61 lines
2.3 KiB
Diff
61 lines
2.3 KiB
Diff
|
commit ee7194a7141b99225bb1d040ef2d37ad47ca838e
|
||
|
|
Author: Christian Boltz <apparmor@cboltz.de>
|
||
|
|
Date: Mon Oct 7 21:47:25 2019 +0200
|
||
|
|
|
||
|
|
Allow /usr/etc/ in abstractions/authentication
|
||
|
|
|
||
|
|
openSUSE (and hopefully some other distributions) work on moving shipped
|
||
|
|
config files from /etc/ to /usr/etc/ so that /etc/ only contains files
|
||
|
|
written by the admin of each system.
|
||
|
|
|
||
|
|
See https://en.opensuse.org/openSUSE:Packaging_UsrEtc for details and
|
||
|
|
the first moved files.
|
||
|
|
|
||
|
|
Updating abstractions/authentication is the first step, and also fixes
|
||
|
|
bugzilla.opensuse.org/show_bug.cgi?id=1153162
|
||
|
|
|
||
|
|
diff --git a/profiles/apparmor.d/abstractions/authentication b/profiles/apparmor.d/abstractions/authentication
|
||
|
|
index b92516f9..58efe6b9 100644
|
||
|
|
--- a/profiles/apparmor.d/abstractions/authentication
|
||
|
|
+++ b/profiles/apparmor.d/abstractions/authentication
|
||
|
|
@@ -2,6 +2,7 @@
|
||
|
|
#
|
||
|
|
# Copyright (C) 2002-2009 Novell/SUSE
|
||
|
|
# Copyright (C) 2009-2012 Canonical Ltd
|
||
|
|
+# Copyright (C) 2019 Christian Boltz
|
||
|
|
#
|
||
|
|
# This program is free software; you can redistribute it and/or
|
||
|
|
# modify it under the terms of version 2 of the GNU General Public
|
||
|
|
@@ -14,13 +15,13 @@
|
||
|
|
# Some services need to perform authentication of users
|
||
|
|
# Such authentication almost certainly needs access to the local users
|
||
|
|
# databases containing passwords, PAM configuration files, PAM libraries
|
||
|
|
- /etc/nologin r,
|
||
|
|
- /etc/pam.d/* r,
|
||
|
|
- /etc/securetty r,
|
||
|
|
- /etc/security/* r,
|
||
|
|
- /etc/shadow r,
|
||
|
|
- /etc/gshadow r,
|
||
|
|
- /etc/pwdb.conf r,
|
||
|
|
+ /{usr/,}etc/nologin r,
|
||
|
|
+ /{usr/,}etc/pam.d/* r,
|
||
|
|
+ /{usr/,}etc/securetty r,
|
||
|
|
+ /{usr/,}etc/security/* r,
|
||
|
|
+ /{usr/,}etc/shadow r,
|
||
|
|
+ /{usr/,}etc/gshadow r,
|
||
|
|
+ /{usr/,}etc/pwdb.conf r,
|
||
|
|
|
||
|
|
/{usr/,}lib{,32,64}/security/pam_filter/* mr,
|
||
|
|
/{usr/,}lib{,32,64}/security/pam_*.so mr,
|
||
|
|
@@ -32,8 +33,8 @@
|
||
|
|
# kerberos
|
||
|
|
#include <abstractions/kerberosclient>
|
||
|
|
# SuSE's pwdutils are different:
|
||
|
|
- /etc/default/passwd r,
|
||
|
|
- /etc/login.defs r,
|
||
|
|
+ /{usr/,}etc/default/passwd r,
|
||
|
|
+ /{usr/,}etc/login.defs r,
|
||
|
|
|
||
|
|
# nis
|
||
|
|
#include <abstractions/nis>
|