users of mdns get denials in apparmor confined applications. An exampel can be found in the original bug below. It seems it is a common pattern, see https://github.com/lathiat/nss-mdns#etcmdnsallow Therefore I'm asking to add /etc/mdns.allow r, to the file /etc/apparmor.d/abstractions/mdns" by default. --- original bug --- Many repetitions of audit: type=1400 audit(1585517168.705:63): apparmor="DENIED" operation="open" profile="/usr/sbin/chronyd" name="/etc/mdns.allow" pid=1983815 comm="chronyd" requested_mask="r" denied_mask="r" fsuid=123 ouid=0 in log. I use libnss-mdns for .local name resolution, so /etc/nsswitch.conf contains hosts: files mdns [NOTFOUND=return] myhostname dns and /etc/mnds.allow contains the domains to resolve with mDNS (in may case, "local." and "local"; see /usr/share/doc/libnss-mdns/README.html.) Presumably cronyd calls a gethostbyX() somewhere, thus eventually trickling down through the name service switch and opening /etc/mdns.allow, which the AppArmor profile in the chrony package does not allow. Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1869629 Signed-off-by: John Johansen <john.johansen@canonical.com> |
||
|---|---|---|
| .. | ||
| abstractions | ||
| apache2.d | ||
| local | ||
| tunables | ||
| bin.ping | ||
| lsb_release | ||
| nvidia_modprobe | ||
| sbin.klogd | ||
| sbin.syslog-ng | ||
| sbin.syslogd | ||
| usr.lib.apache2.mpm-prefork.apache2 | ||
| usr.lib.dovecot.anvil | ||
| usr.lib.dovecot.auth | ||
| usr.lib.dovecot.config | ||
| usr.lib.dovecot.deliver | ||
| usr.lib.dovecot.dict | ||
| usr.lib.dovecot.dovecot-auth | ||
| usr.lib.dovecot.dovecot-lda | ||
| usr.lib.dovecot.imap | ||
| usr.lib.dovecot.imap-login | ||
| usr.lib.dovecot.lmtp | ||
| usr.lib.dovecot.log | ||
| usr.lib.dovecot.managesieve | ||
| usr.lib.dovecot.managesieve-login | ||
| usr.lib.dovecot.pop3 | ||
| usr.lib.dovecot.pop3-login | ||
| usr.lib.dovecot.ssl-params | ||
| usr.lib.dovecot.stats | ||
| usr.sbin.apache2 | ||
| usr.sbin.avahi-daemon | ||
| usr.sbin.dnsmasq | ||
| usr.sbin.dovecot | ||
| usr.sbin.identd | ||
| usr.sbin.mdnsd | ||
| usr.sbin.nmbd | ||
| usr.sbin.nscd | ||
| usr.sbin.ntpd | ||
| usr.sbin.smbd | ||
| usr.sbin.smbldap-useradd | ||
| usr.sbin.traceroute | ||
| usr.sbin.winbindd | ||