Christian Boltz
4ede129d9e
- bugfix release with lots of fixes in all areas - add new userns profiles for balena-etcher, chromium and wike - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_4.0.2 for the detailed upstream changelog - drop upstream(ed) patches: - aa-remove-unknown-fix-unconfined.diff - logprof-mount-empty-source.diff - plasmashell.diff - sampa-rpcd-witness.diff - sddm-xauth.diff - teardown-unconfined.diff - test-aa-notify.diff - tools-fix-redefinition.diff - utils-relax-mount-rules-2.diff - utils-relax-mount-rules.diff - refresh GPG key (was expired) Note: I checked the GPG signature with both the expired and the refreshed key, and it validated with both. OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=421
49 lines
2.2 KiB
Diff
49 lines
2.2 KiB
Diff
From https://gitlab.com/apparmor/apparmor/-/merge_requests/1256
|
|
(adjusted to currently packaged samba-rpcd profile)
|
|
|
|
|
|
From 94ccd111deac35d7deadb07e66d25e045633e221 Mon Sep 17 00:00:00 2001
|
|
From: Christian Boltz <apparmor@cboltz.de>
|
|
Date: Sat, 8 Jun 2024 22:46:53 +0200
|
|
Subject: [PATCH] samba-dcerpcd: allow to execute rpcd_witness
|
|
|
|
... and extend the samba-rpcd profile to also include rpcd_witness.
|
|
|
|
Patch by Noel Power <nopower@suse.com>
|
|
|
|
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1225811
|
|
---
|
|
profiles/apparmor.d/samba-dcerpcd | 2 +-
|
|
profiles/apparmor.d/samba-rpcd | 4 ++--
|
|
2 files changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
Index: apparmor-v4.0.1/profiles/apparmor.d/samba-dcerpcd
|
|
===================================================================
|
|
--- apparmor-v4.0.1.orig/profiles/apparmor.d/samba-dcerpcd 2024-04-12 05:59:30.000000000 +0200
|
|
+++ apparmor-v4.0.1/profiles/apparmor.d/samba-dcerpcd 2024-06-25 21:49:49.017901846 +0200
|
|
@@ -21,7 +21,7 @@ profile samba-dcerpcd /usr/lib*/samba/{,
|
|
/usr/lib*/samba/{,samba/}samba-dcerpcd mr,
|
|
|
|
/usr/lib*/samba/ r,
|
|
- /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} Px -> samba-rpcd,
|
|
+ /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg,witness} Px -> samba-rpcd,
|
|
/usr/lib*/samba/{,samba/}rpcd_classic Px -> samba-rpcd-classic,
|
|
/usr/lib*/samba/{,samba/}rpcd_spoolss Px -> samba-rpcd-spoolss,
|
|
|
|
Index: apparmor-v4.0.1/profiles/apparmor.d/samba-rpcd
|
|
===================================================================
|
|
--- apparmor-v4.0.1.orig/profiles/apparmor.d/samba-rpcd 2024-04-12 05:59:30.000000000 +0200
|
|
+++ apparmor-v4.0.1/profiles/apparmor.d/samba-rpcd 2024-06-25 21:49:49.017901846 +0200
|
|
@@ -13,9 +13,9 @@ abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
-profile samba-rpcd /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} {
|
|
+profile samba-rpcd /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg,witness} {
|
|
include <abstractions/samba-rpcd>
|
|
- /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} mr,
|
|
+ /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg,witness} mr,
|
|
|
|
@{run}/samba/ncalrpc/np/winreg wr,
|
|
|