Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
Subject: Adjust Akonadi AppArmor profiles for openSUSE and AppArmor 3.0
|
|
|
|
|
|
|
|
|
|
From: Christian Boltz <suse-beta@cboltz.de>
|
|
|
|
|
|
2021-07-12 06:32:38 +02:00
|
|
|
* add paths to match the openSUSE file location
|
|
|
|
|
* use @{postgresqlpath} for the various postgresql paths (and add
|
|
|
|
|
/usr/lib/postgresql*[0-9]/ for openSUSE)
|
|
|
|
|
* add 'abi' rules to enable and enforce all AppArmor features
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
|
|
|
|
|
|
2021-07-12 06:32:38 +02:00
|
|
|
Index: akonadi-21.04.3/apparmor/mariadbd_akonadi
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
===================================================================
|
2021-07-12 06:32:38 +02:00
|
|
|
--- akonadi-21.04.3.orig/apparmor/mariadbd_akonadi 2021-06-08 21:02:40.000000000 +0200
|
|
|
|
|
+++ akonadi-21.04.3/apparmor/mariadbd_akonadi 2021-07-11 18:47:18.489487989 +0200
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
@@ -1,3 +1,5 @@
|
|
|
|
|
+abi <abi/3.0>,
|
|
|
|
|
+
|
|
|
|
|
#include <tunables/global>
|
|
|
|
|
|
|
|
|
|
@{xdg_data_home}=@{HOME}/.local/share
|
2021-07-12 06:32:38 +02:00
|
|
|
Index: akonadi-21.04.3/apparmor/mysqld_akonadi
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
===================================================================
|
2021-07-12 06:32:38 +02:00
|
|
|
--- akonadi-21.04.3.orig/apparmor/mysqld_akonadi 2021-06-08 21:02:40.000000000 +0200
|
|
|
|
|
+++ akonadi-21.04.3/apparmor/mysqld_akonadi 2021-07-11 18:47:18.489487989 +0200
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
@@ -1,3 +1,5 @@
|
|
|
|
|
+abi <abi/3.0>,
|
|
|
|
|
+
|
|
|
|
|
#include <tunables/global>
|
|
|
|
|
|
|
|
|
|
@{xdg_data_home}=@{HOME}/.local/share
|
2021-07-12 06:32:38 +02:00
|
|
|
Index: akonadi-21.04.3/apparmor/postgresql_akonadi
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
===================================================================
|
2021-07-12 06:32:38 +02:00
|
|
|
--- akonadi-21.04.3.orig/apparmor/postgresql_akonadi 2021-06-08 21:02:40.000000000 +0200
|
|
|
|
|
+++ akonadi-21.04.3/apparmor/postgresql_akonadi 2021-07-11 18:47:58.253406613 +0200
|
|
|
|
|
@@ -1,8 +1,12 @@
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
+abi <abi/3.0>,
|
|
|
|
|
+
|
|
|
|
|
#include <tunables/global>
|
|
|
|
|
|
|
|
|
|
@{xdg_data_home}=@{HOME}/.local/share
|
2021-07-12 06:32:38 +02:00
|
|
|
|
|
|
|
|
-profile postgresql_akonadi {
|
|
|
|
|
+@{postgresqlpath} = /usr/ /usr/lib/postgresql/*/ /usr/lib/postgresql*[0-9]/ /opt/pgsql*/
|
|
|
|
|
+
|
|
|
|
|
+profile postgresql_akonadi flags=(attach_disconnected) {
|
|
|
|
|
#include <abstractions/base>
|
|
|
|
|
#include <abstractions/bash>
|
|
|
|
|
#include <abstractions/consoles>
|
|
|
|
|
@@ -15,27 +19,30 @@ profile postgresql_akonadi {
|
|
|
|
|
signal receive set=kill peer=/usr/bin/akonadiserver,
|
|
|
|
|
signal receive set=term peer=/usr/bin/akonadiserver,
|
|
|
|
|
|
|
|
|
|
+ deny / rw, # disconnected path
|
|
|
|
|
+
|
|
|
|
|
/etc/passwd r,
|
|
|
|
|
/{usr/,}bin/{b,d}ash mrix,
|
|
|
|
|
/{usr/,}bin/locale mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/initdb mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_ctl mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/postgres mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/initdb mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_ctl mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/postgres mrix,
|
|
|
|
|
/usr/share/postgresql/** r,
|
|
|
|
|
+ /usr/share/postgresql*[0-9]/timezonesets/Default r, # use globbing?
