[apparmor] apparmor_parser segfault

Christian Boltz apparmor at cboltz.de
Tue Jan 11 01:24:50 UTC 2011


Hello,

(merged the subject ;-)

Am Dienstag, 11. Januar 2011 schrieb John Johansen:
> Christian can you attach the profile dumped from running
> 
> apparmor_parser -p <profile>
> 
> this will pull in all the includes, variable defines etc,
> encapsulating it all into a single profile file that is easier for
> us to debug against.

Nice feature, I didn't know about it.
The -p-parsed profiles of nscd and gitweb are attached.

(And they let apparmor_parser segfault when trying to load them, so the 
bug is still reproducable with the -p-parsed profiles.)

Happy debugging! ;-)


Regards,

Christian Boltz
-- 
> Sensation: Ratti schreibt Doku!
> :-)
Olle ätzende Giftspritze! :-)
[> Christian Boltz und Ratti in fontlinge-devel]
-------------- next part --------------
# $Id#
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2005 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------



##included <tunables/global>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2006-2009 Novell/SUSE
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# All the tunables definitions that should be available to every profile
# should be included here



##included <tunables/home>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2006-2009 Novell/SUSE
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# @{HOME} is a space-separated list of all user home directories. While
# it doesn't refer to a specific home directory (AppArmor doesn't
# enforce discretionary access controls) it can be used as if it did
# refer to a specific home directory
@{HOME}=@{HOMEDIRS}/*/ /root/

# @{HOMEDIRS} is a space-separated list of where user home directories
# are stored, for programs that must enumerate all home directories on a
# system.
@{HOMEDIRS}=/home/

# Also, include files in tunables/home.d for site-specific adjustments to
# @{HOMEDIRS}.


##included <tunables/home.d>
# ------------------------------------------------------------------
#
#    Copyright (C) 2010 Canonical Ltd.
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# The following is a space-separated list of where additional user home
# directories are stored, each must have a trailing '/'. Directories added
# here are appended to @{HOMEDIRS}.  See tunables/home for details. Eg:
#@{HOMEDIRS}+=/srv/nfs/home/ /mnt/home/




##included <tunables/proc>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# @{PROC} is the location where procfs is mounted.
@{PROC}=/proc/



##included <tunables/alias>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# Alias rules can be used to rewrite paths and are done after variable
# resolution. For example, if '/usr' is on removable media:
# alias /usr/ -> /mnt/usr/,
#
# Or if mysql databases are stored in /home:
# alias /var/lib/mysql/ -> /home/mysql/,


alias /var -> /home/sys-var,
alias /tmp -> /home/sys-tmp,


/usr/sbin/nscd {
  

##included <abstractions/base>
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------



  # (Note that the ldd profile has inlined this file; if you make
  # modifications here, please consider including them in the ldd
  # profile as well.)

  # The __canary_death_handler function writes a time-stamped log
  # message to /dev/log for logging by syslogd. So, /dev/log, timezones,
  # and localisations of date should be available EVERYWHERE, so
  # StackGuard, FormatGuard, etc., alerts can be properly logged.
  /dev/log                       w,
  /dev/random                    r,
  /dev/urandom                   r,
  /etc/locale/**                 r,
  /etc/locale.alias              r,
  /etc/localtime                 r,
  /usr/share/locale-langpack/**  r,
  /usr/share/locale/**           r,
  /usr/share/**/locale/**        r,
  /usr/share/zoneinfo/           r,
  /usr/share/zoneinfo/**         r,
  /usr/share/X11/locale/**       r,

  /usr/lib{,32,64}/locale/**             mr,
  /usr/lib{,32,64}/gconv/*.so            mr,
  /usr/lib{,32,64}/gconv/gconv-modules*  mr,

