utils/apparmor/patches/060-openwrt-dnsmasq-profile.patch

   1 --- a/profiles/apparmor.d/usr.sbin.dnsmasq
   2 +++ b/profiles/apparmor.d/usr.sbin.dnsmasq
   3 @@ -1,3 +1,10 @@
   4 +# Last Modified: Thu Jun 10 01:23:44 2021
   5 +abi <abi/3.0>,
   6 +
   7 +include <tunables/global>
   8 +
   9 +@{TFTP_DIR} = /srv/tftp /srv/tftpboot /var/tftp
  10 +
  11  # ------------------------------------------------------------------
  12  #
  13  #    Copyright (C) 2009 John Dong <jdong@ubuntu.com>
  14 @@ -9,126 +16,95 @@
  15  #
  16  # ------------------------------------------------------------------
  17
  18 -abi <abi/3.0>,
  19 -
  20 -@{TFTP_DIR}=/var/tftp /srv/tftp /srv/tftpboot
  21
  22 -include <tunables/global>
  23  profile dnsmasq /usr/{bin,sbin}/dnsmasq flags=(attach_disconnected) {
  24    include <abstractions/base>
  25    include <abstractions/dbus>
  26    include <abstractions/nameservice>
  27 +  include <abstractions/user-tmp>
  28 +  include if exists <local/usr.sbin.dnsmasq>
  29
  30    capability chown,
  31 +  capability dac_override,
  32 +  capability net_admin, # for DHCP server
  33    capability net_bind_service,
  34 +  capability net_raw, # for DHCP server ping checks
  35    capability setgid,
  36    capability setuid,
  37 -  capability dac_override,
  38 -  capability net_admin,         # for DHCP server
  39 -  capability net_raw,           # for DHCP server ping checks
  40 +
  41    network inet raw,
  42    network inet6 raw,
  43
  44 -  signal (receive) peer=/usr/{bin,sbin}/libvirtd,
  45 -  signal (receive) peer=libvirtd,
  46 -  ptrace (readby) peer=/usr/{bin,sbin}/libvirtd,
  47 -  ptrace (readby) peer=libvirtd,
  48 +  signal receive peer=/usr/{bin,sbin}/libvirtd,
  49 +  signal receive peer=libvirtd,
  50
  51 -  owner /dev/tty rw,
  52 +  ptrace readby peer=/usr/{bin,sbin}/libvirtd,
  53 +  ptrace readby peer=libvirtd,
  54
  55 -  @{PROC}/@{pid}/fd/ r,
  56 -
  57 -  /etc/dnsmasq.conf r,
  58 -  /etc/dnsmasq.d/ r,
  59 -  /etc/dnsmasq.d/* r,
  60 -  /etc/dnsmasq.d-available/ r,
  61 -  /etc/dnsmasq.d-available/* r,
  62 -  /etc/ethers r,
  63 -  /etc/NetworkManager/dnsmasq.d/ r,
  64 -  /etc/NetworkManager/dnsmasq.d/* r,
  65    /etc/NetworkManager/dnsmasq-shared.d/ r,
  66    /etc/NetworkManager/dnsmasq-shared.d/* r,
  67 +  /etc/NetworkManager/dnsmasq.d/ r,
  68 +  /etc/NetworkManager/dnsmasq.d/* r,
  69    /etc/dnsmasq-conf.conf r,
  70    /etc/dnsmasq-resolv.conf r,
  71 -
  72 -  /usr/{bin,sbin}/dnsmasq mr,
  73 -
  74 -  /var/log/dnsmasq*.log w,
  75 -
  76 +  /etc/dnsmasq.conf r,
  77 +  /etc/dnsmasq.d-available/ r,
  78 +  /etc/dnsmasq.d-available/* r,
  79 +  /etc/dnsmasq.d/ r,
  80 +  /etc/dnsmasq.d/* r,
  81 +  /etc/ethers r,
  82 +  /tmp/** r,
  83 +  /usr/libexec/libvirt_leaseshelper Cx -> libvirt_leaseshelper,
  84 +  /usr/lib{,64}/libvirt/libvirt_leaseshelper Cx -> libvirt_leaseshelper,
  85    /usr/share/dnsmasq{-base,}/ r,
  86    /usr/share/dnsmasq{-base,}/* r,
  87 -
  88 -  @{run}/*dnsmasq*.pid w,
  89 -  @{run}/dnsmasq-forwarders.conf r,
