AppArmor Profiles

Merge lp://qastaging/~sdeziel/apparmor-profiles/unbound-profile into lp://qastaging/apparmor-profiles

Proposed by Simon Déziel on 2011-11-29

Status:

Superseded

Proposed branch:

Merge into:

Diff against target:

1 file modified

ubuntu/12.04/usr.sbin.unbound (+31/-0)

To merge this branch:

bzr merge lp://qastaging/~sdeziel/apparmor-profiles/unbound-profile

Undecided

Fix Released

Link a bug report

Reviewer	Review Type	Date Requested	Status
Jamie Strandboge		2011-11-29	Approve on 2011-11-29
Review via email: mp+83842@code.qastaging.launchpad.net

This proposal has been superseded by a proposal from 2011-11-30.

This adds a profile for Unbound. It supports chroot'ing (in /var/lib/unbound) as well as privilege downgrade.

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2011-11-29:

ACK. Thanks!

review: Approve

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2011-11-29:

Can you comment why this is needed:
capability dac_override,

I added a note in the profile in the meantime.

76. By Simon Déziel on 2011-11-30: remove the useless dac_override capability (thanks Jamie for pointing this out)
77. By Simon Déziel on 2011-11-30: remove the useless chow capability
78. By Simon Déziel on 2011-11-30: Unify rules to cover chroot'ed and non-chroot'ed configurations..
Audit/deny write access to unbound_(control|server).key while still
allowing write access to *.key to support the "auto-trust-anchor-file"
mechanism.
79. By Simon Déziel on 2011-11-30: Merged master branch
80. By Simon Déziel on 2011-11-30: The pid creation requires the dac_override and chown capabilities. Thanks Felix for pointing this out.
81. By Simon Déziel on 2011-11-30: Authorize mmap'ing /etc/{passwd,group} as Unbound insists on this. Thanks Felix for pointing this out.
82. By Simon Déziel on 2011-11-30: The root.key handling is not perfect. Ideally, this file should reside in the chroot
jail but that's not possible until LP: #898287 is addressed. For now, lets allow to
write to the file when not chroot'ed (the default is to run without chroot anyways).
83. By Simon Déziel on 2011-12-20: Merged lp:apparmor-profiles