  # used by glibc when binding to ephemeral ports
  /etc/bindresvport.blacklist    r,

  # ld.so.cache and ld are used to load shared libraries; they are best
  # available everywhere
  /etc/ld.so.cache               mr,
  /lib{,32,64}/ld{,32,64}-*.so   mrix,
  /lib{,32,64}/**/ld{,32,64}-*.so     mrix,
  /lib/tls/i686/{cmov,nosegneg}/ld-*.so     mrix,
  /opt/*-linux-uclibc/lib/ld-uClibc*so* mrix,

  # we might as well allow everything to use common libraries
  /lib{,32,64}/**                r,
  /lib{,32,64}/lib*.so*          mr,
  /lib{,32,64}/**/lib*.so*       mr,
  /usr/lib{,32,64}/**            r,
  /usr/lib{,32,64}/*.so*         mr,
  /usr/lib{,32,64}/**/lib*.so*   mr,
  /lib/tls/i686/{cmov,nosegneg}/lib*.so*    mr,

  # /dev/null is pretty harmless and frequently used
  /dev/null                      rw,
  # as is /dev/zero
  /dev/zero                      rw,
  # recent glibc uses /dev/full in preference to /dev/null for programs
  # that don't have open fds at exec()
  /dev/full                      rw,

  # Sometimes used to determine kernel/user interfaces to use
  @{PROC}/sys/kernel/version     r,
  # Depending on which glibc routine uses this file, base may not be the
  # best place -- but many profiles require it, and it is quite harmless.
  @{PROC}/sys/kernel/ngroups_max r,

  # glibc's sysconf(3) routine to determine free memory, etc
  @{PROC}/meminfo                r,
  @{PROC}/stat                   r,
  @{PROC}/cpuinfo                r,

  # glibc's *printf protections read the maps file
  @{PROC}/*/maps                 r,

  # libgcrypt reads some flags from /proc
  @{PROC}/sys/crypto/*           r,

  # some applications will display license information
  /usr/share/common-licenses/**  r,

  # glibc statvfs
  @{PROC}/filesystems            r,

  # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked
  # filesystems generally. This does not appreciably decrease security with
  # Ubuntu profiles because the user is expected to have access to files owned
  # by him/her. Exceptions to this are explicit in the profiles. While this rule
  # grants access to those exceptions, the intended privacy is maintained due to
  # the encrypted contents of the files in this directory. Files in this
  # directory will also use filename encryption by default, so the files are
  # further protected. Also, with the use of 'owner', this rule properly
  # prevents access to the files from processes running under a different uid.

  # encrypted ~/.Private and old-style encrypted $HOME
  owner @{HOME}/.Private/** mrixwlk,
  # new-style encrypted $HOME
  owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,


  

##included <abstractions/consoles>
# vim:syntax=apparmor
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2005 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------



  # there are three common ways to refer to consoles
  /dev/console rw,
  /dev/tty     rw,
  # this next entry is a tad unfortunate; /dev/tty will always be
  # associated with the controlling terminal by the kernel, but if a
  # program uses the /dev/pts/ interface, it actually has access to
  # -all- xterm, sshd, etc, terminals on the system.
  /dev/pts/[0-9]*   rw,
  /dev/pts/         r,


  

##included <abstractions/nameservice>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # Many programs wish to perform nameservice-like operations, such as
  # looking up users by name or id, groups by name or id, hosts by name
  # or IP, etc. These operations may be performed through files, dns,
  # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
  /etc/group              r,
  /etc/host.conf          r,
  /etc/hosts              r,
  /etc/ldap.conf          r,
  /etc/ldap.secret        r,
  /etc/nsswitch.conf      r,
  /etc/gai.conf           r,
  /etc/passwd             r,
  /etc/protocols          r,

  /etc/resolv.conf        r,
  # on systems using resolvconf, /etc/resolv.conf is a symlink to
  # /var/run/resolvconf/resolv.conf and a file sometimes referenced in
  # /etc/resolvconf/run/resolv.conf
  /var/run/resolvconf/resolv.conf r,
  /etc/resolvconf/run/resolv.conf r,