|
|
|
|
|
owner /dev/shm/PostgreSQL.* rw,
|
|
|
|
|
owner @{xdg_data_home}/akonadi/** rwlk,
|
|
|
|
|
owner @{xdg_data_home}/akonadi/db_data/** l,
|
|
|
|
|
owner /{,var/}run/user/@{uid}/akonadi** rwk,
|
|
|
|
|
|
|
|
|
|
# pg_upgrade
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/}bin/pg_upgrade mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_upgrade mrix,
|
|
|
|
|
/opt/pgsql*/** mr,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_controldata mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_resetwal mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_dumpall mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_dump mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/vacuumdb mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/psql mrix,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_restore mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_controldata mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_resetwal mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_dumpall mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_dump mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/vacuumdb mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/psql mrix,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_restore mrix,
|
|
|
|
|
/{usr/,}bin/cp mrix,
|
|
|
|
|
}
|
|
|
|
|
Index: akonadi-21.04.3/apparmor/usr.bin.akonadiserver
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
===================================================================
|
2021-07-12 06:32:38 +02:00
|
|
|
--- akonadi-21.04.3.orig/apparmor/usr.bin.akonadiserver 2021-06-08 21:02:40.000000000 +0200
|
|
|
|
|
+++ akonadi-21.04.3/apparmor/usr.bin.akonadiserver 2021-07-11 18:49:46.837184405 +0200
|
|
|
|
|
@@ -1,9 +1,13 @@
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
+abi <abi/3.0>,
|
|
|
|
|
+
|
|
|
|
|
#include <tunables/global>
|
|
|
|
|
|
|
|
|
|
@{xdg_data_home}=@{HOME}/.local/share
|
2021-07-12 06:32:38 +02:00
|
|
|
|
|
|
|
|
@{xdg_config_home}=@{HOME}/.config
|
|
|
|
|
|
|
|
|
|
+@{postgresqlpath} = /usr/ /usr/lib/postgresql/*/ /usr/lib/postgresql*[0-9]/ /opt/pgsql*/
|
|
|
|
|
+
|
|
|
|
|
/usr/bin/akonadiserver {
|
|
|
|
|
#include <abstractions/base>
|
|
|
|
|
#include <abstractions/consoles>
|
|
|
|
|
@@ -37,6 +41,7 @@
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
/etc/xdg/** r,
|
|
|
|
|
/usr/bin/akonadiserver mr,
|
|
|
|
|
/usr/lib/x86_64-linux-gnu/libexec/drkonqi PUx,
|
|
|
|
|
+ /usr/lib{,64}/libexec/drkonqi PUx,
|
|
|
|
|
/usr/bin/mariadb-admin PUx -> mariadbd_akonadi,
|
|
|
|
|
/usr/bin/mariadb-check PUx -> mariadbd_akonadi,
|
|
|
|
|
/usr/bin/mariadb-install-db PUx -> mariaddbd_akonadi,
|
2021-07-12 06:32:38 +02:00
|
|
|
@@ -45,14 +50,18 @@
|
|
|
|
|
/usr/bin/mysqladmin PUx -> mysqld_akonadi,
|
|
|
|
|
/usr/bin/mysqlcheck PUx -> mysqld_akonadi,
|
|
|
|
|
/usr/{,s}bin/mysqld PUx -> mysqld_akonadi,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/initdb PUx -> postgresql_akonadi,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_ctl PUx -> postgresql_akonadi,
|
|
|
|
|
- /{usr/,usr/lib/postgresql/*/}bin/pg_upgrade PUx -> postgresql_akonadi,
|
|
|
|
|
+ @{postgresqlpath}/bin/initdb PUx -> postgresql_akonadi,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_ctl PUx -> postgresql_akonadi,
|
|
|
|
|
+ @{postgresqlpath}/bin/pg_upgrade PUx -> postgresql_akonadi,
|
|
|
|
|
+ /usr/local/share/mime/mime.cache r,
|
|
|
|
|
+ /usr/local/share/mime/types r,
|
Accepting request 897736 from home:cboltz:branches:KDE:Applications
- Install AppArmor profiles (as -apparmor subpackage)
- add akonadi-apparmor-opensuse.diff to adjust the profiles to
openSUSE paths, and to add 'abi' rules to the profiles
Thanks for the quick review in SR 897569. This SR should fix the issues you
noticed.
Another diff to SR 897569 is that I added 'abi' rules to the profiles to ensure
that all AppArmor features get enforced.
Original description (from SR 897569):
Note: The akonadi-server-apparmor package will _not_ be installed
automatically, so users will have to explicitely install it if they want
to use the AppArmor profiles for akonadi-server.
I tested the profiles with my setup (which is using the system-wide
mariadb with akonadi), other setups might need some adjustments.
My proposal is: As soon as this change reaches Tumbleweed, let's send
out a call for testing on the factory mailinglist (I can do that, unless
you want to do it yourself).
I'll update the profiles as needed (as bugreports come in) so that they
work with mariadb and postgresql, with the goal to have profiles that
"just work".
To get started, I added a patch with some profile additions (openSUSE
and Debian paths somewhat differ). When the dust/bugreports settles, we
should of course get the patch upstream. (I can probably do that, but
might need some help - it's been a long time since I last submitted a
patch to one of the KDE repos.)
If you want to test yourself, note that you'll need to restart akonadi
to actually enable the AppArmor confinement.
OBS-URL: https://build.opensuse.org/request/show/897736
OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/akonadi-server?expand=0&rev=279
2021-06-08 14:04:10 +02:00
|
|
|
/usr/sbin/mysqld PUx -> mysqld_akonadi,
|
|
|
|
|
+ /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
|
|
|
|
|
/usr/share/mime/mime.cache r,
|
|
|
|
|
/usr/share/mime/packages/ r,
|
|
|
|
|
/usr/share/mime/types r,
|
|
|
|
|
- /usr/share/qt/translations/* r,
|
|
|
|
|
+ /usr/share/qt5/qtlogging.ini r,
|
|
|
|
|
+ /usr/share/qt{,5}/translations/* r,
|
|
|
|
|
/usr/share/mysql/** r,
|
|
|
|
|
@{PROC}/sys/kernel/core_pattern r,
|
|
|
|
|
@{PROC}/sys/kernel/random/boot_id r,
|