Accepting request 305835 from Base:System

apparmor profile change and doc dependency update

OBS-URL: https://build.opensuse.org/request/show/305835
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/rsyslog?expand=0&rev=106

module-gssapi

@@ -1,3 +0,0 @@
-  # rsyslog-module-gssapi
-  # couldn't test because not kerberos server is available
-  # but it shouldn't require any special permissions anyhow

module-gtls

@@ -1,4 +0,0 @@
-  # for logging via TLS (rsyslog-module-gtls)
-  # keys/certificates need to be located under /etc/rsyslog.d or permissions need to be adjusted here
-  # rsyslog tries to write to the certificates for no reason, so deny this quietly
-  deny /etc/rsyslog.d/* w,

module-mysql

@@ -3,4 +3,4 @@
   #include <abstractions/p11-kit>
   /etc/my.cnf r,
   /etc/my.cnf.d/ r,
-  /etc/my.cnf.d/default_plugins.cnf r,
+  /etc/my.cnf.d/* r,

module-pgsql

@@ -1 +0,0 @@
-  # for logging to postgresql (rsyslog-module-pgsql)

module-relp

@@ -1 +0,0 @@
-  # for logging via relp (rsyslog-module-relp)

rsyslog.changes

@@ -1,3 +1,17 @@
+-------------------------------------------------------------------
+Thu Apr 30 12:39:07 UTC 2015 - jengelh@inai.de
+
+- Documentation does not depend on the presence of anything
+
+-------------------------------------------------------------------
+Mon Apr 27 14:53:52 UTC 2015 - jsegitz@novell.com
+
+- Adjusted apparmor profile based on the suggestions by Christian Boltz
+  * Removed empty files: module-pgsql, module-relp, module-gssapi, module-gtls
+  * Moved profiles to /usr/share/apparmor/extra-profiles/
+  * Blocked capability block_suspend
+  plus some other small fixes
+
 -------------------------------------------------------------------
 Mon Apr 20 14:22:32 UTC 2015 - jsegitz@novell.com
 

rsyslog.spec

@@ -200,13 +200,9 @@ Source2:        rsyslog.conf.in
 Source4:        rsyslog.d.remote.conf.in
 Source5:        rsyslog-service-prepare.in
 Source6:        usr.sbin.rsyslogd
-Source7:        module-gssapi
+Source7:        module-mysql
-Source8:        module-gtls
+Source8:        module-snmp
-Source9:        module-mysql
+Source9:        module-udpspoof
-Source10:       module-pgsql
-Source11:       module-relp
-Source12:       module-snmp
-Source13:       module-udpspoof
 Source14:       http://www.rsyslog.com/files/download/rsyslog/rsyslog-doc-%{upstream_version}.tar.gz
 Source15:       rsyslog.firewall
 
@@ -215,11 +211,10 @@ Patch0:         rsyslog-unit.patch
 
 # this is a dirty hack since % dir does only work for the specified directory and nothing above
 # but I want to be able to switch this to /etc/apparmor.d once the profiles received more testing
-%define APPARMOR_PROFILE_PATH /etc/apparmor/profiles/extras
+%define APPARMOR_PROFILE_PATH /usr/share/apparmor/extra-profiles
-%define APPARMOR_PROFILE_PATH_DIR_COMMANDS %dir /etc/apparmor/ \
+%define APPARMOR_PROFILE_PATH_DIR_COMMANDS %dir /usr/share/apparmor \
-                                           %dir /etc/apparmor/profiles \
+                                           %dir /usr/share/apparmor/extra-profiles \
-                                           %dir /etc/apparmor/profiles/extras \
+                                           %dir /usr/share/apparmor/extra-profiles/rsyslog.d
-                                           %dir /etc/apparmor/profiles/extras/rsyslog.d
 
 %description
 Rsyslog is an enhanced multi-threaded syslogd supporting, among others,
@@ -231,7 +226,6 @@ protected syslog relay chains while at the same time being very easy to
 setup for the novice user.
 