  /etc/samba/lmhosts      r,
  /etc/services           r,
  # all openldap config
  /etc/openldap/*         r,
  /etc/ldap/**            r,
  # db backend
  /var/lib/misc/*.db      r,
  # The Name Service Cache Daemon can cache lookups, sometimes leading
  # to vast speed increases when working with network-based lookups.
  /var/run/.nscd_socket   rw,
  /var/run/nscd/socket    rw,
  /var/{db,cache,run}/nscd/{passwd,group,services,host}    r,
  # nscd renames and unlinks files in it's operation that clients will
  # have open
  /var/run/nscd/db*  rmix,

  # The nss libraries are sometimes used in addition to PAM; make sure
  # they are available
  /lib{,32,64}/libnss_*.so*      mr,
  /usr/lib{,32,64}/libnss_*.so*  mr,
  /etc/default/nss               r,

  # avahi-daemon is used for mdns4 resolution
  /var/run/avahi-daemon/socket w,

  # nis
  

##included <abstractions/nis>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # NIS rules
  /var/yp/binding/*           r,
  # portmapper may ask root processes to do nis/ldap at low ports
  capability net_bind_service,



  # winbind
  

##included <abstractions/winbind>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # pam_winbindd
  /tmp/.winbindd/pipe  rw,
  /var/{lib,run}/samba/winbindd_privileged/pipe rw,
  /etc/samba/smb.conf         r,
  /usr/lib/samba/valid.dat    r,
  /usr/lib/samba/upcase.dat   r,
  /usr/lib/samba/lowcase.dat  r,



  # likewise
  

##included <abstractions/likewise>
# vim:syntax=apparmor
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  /tmp/.lwidentity/pipe       rw,
  /var/lib/likewise-open/lwidentity_privileged/pipe rw,


  # mdnsd
  

##included <abstractions/mdns>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # mdnsd
  /etc/nss_mdns.conf r,
  /var/run/mdnsd w,


  # kerberos
  

##included <abstractions/kerberosclient>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # files required by kerberos client programs
  /usr/lib{,32,64}/krb5/plugins/libkrb5/ r,
  /usr/lib{,32,64}/krb5/plugins/libkrb5/* mr,

  /usr/lib{,32,64}/krb5/plugins/preauth/ r,
  /usr/lib{,32,64}/krb5/plugins/preauth/* mr,

  /etc/krb5.keytab            r,
  /etc/krb5.conf              r,

  # config files found via strings on libs
  /etc/krb.conf               r,
  /etc/krb.realms             r,
  /etc/srvtab                 r,

  # credential caches
  /tmp/krb5cc* r,


  # TCP/UDP network access
  network inet  stream,
  network inet6 stream,
  network inet  dgram,
  network inet6 dgram,

  # interface details
  @{PROC}/*/net/route r,

  

##included <abstractions/ssl_certs>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2005 Novell/SUSE
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  /etc/ssl/ r,
  /etc/ssl/certs/ r,
  /etc/ssl/certs/* r,
  /usr/share/ca-certificates/ r,
  /usr/share/ca-certificates/** r,


  capability net_bind_service,

  network inet dgram,
  network inet stream,

  /etc/netgroup r,
  /etc/nscd.conf r,
  /tmp/.winbindd/pipe rw,
  /usr/sbin/nscd rmix,
  /var/lib/samba/winbindd_privileged/pipe rw,
  /var/run/.nscd_socket wl,
  /var/run/avahi-daemon/socket w,
  /var/run/nscd/ r,
  /var/run/nscd/db* wl,
  /var/run/nscd/socket wl,
  /var/{cache,run}/nscd/{passwd,group,services,hosts} rw,
  /var/run/{nscd/,}nscd.pid rwl,
  /var/log/nscd.log rw,
  @{PROC}/[0-9]*/fd/ r,
  @{PROC}/[0-9]*/fd/* r,
  @{PROC}/[0-9]*/maps r,
  @{PROC}/[0-9]*/mounts r,
  @{PROC}/filesystems r,
}
-------------- next part --------------
# Last Modified: Fri Dec 19 11:03:49 2008


