From 4c137d697e1a53ec6f9e0de5eb5853ecad8ab3a1e2e74e00209103958592290c Mon Sep 17 00:00:00 2001
From: Christian Boltz <suse-beta@cboltz.de>
Date: Thu, 2 Feb 2023 17:23:48 +0000
Subject: [PATCH] Accepting request 1062036 from home:cboltz

- add nscd-systemd-userdb.diff: allow nscd to read systemd-userdb
  (boo#1207698)

OBS-URL: https://build.opensuse.org/request/show/1062036
OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=360
---
 apparmor.changes         |  6 ++++++
 apparmor.spec            |  4 ++++
 nscd-systemd-userdb.diff | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 46 insertions(+)
 create mode 100644 nscd-systemd-userdb.diff

diff --git a/apparmor.changes b/apparmor.changes
index 38bc483..c054b1a 100644
--- a/apparmor.changes
+++ b/apparmor.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Jan 30 11:33:05 UTC 2023 - Christian Boltz <suse-beta@cboltz.de>
+
+- add nscd-systemd-userdb.diff: allow nscd to read systemd-userdb
+  (boo#1207698)
+
 -------------------------------------------------------------------
 Tue Dec 27 10:20:43 UTC 2022 - Ludwig Nussel <lnussel@suse.com>
 
diff --git a/apparmor.spec b/apparmor.spec
index df4a7fa..cc24666 100644
--- a/apparmor.spec
+++ b/apparmor.spec
@@ -91,6 +91,9 @@ Patch6:         apache-extra-profile-include-if-exists.diff
 # allow reading /sys/devices/system/cpu/possible in dnsmasc//libvirt-leaseshelper (boo#1202849, submitted upstream 2022-08-28 https://gitlab.com/apparmor/apparmor/-/merge_requests/917)
 Patch12:        dnsmasq-cpu-possible.diff
 
+# allow nscd to read systemd userdb (boo#1207698, submitted upstream 2023-01-30 https://gitlab.com/apparmor/apparmor/-/merge_requests/977)
+Patch13:        nscd-systemd-userdb.diff
+
 PreReq:         sed
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  bison
@@ -356,6 +359,7 @@ mv -v profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 profiles/apparmor/
 %patch5
 %patch6
 %patch12 -p1
+%patch13 -p1
 
 %build
 export SUSE_ASNEEDED=0
diff --git a/nscd-systemd-userdb.diff b/nscd-systemd-userdb.diff
new file mode 100644
index 0000000..3573e6e
--- /dev/null
+++ b/nscd-systemd-userdb.diff
@@ -0,0 +1,36 @@
+From https://gitlab.com/apparmor/apparmor/-/merge_requests/977
+
+From cb83ab51636e93371225c21906e01821b5b4261a Mon Sep 17 00:00:00 2001
+From: Christian Boltz <apparmor@cboltz.de>
+Date: Mon, 30 Jan 2023 12:26:31 +0100
+Subject: [PATCH] nscd: allow using systemd-userdb
+
+If systemd-userdb is used to configure some users, nscd needs to read
+the userdb files.
+
+See also https://www.freedesktop.org/software/systemd/man/nss-systemd.html
+for the list of possible filenames (and symlinks).
+
+Fixes: http://bugzilla.opensuse.org/show_bug.cgi?id=1207698
+---
+ profiles/apparmor.d/usr.sbin.nscd | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/profiles/apparmor.d/usr.sbin.nscd b/profiles/apparmor.d/usr.sbin.nscd
+index 80f970988..baa858ea6 100644
+--- a/profiles/apparmor.d/usr.sbin.nscd
++++ b/profiles/apparmor.d/usr.sbin.nscd
+@@ -41,6 +41,10 @@ profile nscd /usr/{bin,sbin}/nscd {
+   @{PROC}/@{pid}/fd/* r,
+   @{PROC}/@{pid}/mounts r,
+ 
++  # systemd-userdb
++  /{etc,run,run/host,/usr/lib}/userdb/ r,
++  /{etc,run,run/host,/usr/lib}/userdb/*.{user,user-privileged,group,group-privileged} r,
++
+   # Site-specific additions and overrides. See local/README for details.
+   include if exists <local/usr.sbin.nscd>
+ }
+-- 
+GitLab
+