 %package doc
-Requires:       %{name} = %{version}
 Summary:        Additional documentation for rsyslog
 Group:          System/Daemons
 
@@ -737,26 +731,14 @@ touch %{buildroot}%{rsyslog_sockets_cfg}
 chmod 644 %{buildroot}%{rsyslog_sockets_cfg}
 mkdir -p %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
 install -m0640 %{SOURCE6} %{buildroot}%{APPARMOR_PROFILE_PATH}/
-%if %{with gssapi}
+%if %{with mysql}
   install -m0640 %{SOURCE7} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
 %endif
-%if %{with gnutls}
+%if %{with snmp}
   install -m0640 %{SOURCE8} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
 %endif
-%if %{with mysql}
-  install -m0640 %{SOURCE9} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
-%endif
-%if %{with pgsql}
-  install -m0640 %{SOURCE10} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
-%endif
-%if %{with relp}
-  install -m0640 %{SOURCE11} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
-%endif
-%if %{with snmp}
-  install -m0640 %{SOURCE12} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
-%endif
 %if %{with udpspoof}
-  install -m0640 %{SOURCE13} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
+  install -m0640 %{SOURCE9} %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
 %endif
 
 # firewall config
@@ -994,7 +976,6 @@ fi
 %{rsyslog_module_dir_withdeps}/omgssapi.so
 %{rsyslog_module_dir_withdeps}/imgssapi.so
 %{rsyslog_module_dir_withdeps}/lmgssutil.so
-%config  %{APPARMOR_PROFILE_PATH}/rsyslog.d/module-gssapi
 %endif
 
 %if %{with mysql}
@@ -1012,7 +993,6 @@ fi
 %defattr(-,root,root)
 %doc %{rsyslogdocdir}/pgsql-createDB.sql
 %{rsyslog_module_dir_withdeps}/ompgsql.so
-%config %{APPARMOR_PROFILE_PATH}/rsyslog.d/module-pgsql
 %endif
 
 %if %{with dbi}
@@ -1036,7 +1016,6 @@ fi
 %files module-gtls
 %defattr(-,root,root)
 %{rsyslog_module_dir_withdeps}/lmnsd_gtls.so
-%config %{APPARMOR_PROFILE_PATH}/rsyslog.d/module-gtls
 %endif
 
 %if %{with relp}
@@ -1045,7 +1024,6 @@ fi
 %defattr(-,root,root)
 %{rsyslog_module_dir_withdeps}/imrelp.so
 %{rsyslog_module_dir_withdeps}/omrelp.so
-%config %{APPARMOR_PROFILE_PATH}/rsyslog.d/module-relp
 %endif
 
 %if %{with mmnormalize}

usr.sbin.rsyslogd

@@ -16,11 +16,11 @@
   # general networking is allowed here
   #include <abstractions/nameservice>
 
-  capability block_suspend,
   capability dac_override,
   capability sys_nice,
   capability sys_tty_config,
   capability syslog,
+  deny capability block_suspend,
 
   /dev/tty* w,
   /dev/xconsole rw,
@@ -33,6 +33,7 @@
   /usr/sbin/rsyslogd mr,
 
   /var/log/** rw,
+  /var/lib/*/dev/log w,
 
   /proc/kmsg r,
 
@@ -43,4 +44,9 @@
   # include rules for rsyslog-module-* packages
   # change that to <rsyslog.d> once it is moved to /etc/apparmor.d
   #include "/etc/apparmor/profiles/extras/rsyslog.d"
+  
+  # for logging via TLS (rsyslog-module-gtls)
+  # keys/certificates need to be located under /etc/rsyslog.d or permissions need to be adjusted here
+  # rsyslog tries to write to the certificates for no reason, so deny this quietly
+  deny /etc/rsyslog.d/* w,
 }