##included <tunables/global>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2006-2009 Novell/SUSE
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# All the tunables definitions that should be available to every profile
# should be included here



##included <tunables/home>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2006-2009 Novell/SUSE
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# @{HOME} is a space-separated list of all user home directories. While
# it doesn't refer to a specific home directory (AppArmor doesn't
# enforce discretionary access controls) it can be used as if it did
# refer to a specific home directory
@{HOME}=@{HOMEDIRS}/*/ /root/

# @{HOMEDIRS} is a space-separated list of where user home directories
# are stored, for programs that must enumerate all home directories on a
# system.
@{HOMEDIRS}=/home/

# Also, include files in tunables/home.d for site-specific adjustments to
# @{HOMEDIRS}.


##included <tunables/home.d>
# ------------------------------------------------------------------
#
#    Copyright (C) 2010 Canonical Ltd.
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# The following is a space-separated list of where additional user home
# directories are stored, each must have a trailing '/'. Directories added
# here are appended to @{HOMEDIRS}.  See tunables/home for details. Eg:
#@{HOMEDIRS}+=/srv/nfs/home/ /mnt/home/




##included <tunables/proc>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# @{PROC} is the location where procfs is mounted.
@{PROC}=/proc/



##included <tunables/alias>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# Alias rules can be used to rewrite paths and are done after variable
# resolution. For example, if '/usr' is on removable media:
# alias /usr/ -> /mnt/usr/,
#
# Or if mysql databases are stored in /home:
# alias /var/lib/mysql/ -> /home/mysql/,


alias /var -> /home/sys-var,
alias /tmp -> /home/sys-tmp,



/usr/share/gitweb/gitweb.cgi {
  

##included <abstractions/base>
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------



  # (Note that the ldd profile has inlined this file; if you make
  # modifications here, please consider including them in the ldd
  # profile as well.)

  # The __canary_death_handler function writes a time-stamped log
  # message to /dev/log for logging by syslogd. So, /dev/log, timezones,
  # and localisations of date should be available EVERYWHERE, so
  # StackGuard, FormatGuard, etc., alerts can be properly logged.
  /dev/log                       w,
  /dev/random                    r,
  /dev/urandom                   r,
  /etc/locale/**                 r,
  /etc/locale.alias              r,
  /etc/localtime                 r,
  /usr/share/locale-langpack/**  r,
  /usr/share/locale/**           r,
  /usr/share/**/locale/**        r,
  /usr/share/zoneinfo/           r,
  /usr/share/zoneinfo/**         r,
  /usr/share/X11/locale/**       r,

  /usr/lib{,32,64}/locale/**             mr,
  /usr/lib{,32,64}/gconv/*.so            mr,
  /usr/lib{,32,64}/gconv/gconv-modules*  mr,

  # used by glibc when binding to ephemeral ports
  /etc/bindresvport.blacklist    r,

  # ld.so.cache and ld are used to load shared libraries; they are best
  # available everywhere
  /etc/ld.so.cache               mr,
  /lib{,32,64}/ld{,32,64}-*.so   mrix,
  /lib{,32,64}/**/ld{,32,64}-*.so     mrix,
  /lib/tls/i686/{cmov,nosegneg}/ld-*.so     mrix,
  /opt/*-linux-uclibc/lib/ld-uClibc*so* mrix,

  # we might as well allow everything to use common libraries
  /lib{,32,64}/**                r,
  /lib{,32,64}/lib*.so*          mr,
  /lib{,32,64}/**/lib*.so*       mr,
  /usr/lib{,32,64}/**            r,
  /usr/lib{,32,64}/*.so*         mr,
  /usr/lib{,32,64}/**/lib*.so*   mr,
  /lib/tls/i686/{cmov,nosegneg}/lib*.so*    mr,

