mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
d4e0a94511
Currently the wutmp abstraction has the following rules:
/var/log/lastlog rwk,
/var/log/wtmp wk,
@{run}/utmp rwk,
According to what I see in my apparmor profiles, just a few apps want
to interact with the files listed above, especially with the
/var/log/wtmp . But when the apps do this, they sometimes want the
read access to this file. An example could be the last command. Is
there any reason for not having the r in the rule? The second thing
is the file /var/log/btmp (which isn't included in the
abstracion). Whenever I see an app, which wants to access the
/var/log/wtmp file, it also tries to interact with the /var/log/btmp
file, for instance lightdm/sddm or su . Most of the time they need
just wk permissions, but sometimes apps need also r on this file, an
example could be the lastb command, which is just a link to last.
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/152
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/724
Signed-off-by: John Johansen <john.johansen@canonical.com>
|
||
|---|---|---|
| .. | ||
| abi | ||
| abstractions | ||
| apache2.d | ||
| local | ||
| tunables | ||
| bin.ping | ||
| lsb_release | ||
| nvidia_modprobe | ||
| php-fpm | ||
| sbin.klogd | ||
| sbin.syslog-ng | ||
| sbin.syslogd | ||
| usr.lib.apache2.mpm-prefork.apache2 | ||
| usr.lib.dovecot.anvil | ||
| usr.lib.dovecot.auth | ||
| usr.lib.dovecot.config | ||
| usr.lib.dovecot.deliver | ||
| usr.lib.dovecot.dict | ||
| usr.lib.dovecot.director | ||
| usr.lib.dovecot.doveadm-server | ||
| usr.lib.dovecot.dovecot-auth | ||
| usr.lib.dovecot.dovecot-lda | ||
| usr.lib.dovecot.imap | ||
| usr.lib.dovecot.imap-login | ||
| usr.lib.dovecot.lmtp | ||
| usr.lib.dovecot.log | ||
| usr.lib.dovecot.managesieve | ||
| usr.lib.dovecot.managesieve-login | ||
| usr.lib.dovecot.pop3 | ||
| usr.lib.dovecot.pop3-login | ||
| usr.lib.dovecot.replicator | ||
| usr.lib.dovecot.script-login | ||
| usr.lib.dovecot.ssl-params | ||
| usr.lib.dovecot.stats | ||
| usr.sbin.apache2 | ||
| usr.sbin.avahi-daemon | ||
| usr.sbin.dnsmasq | ||
| usr.sbin.dovecot | ||
| usr.sbin.identd | ||
| usr.sbin.mdnsd | ||
| usr.sbin.nmbd | ||
| usr.sbin.nscd | ||
| usr.sbin.ntpd | ||
| usr.sbin.smbd | ||
| usr.sbin.smbldap-useradd | ||
| usr.sbin.traceroute | ||
| usr.sbin.winbindd | ||