Marcus Rueckert
cb8cbecbf9
Accepted submit request 58682 from user coolo OBS-URL: https://build.opensuse.org/request/show/58682 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apparmor?expand=0&rev=3
136 lines
4.9 KiB
Plaintext
136 lines
4.9 KiB
Plaintext
From: Jeff Mahoney <jeffm@suse.com>
|
|
Subject: profiles: Add openssl abstraction
|
|
References: bnc#623886
|
|
|
|
Profiles that use openssl have been adding the openssl files piecemeal.
|
|
|
|
This patch creates a new openssl abstraction that can be inherited by
|
|
all profiles that use it.
|
|
|
|
|
|
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
|
|
---
|
|
profiles/apparmor.d/abstractions/openssl | 4 ++++
|
|
profiles/apparmor.d/abstractions/ssl_certs | 4 ++++
|
|
profiles/apparmor/profiles/extras/usr.lib.postfix.smtp | 2 +-
|
|
profiles/apparmor/profiles/extras/usr.lib.postfix.smtpd | 2 +-
|
|
profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork | 2 +-
|
|
profiles/apparmor/profiles/extras/usr.sbin.imapd | 2 +-
|
|
profiles/apparmor/profiles/extras/usr.sbin.ipop2d | 2 +-
|
|
profiles/apparmor/profiles/extras/usr.sbin.ipop3d | 2 +-
|
|
8 files changed, 14 insertions(+), 6 deletions(-)
|
|
|
|
--- /dev/null
|
|
+++ b/profiles/apparmor.d/abstractions/openssl
|
|
@@ -0,0 +1,4 @@
|
|
+
|
|
+ /etc/ssl/openssl.cnf r,
|
|
+ /usr/share/ssl/openssl.cnf r,
|
|
+
|
|
--- a/profiles/apparmor.d/abstractions/ssl_certs
|
|
+++ b/profiles/apparmor.d/abstractions/ssl_certs
|
|
@@ -15,3 +15,7 @@
|
|
/etc/ssl/certs/* r,
|
|
/usr/share/ca-certificates/ r,
|
|
/usr/share/ca-certificates/** r,
|
|
+ /usr/share/ssl/certs/ca-bundle.crt r,
|
|
+
|
|
+ /usr/share/ca-certificates/mozilla/ r,
|
|
+ /usr/share/ca-certificates/mozilla/* r,
|
|
--- a/profiles/apparmor/profiles/extras/usr.lib.postfix.smtp
|
|
+++ b/profiles/apparmor/profiles/extras/usr.lib.postfix.smtp
|
|
@@ -16,6 +16,7 @@
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/kerberosclient>
|
|
#include <program-chunks/postfix-common>
|
|
+ #include <abstractions/openssl>
|
|
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
@@ -39,7 +40,6 @@
|
|
/etc/postfix/{ssl/,}*.pem r,
|
|
/etc/postfix/prng_exch rw,
|
|
/usr/share/ssl/certs/ca-bundle.crt r,
|
|
- /usr/share/ssl/openssl.cnf r,
|
|
/etc/postfix/virtual.db r,
|
|
/etc/postfix/sasl_passwd.db r,
|
|
/etc/mtab r,
|
|
--- a/profiles/apparmor/profiles/extras/usr.lib.postfix.smtpd
|
|
+++ b/profiles/apparmor/profiles/extras/usr.lib.postfix.smtpd
|
|
@@ -16,6 +16,7 @@
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/kerberosclient>
|
|
#include <program-chunks/postfix-common>
|
|
+ #include <abstractions/openssl>
|
|
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
@@ -44,7 +45,6 @@
|
|
/usr/lib/sasl2/* mr,
|
|
|
|
/usr/share/ssl/certs/ca-bundle.crt r,
|
|
- /usr/share/ssl/openssl.cnf r,
|
|
|
|
/{var/spool/postfix/,}pid/inet.* rw,
|
|
/{var/spool/postfix/,}private/anvil w,
|
|
--- a/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork
|
|
+++ b/profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork
|
|
@@ -18,6 +18,7 @@
|
|
#include <abstractions/kerberosclient>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/perl>
|
|
+ #include <abstractions/openssl>
|
|
|
|
capability kill,
|
|
capability net_bind_service,
|
|
@@ -84,7 +85,6 @@
|
|
/usr/share/snmp/mibs r,
|
|
/usr/share/snmp/mibs/*.{txt,mib} r,
|
|
/usr/share/snmp/mibs/.index wr,
|
|
- /usr/share/ssl/openssl.cnf r,
|
|
/var/lock/httpd2.lock.* wl,
|
|
/var/log/apache2/* rwl,
|
|
/var/log/httpd/ssl_scache.dir r,
|
|
--- a/profiles/apparmor/profiles/extras/usr.sbin.imapd
|
|
+++ b/profiles/apparmor/profiles/extras/usr.sbin.imapd
|
|
@@ -16,10 +16,10 @@
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/authentication>
|
|
#include <abstractions/user-mail>
|
|
+ #include <abstractions/openssl>
|
|
|
|
/dev/urandom r,
|
|
/tmp/* rwl,
|
|
/usr/sbin/imapd r,
|
|
/usr/share/ssl/certs/imapd.pem r,
|
|
- /usr/share/ssl/openssl.cnf r,
|
|
}
|
|
--- a/profiles/apparmor/profiles/extras/usr.sbin.ipop2d
|
|
+++ b/profiles/apparmor/profiles/extras/usr.sbin.ipop2d
|
|
@@ -16,10 +16,10 @@
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/authentication>
|
|
#include <abstractions/user-mail>
|
|
+ #include <abstractions/openssl>
|
|
|
|
/dev/urandom r ,
|
|
/tmp/.* rwl ,
|
|
/usr/sbin/ipop2d rmix,
|
|
/usr/share/ssl/certs/ipop2d.pem r ,
|
|
- /usr/share/ssl/openssl.cnf r ,
|
|
}
|
|
--- a/profiles/apparmor/profiles/extras/usr.sbin.ipop3d
|
|
+++ b/profiles/apparmor/profiles/extras/usr.sbin.ipop3d
|
|
@@ -16,10 +16,10 @@
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/authentication>
|
|
#include <abstractions/user-mail>
|
|
+ #include <abstractions/openssl>
|
|
|
|
/dev/urandom r ,
|
|
/tmp/.* rwl ,
|
|
/usr/sbin/ipop3d rmix,
|
|
/usr/share/ssl/certs/ipop3d.pem r ,
|
|
- /usr/share/ssl/openssl.cnf r ,
|
|
}
|