  # /dev/null is pretty harmless and frequently used
  /dev/null                      rw,
  # as is /dev/zero
  /dev/zero                      rw,
  # recent glibc uses /dev/full in preference to /dev/null for programs
  # that don't have open fds at exec()
  /dev/full                      rw,

  # Sometimes used to determine kernel/user interfaces to use
  @{PROC}/sys/kernel/version     r,
  # Depending on which glibc routine uses this file, base may not be the
  # best place -- but many profiles require it, and it is quite harmless.
  @{PROC}/sys/kernel/ngroups_max r,

  # glibc's sysconf(3) routine to determine free memory, etc
  @{PROC}/meminfo                r,
  @{PROC}/stat                   r,
  @{PROC}/cpuinfo                r,

  # glibc's *printf protections read the maps file
  @{PROC}/*/maps                 r,

  # libgcrypt reads some flags from /proc
  @{PROC}/sys/crypto/*           r,

  # some applications will display license information
  /usr/share/common-licenses/**  r,

  # glibc statvfs
  @{PROC}/filesystems            r,

  # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked
  # filesystems generally. This does not appreciably decrease security with
  # Ubuntu profiles because the user is expected to have access to files owned
  # by him/her. Exceptions to this are explicit in the profiles. While this rule
  # grants access to those exceptions, the intended privacy is maintained due to
  # the encrypted contents of the files in this directory. Files in this
  # directory will also use filename encryption by default, so the files are
  # further protected. Also, with the use of 'owner', this rule properly
  # prevents access to the files from processes running under a different uid.

  # encrypted ~/.Private and old-style encrypted $HOME
  owner @{HOME}/.Private/** mrixwlk,
  # new-style encrypted $HOME
  owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,


  

##included <abstractions/bash>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # user-specific bash files
  @{HOMEDIRS}                      r,
  @{HOME}/.bashrc                  r,
  @{HOME}/.profile                 r,
  @{HOME}/.bash_profile            r,
  @{HOME}/.bash_history            rw,

  # system-wide bash configuration
  /etc/profile.dos                 r,
  /etc/profile                     r,
  /etc/profile.d/                  r,
  /etc/profile.d/*                 r,
  /etc/bashrc                      r,
  /etc/bash.bashrc                 r,
  /etc/bash.bashrc.local           r,
  /etc/bash_completion             r,
  /etc/bash_completion.d/          r,
  /etc/bash_completion.d/*         r,

  # bash relies on system-wide readline configuration
  /etc/inputrc                     r,

  # bash inspects filesystems at startup
  /etc/mtab                        r,
  @{PROC}/[0-9]*/mounts            r,
  @{PROC}/filesystems              r,

  # probably readline wants to know terminal capabilities
  /usr/share/terminfo/**           r,

  # run out of /etc/bash.bashrc
  /etc/DIR_COLORS                  r,
  /bin/ls                          mix,
  /usr/bin/dircolors               mix,

  

##included <abstractions/nameservice>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # Many programs wish to perform nameservice-like operations, such as
  # looking up users by name or id, groups by name or id, hosts by name
  # or IP, etc. These operations may be performed through files, dns,
  # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
  /etc/group              r,
  /etc/host.conf          r,
  /etc/hosts              r,
  /etc/ldap.conf          r,
  /etc/ldap.secret        r,
  /etc/nsswitch.conf      r,
  /etc/gai.conf           r,
  /etc/passwd             r,
  /etc/protocols          r,

  /etc/resolv.conf        r,
  # on systems using resolvconf, /etc/resolv.conf is a symlink to
  # /var/run/resolvconf/resolv.conf and a file sometimes referenced in
  # /etc/resolvconf/run/resolv.conf
  /var/run/resolvconf/resolv.conf r,
  /etc/resolvconf/run/resolv.conf r,

