apparmor/apparmor-lessopen-nfs-workaround.diff

Index: profiles/apparmor.d/usr.bin.lessopen.sh
===================================================================
--- profiles/apparmor.d/usr.bin.lessopen.sh.orig	2019-01-06 20:05:38.582356924 +0100
+++ profiles/apparmor.d/usr.bin.lessopen.sh	2019-01-06 20:08:26.885706133 +0100
@@ -13,6 +13,10 @@
   capability dac_override,
   capability dac_read_search,
 
+  # workaround for https://bugzilla.opensuse.org/show_bug.cgi?id=1119937 / https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1784499
+  network inet stream,
+  network inet6 stream,
+
   /** rk,
   /{usr/,}bin/bash mrix,
   /{usr/,}bin/rpm mrix,
Accepting request 663645 from home:cboltz - add apparmor-lessopen-nfs-workaround.diff: allow network access in lessopen.sh for reading files on NFS (workaround for boo#1119937 / lp#1784499) OBS-URL: https://build.opensuse.org/request/show/663645 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=229 2019-01-08 13:18:00 +01:00			`Index: profiles/apparmor.d/usr.bin.lessopen.sh`
			`===================================================================`
			`--- profiles/apparmor.d/usr.bin.lessopen.sh.orig 2019-01-06 20:05:38.582356924 +0100`
			`+++ profiles/apparmor.d/usr.bin.lessopen.sh 2019-01-06 20:08:26.885706133 +0100`
Accepting request 844157 from home:cboltz - update to AppArmor 3.0.0 - introduce feature abi declaration in profiles to enable use of new rule types (for openSUSE: dbus and unix rules) - support xattr attachment conditionals - experimental support for kill and unconfined profile modes - rewritten aa-status (in C), including support for new profile modes - rewritten aa-notify (in python), finally dropping the perl requirement at runtime - new tool aa-features-abi for extracting feature abis from the kernel - update profiles to have profile names and to use 3.0 feature abi - introduce @{etc_ro} and @{etc_rw} profile variables - new profile for php-fpm - several updates to profiles and abstractions (including boo#1166007) - fully support 'include if exists' in the aa-* tools - rewrite handling of alias, include, link and variable rules in the aa-* tools - rewrite and simplify log handling in the aa-logprof and aa-genprof - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0 for the detailed upstream changelog - patches: - add changes-since-3.0.0.diff with upstream fixes since the 3.0.0 release up to 3e18c0785abc03ee42a022a67a27a085516a7921 - drop upstreamed usr-etc-abstractions-base-nameservice.diff - drop 2.13-only libapparmor-so-number.diff - refresh apparmor-enable-profile-cache.diff - partially upstreamed - update apparmor-samba-include-permissions-for-shares.diff and apparmor-lessopen-profile.patch - switch to "include if exists" - apparmor-lessopen-profile.patch: add abi rule to lessopen profile - refresh apparmor-lessopen-nfs-workaround.diff - move away very loose apache profile that doesn't even match the apache2 binary path in openSUSE to avoid confusion (boo#872984) - move rewritten aa-status from utils to parser subpackage - add aa-features-abi to parser subpackage - replace perl and libnotify-tools requires with requiring python3-notify2 and python3-psutil (needed by the rewritten aa-notify) - drop ancient cleanup for /etc/init.d/subdomain from parser %pre - drop (never enabled) conditionals to build with python2 and to build the python-apparmor subpackage (upstream dropped python2 support) - drop setting PYTHON and PYTHON_VERSIONS env variable, no longer needed - set PYFLAKES path for utils check - add precompiled_cache build conditional to allow faster local builds without using kvm - remove duplicated BuildRequires: swig libapparmor: - update to AppArmor 3.0.0 - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0 for the detailed upstream changelog - add changes-since-3.0.0.diff with upstream fixes since the 3.0.0 release up to 3e18c0785abc03ee42a022a67a27a085516a7921 - drop 2.13-only patch libapparmor-so-number.diff OBS-URL: https://build.opensuse.org/request/show/844157 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=281 2020-10-26 21:16:22 +01:00			`@@ -13,6 +13,10 @@`
Accepting request 663645 from home:cboltz - add apparmor-lessopen-nfs-workaround.diff: allow network access in lessopen.sh for reading files on NFS (workaround for boo#1119937 / lp#1784499) OBS-URL: https://build.opensuse.org/request/show/663645 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=229 2019-01-08 13:18:00 +01:00			`capability dac_override,`
			`capability dac_read_search,`

			`+ # workaround for https://bugzilla.opensuse.org/show_bug.cgi?id=1119937 / https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1784499`
			`+ network inet stream,`
			`+ network inet6 stream,`
			`+`
			`/** rk,`
Accepting request 694059 from home:cboltz - update lessopen.sh profile for usrMerge (bash and tar) (boo#1132350) OBS-URL: https://build.opensuse.org/request/show/694059 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=240 2019-04-14 17:15:50 +02:00			`/{usr/,}bin/bash mrix,`
Accepting request 663645 from home:cboltz - add apparmor-lessopen-nfs-workaround.diff: allow network access in lessopen.sh for reading files on NFS (workaround for boo#1119937 / lp#1784499) OBS-URL: https://build.opensuse.org/request/show/663645 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=229 2019-01-08 13:18:00 +01:00			`/{usr/,}bin/rpm mrix,`