pool/apparmor
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1062692 from security:apparmor

Browse Source 
- add nscd-systemd-userdb.diff: allow nscd to read systemd-userdb
  (boo#1207698) (forwarded request 1062036 from cboltz)

OBS-URL: https://build.opensuse.org/request/show/1062692
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apparmor?expand=0&rev=186
This commit is contained in:
Dominique Leuenberger 2023-02-04 13:11:00 +00:00 committed by Git OBS Bridge
commit b0ebae81de
3 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
apparmor.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Mon Jan 30 11:33:05 UTC 2023 - Christian Boltz <suse-beta@cboltz.de>
- add nscd-systemd-userdb.diff: allow nscd to read systemd-userdb
(boo#1207698)
-------------------------------------------------------------------
Tue Dec 27 10:20:43 UTC 2022 - Ludwig Nussel <lnussel@suse.com>

4
apparmor.spec
View File

@ -91,6 +91,9 @@ Patch6: apache-extra-profile-include-if-exists.diff
# allow reading /sys/devices/system/cpu/possible in dnsmasc//libvirt-leaseshelper (boo#1202849, submitted upstream 2022-08-28 https://gitlab.com/apparmor/apparmor/-/merge_requests/917)
Patch12: dnsmasq-cpu-possible.diff
# allow nscd to read systemd userdb (boo#1207698, submitted upstream 2023-01-30 https://gitlab.com/apparmor/apparmor/-/merge_requests/977)
Patch13: nscd-systemd-userdb.diff
PreReq: sed
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: bison
@ -356,6 +359,7 @@ mv -v profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 profiles/apparmor/
%patch5
%patch6
%patch12 -p1
%patch13 -p1
%build
export SUSE_ASNEEDED=0

36
nscd-systemd-userdb.diff Normal file
View File

@ -0,0 +1,36 @@
From https://gitlab.com/apparmor/apparmor/-/merge_requests/977
From cb83ab51636e93371225c21906e01821b5b4261a Mon Sep 17 00:00:00 2001
From: Christian Boltz <apparmor@cboltz.de>
Date: Mon, 30 Jan 2023 12:26:31 +0100
Subject: [PATCH] nscd: allow using systemd-userdb
If systemd-userdb is used to configure some users, nscd needs to read
the userdb files.
See also https://www.freedesktop.org/software/systemd/man/nss-systemd.html
for the list of possible filenames (and symlinks).
Fixes: http://bugzilla.opensuse.org/show_bug.cgi?id=1207698
---
profiles/apparmor.d/usr.sbin.nscd | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/profiles/apparmor.d/usr.sbin.nscd b/profiles/apparmor.d/usr.sbin.nscd
index 80f970988..baa858ea6 100644
--- a/profiles/apparmor.d/usr.sbin.nscd
+++ b/profiles/apparmor.d/usr.sbin.nscd
@@ -41,6 +41,10 @@ profile nscd /usr/{bin,sbin}/nscd {
@{PROC}/@{pid}/fd/* r,
@{PROC}/@{pid}/mounts r,
+ # systemd-userdb
+ /{etc,run,run/host,/usr/lib}/userdb/ r,
+ /{etc,run,run/host,/usr/lib}/userdb/*.{user,user-privileged,group,group-privileged} r,
+
# Site-specific additions and overrides. See local/README for details.
include if exists <local/usr.sbin.nscd>
}
--
GitLab