  /etc/samba/lmhosts      r,
  /etc/services           r,
  # all openldap config
  /etc/openldap/*         r,
  /etc/ldap/**            r,
  # db backend
  /var/lib/misc/*.db      r,
  # The Name Service Cache Daemon can cache lookups, sometimes leading
  # to vast speed increases when working with network-based lookups.
  /var/run/.nscd_socket   rw,
  /var/run/nscd/socket    rw,
  /var/{db,cache,run}/nscd/{passwd,group,services,host}    r,
  # nscd renames and unlinks files in it's operation that clients will
  # have open
  /var/run/nscd/db*  rmix,

  # The nss libraries are sometimes used in addition to PAM; make sure
  # they are available
  /lib{,32,64}/libnss_*.so*      mr,
  /usr/lib{,32,64}/libnss_*.so*  mr,
  /etc/default/nss               r,

  # avahi-daemon is used for mdns4 resolution
  /var/run/avahi-daemon/socket w,

  # nis
  

##included <abstractions/nis>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # NIS rules
  /var/yp/binding/*           r,
  # portmapper may ask root processes to do nis/ldap at low ports
  capability net_bind_service,



  # winbind
  

##included <abstractions/winbind>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # pam_winbindd
  /tmp/.winbindd/pipe  rw,
  /var/{lib,run}/samba/winbindd_privileged/pipe rw,
  /etc/samba/smb.conf         r,
  /usr/lib/samba/valid.dat    r,
  /usr/lib/samba/upcase.dat   r,
  /usr/lib/samba/lowcase.dat  r,



  # likewise
  

##included <abstractions/likewise>
# vim:syntax=apparmor
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  /tmp/.lwidentity/pipe       rw,
  /var/lib/likewise-open/lwidentity_privileged/pipe rw,


  # mdnsd
  

##included <abstractions/mdns>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2006 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # mdnsd
  /etc/nss_mdns.conf r,
  /var/run/mdnsd w,


  # kerberos
  

##included <abstractions/kerberosclient>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # files required by kerberos client programs
  /usr/lib{,32,64}/krb5/plugins/libkrb5/ r,
  /usr/lib{,32,64}/krb5/plugins/libkrb5/* mr,

  /usr/lib{,32,64}/krb5/plugins/preauth/ r,
  /usr/lib{,32,64}/krb5/plugins/preauth/* mr,

  /etc/krb5.keytab            r,
  /etc/krb5.conf              r,

  # config files found via strings on libs
  /etc/krb.conf               r,
  /etc/krb.realms             r,
  /etc/srvtab                 r,

  # credential caches
  /tmp/krb5cc* r,


  # TCP/UDP network access
  network inet  stream,
  network inet6 stream,
  network inet  dgram,
  network inet6 dgram,

  # interface details
  @{PROC}/*/net/route r,

  

##included <abstractions/perl>
# $Id$
# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2009 Novell/SUSE
#    Copyright (C) 2009 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  # a few files typically required for perl scripts
  /usr/bin/perl                  rmix,
  /usr/bin/perl[0-9].[0-9].[0-9] rmix,

  /usr/lib{,32,64}/perl5/**         r,
  /usr/lib{,32,64}/perl{,5}/**.so*  mr,

  /usr/share/perl/**             r,
  /usr/share/perl5/**            r,
  /etc/perl/**                   r,


  /bin/bash rix,
  /dev/tty rw,
  /etc/gitweb.conf r,
  /etc/mime.types r,
  /proc/meminfo r,
  /proc/sys/kernel/ngroups_max r,
  /srv/git/ r,
  /srv/git/** r,
  /usr/bin/perl ix,
  /usr/lib/git/git rix,
  /usr/bin/git-receive-pack rix,
  /usr/share/gitweb/* r,
  /usr/share/gitweb/static/* r,
}


More information about the AppArmor mailing list