[Bug 2072702] Re: AppArmor profile prevents use of TLS keys and certificates

[Andreas Hasenack]

Note also the README.apparmor[1] explanation. Packages can also install
apparmor profile snippets in /etc/apparmor.d/rsyslog.d. If the default
of the freeipa package (or whatever produced /etc/ipa/ca.crt) is to
place certificate and keys in /etc/ipa, maybe it could ship such a
profile snippet.


1.
https://git.launchpad.net/ubuntu/+source/rsyslog/tree/debian/README.apparmor

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/2072702

Title:
  AppArmor profile prevents use of TLS keys and certificates

Status in rsyslog package in Ubuntu:
  New

Bug description:
  I'm trying to use the following configuration:

  # certificate files
  $DefaultNetstreamDriverCAFile /etc/ipa/ca.crt
  $DefaultNetstreamDriverCertFile /etc/ssl/certs/FQDN.crt
  $DefaultNetstreamDriverKeyFile /etc/ssl/private/FQDN.key

  But AppArmor prevents the loading of /etc/ipa/ca.crt and the key file.

  I think rsyslog-gnutls should allow reading the key file.

  But perhaps /etc/ipa/ca.crt needs to be added to
  /etc/apparmor.d/abstractions/ssl_certs which is in the apparmor
  package.

  Version 8.2312.0-3ubuntu9

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/2072702/+subscriptions