[apparmor] [patch] nscd profile

[Christian Boltz]

Hello,

the following patch is the result of last night's discussion on IRC.
(Well, at least for me it was night ;-)


I propose this patch for trunk and the 2.8 branch.


Add missing permissions to the nscd profile. 
Also deny capability block_suspend because nobody can imagine why it 
would be needed.

References: https://bugzilla.novell.com/show_bug.cgi?id=807104

=== modified file 'profiles/apparmor.d/usr.sbin.nscd'
--- profiles/apparmor.d/usr.sbin.nscd   2013-01-02 23:34:38 +0000
+++ profiles/apparmor.d/usr.sbin.nscd   2013-03-05 00:47:51 +0000
@@ -16,6 +16,7 @@
   #include <abstractions/nameservice>
   #include <abstractions/ssl_certs>
 
+  deny capability block_suspend,
   capability net_bind_service,
   capability setgid,
   capability setuid,
@@ -31,9 +32,9 @@
   /{,var/}run/.nscd_socket wl,
   /{,var/}run/avahi-daemon/socket w,
   /{,var/}run/nscd/ rw,
-  /{,var/}run/nscd/db* wl,
+  /{,var/}run/nscd/db* rwl,
   /{,var/}run/nscd/socket wl,
-  /var/{cache,run}/nscd/{passwd,group,services,hosts} rw,
+  /var/{cache,run}/nscd/{passwd,group,services,hosts,netgroup} rw,
   /{,var/}run/{nscd/,}nscd.pid rwl,
   /var/log/nscd.log rw,
   @{PROC}/@{pid}/fd/ r,
@@ -41,6 +42,7 @@
   @{PROC}/@{pid}/maps r,
   @{PROC}/@{pid}/mounts r,
   @{PROC}/filesystems r,
+  @{PROC}/sys/vm/overcommit_memory r,
 
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.nscd>





Regards,

Christian Boltz
-- 
> Ich hab letztens nen Film gesehen, in dem sich zwei Irre unterhalten 
> haben. Da hat der eine den anderen auch nicht verstanden.
Stimmt, hast Recht. Wann haben wir übrigens wieder Freigang? ;)
[> Martin Borchert und Bernd Brodesser in suse-linux]