From: Jeff Mahoney <jeffm@suse.com>
Subject: profiles: Add openssl abstraction
References: bnc#623886

 Profiles that use openssl have been adding the openssl files piecemeal.

 This patch creates a new openssl abstraction that can be inherited by
 all profiles that use it.


Signed-off-by: Jeff Mahoney <jeffm@suse.com>
---
 profiles/apparmor.d/abstractions/openssl                  |    4 ++++
 profiles/apparmor.d/abstractions/ssl_certs                |    4 ++++
 profiles/apparmor/profiles/extras/usr.lib.postfix.smtp    |    2 +-
 profiles/apparmor/profiles/extras/usr.lib.postfix.smtpd   |    2 +-
 profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork |    2 +-
 profiles/apparmor/profiles/extras/usr.sbin.imapd          |    2 +-
 profiles/apparmor/profiles/extras/usr.sbin.ipop2d         |    2 +-
 profiles/apparmor/profiles/extras/usr.sbin.ipop3d         |    2 +-
 8 files changed, 14 insertions(+), 6 deletions(-)

--- /dev/null
+++ b/profiles/apparmor.d/abstractions/openssl
@@ -0,0 +1,4 @@
+
+  /etc/ssl/openssl.cnf r,
+  /usr/share/ssl/openssl.cnf r,
+
--- a/profiles/apparmor.d/abstractions/ssl_certs
+++ b/profiles/apparmor.d/abstractions/ssl_certs
@@ -15,3 +15,7 @@
   /etc/ssl/certs/* r,
   /usr/share/ca-certificates/ r,
   /usr/share/ca-certificates/** r,
+  /usr/share/ssl/certs/ca-bundle.crt          r,
+
+  /usr/share/ca-certificates/mozilla/ r,
+  /usr/share/ca-certificates/mozilla/* r,
--- a/profiles/apparmor/profiles/extras/usr.lib.postfix.smtp
+++ b/profiles/apparmor/profiles/extras/usr.lib.postfix.smtp
@@ -16,6 +16,7 @@
   #include <abstractions/nameservice>
   #include <abstractions/kerberosclient>
   #include <program-chunks/postfix-common>
+  #include <abstractions/openssl>
 
   capability dac_override,
   capability dac_read_search,
@@ -39,7 +40,6 @@
   /etc/postfix/{ssl/,}*.pem                   r,
   /etc/postfix/prng_exch                      rw,
   /usr/share/ssl/certs/ca-bundle.crt          r,
-  /usr/share/ssl/openssl.cnf                  r,
   /etc/postfix/virtual.db                     r,
   /etc/postfix/sasl_passwd.db                 r,
   /etc/mtab                                   r,
--- a/profiles/apparmor/profiles/extras/usr.lib.postfix.smtpd
+++ b/profiles/apparmor/profiles/extras/usr.lib.postfix.smtpd
@@ -16,6 +16,7 @@
   #include <abstractions/nameservice>
   #include <abstractions/kerberosclient>
   #include <program-chunks/postfix-common>
+  #include <abstractions/openssl>
 
   capability dac_override,
   capability dac_read_search,
@@ -44,7 +45,6 @@
   /usr/lib/sasl2/*                            mr,
 
   /usr/share/ssl/certs/ca-bundle.crt          r,
-  /usr/share/ssl/openssl.cnf                  r,
 
   /{var/spool/postfix/,}pid/inet.*               rw,
   /{var/spool/postfix/,}private/anvil            w,
--- a/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork
+++ b/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork
@@ -18,6 +18,7 @@
   #include <abstractions/kerberosclient>
   #include <abstractions/nameservice>
   #include <abstractions/perl>
+  #include <abstractions/openssl>
 
   capability kill,
   capability net_bind_service,
@@ -84,7 +85,6 @@
   /usr/share/snmp/mibs r,
   /usr/share/snmp/mibs/*.{txt,mib} r,
   /usr/share/snmp/mibs/.index wr,
-  /usr/share/ssl/openssl.cnf r,
   /var/lock/httpd2.lock.* wl,
   /var/log/apache2/* rwl,
   /var/log/httpd/ssl_scache.dir r,
--- a/profiles/apparmor/profiles/extras/usr.sbin.imapd
+++ b/profiles/apparmor/profiles/extras/usr.sbin.imapd
@@ -16,10 +16,10 @@
   #include <abstractions/nameservice>
   #include <abstractions/authentication>
   #include <abstractions/user-mail>
+  #include <abstractions/openssl>
 
   /dev/urandom                              r,
   /tmp/*                                    rwl,
   /usr/sbin/imapd                           r,
   /usr/share/ssl/certs/imapd.pem            r,
-  /usr/share/ssl/openssl.cnf                r,
 }
--- a/profiles/apparmor/profiles/extras/usr.sbin.ipop2d
+++ b/profiles/apparmor/profiles/extras/usr.sbin.ipop2d
@@ -16,10 +16,10 @@
   #include <abstractions/nameservice>
   #include <abstractions/authentication>
   #include <abstractions/user-mail>
+  #include <abstractions/openssl>
 
   /dev/urandom                           r     ,
   /tmp/.*                                rwl   ,
   /usr/sbin/ipop2d                       rmix,
   /usr/share/ssl/certs/ipop2d.pem        r     ,
-  /usr/share/ssl/openssl.cnf             r     ,
 }
--- a/profiles/apparmor/profiles/extras/usr.sbin.ipop3d
+++ b/profiles/apparmor/profiles/extras/usr.sbin.ipop3d
@@ -16,10 +16,10 @@
   #include <abstractions/nameservice>
   #include <abstractions/authentication>
   #include <abstractions/user-mail>
+  #include <abstractions/openssl>
 
   /dev/urandom                           r     ,
   /tmp/.*                                rwl   ,
   /usr/sbin/ipop3d                       rmix,
   /usr/share/ssl/certs/ipop3d.pem        r     ,
-  /usr/share/ssl/openssl.cnf             r     ,
 }