  90 -  @{run}/dnsmasq/ r,
  91 -  @{run}/dnsmasq/* rw,
  92 -
  93 +  /usr/{bin,sbin}/dnsmasq mr,
  94 +  /var/lib/NetworkManager/dnsmasq-*.leases rw,
  95 +  /var/lib/libvirt/dnsmasq/ r,
  96 +  /var/lib/libvirt/dnsmasq/* r,
  97 +  /var/lib/lxd-bridge/dnsmasq.*.leases rw,
  98 +  /var/lib/lxd/networks/*/dnsmasq.* r,
  99 +  /var/lib/lxd/networks/*/dnsmasq.leases rw,
 100 +  /var/lib/lxd/networks/*/dnsmasq.pid rw,
 101 +  /var/lib/misc/dnsmasq.*.leases rw,
 102    /var/lib/misc/dnsmasq.leases rw, # Required only for DHCP server usage
 103 -
 104 +  /var/log/dnsmasq*.log w,
 105    /{,usr/}bin/{ba,da,}sh ix, # Required to execute --dhcp-script argument
 106 -
 107 -  # access to iface mtu needed for Router Advertisement messages in IPv6
 108 -  # Neighbor Discovery protocol (RFC 2461)
 109 +  @{PROC}/@{pid}/fd/ r,
 110    @{PROC}/sys/net/ipv6/conf/*/mtu r,
 111 -
 112 -  # for the read-only TFTP server
 113    @{TFTP_DIR}/ r,
 114    @{TFTP_DIR}/** r,
 115 -
 116 -  # libvirt config and hosts file for dnsmasq
 117 -  /var/lib/libvirt/dnsmasq/          r,
 118 -  /var/lib/libvirt/dnsmasq/*         r,
 119 -
 120 -  # libvirt pid files for dnsmasq
 121 -  @{run}/libvirt/network/      r,
 122 +  @{run}/*dnsmasq*.pid w,
 123 +  @{run}/NetworkManager/NetworkManager.pid w,
 124 +  @{run}/NetworkManager/dnsmasq.conf r,
 125 +  @{run}/NetworkManager/dnsmasq.pid w,
 126 +  @{run}/dnsmasq-forwarders.conf r,
 127 +  @{run}/dnsmasq/ r,
 128 +  @{run}/dnsmasq/* rw,
 129 +  @{run}/libvirt/network/ r,
 130    @{run}/libvirt/network/*.pid rw,
 131 -
 132 -  # libvirt lease helper
 133 -  /usr/lib{,64}/libvirt/libvirt_leaseshelper Cx -> libvirt_leaseshelper,
 134 -  /usr/libexec/libvirt_leaseshelper Cx -> libvirt_leaseshelper,
 135 -
 136 -  # lxc-net pid and lease files
 137 -  @{run}/lxc/dnsmasq.pid    rw,
 138 -  /var/lib/misc/dnsmasq.*.leases rw,
 139 -
 140 -  # lxd-bridge pid and lease files
 141 -  @{run}/lxd-bridge/dnsmasq.pid   rw,
 142 -  /var/lib/lxd-bridge/dnsmasq.*.leases rw,
 143 -  /var/lib/lxd/networks/*/dnsmasq.* r,
 144 -  /var/lib/lxd/networks/*/dnsmasq.leases rw,
 145 -  /var/lib/lxd/networks/*/dnsmasq.pid rw,
 146 -
 147 -  # NetworkManager integration
 148 -  /var/lib/NetworkManager/dnsmasq-*.leases rw,
 149 +  @{run}/lxc/dnsmasq.pid rw,
 150 +  @{run}/lxd-bridge/dnsmasq.pid rw,
 151    @{run}/nm-dns-dnsmasq.conf r,
 152    @{run}/nm-dnsmasq-*.pid rw,
 153    @{run}/sendsigs.omit.d/*dnsmasq.pid w,
 154 -  @{run}/NetworkManager/dnsmasq.conf r,
 155 -  @{run}/NetworkManager/dnsmasq.pid w,
 156 -  @{run}/NetworkManager/NetworkManager.pid w,
 157 +  owner /dev/tty rw,
 158 +
 159
 160    profile libvirt_leaseshelper {
 161      include <abstractions/base>
 162
 163      /etc/libnl-3/classid r,
 164 -
 165 -    /usr/lib{,64}/libvirt/libvirt_leaseshelper m,
 166      /usr/libexec/libvirt_leaseshelper m,
 167 -
 168 -    owner @{PROC}/@{pid}/net/psched r,
 169 -    owner @{PROC}/@{pid}/status r,
 170 -
 171 +    /usr/lib{,64}/libvirt/libvirt_leaseshelper m,
 172 +    /var/lib/libvirt/dnsmasq/*.leases rw,
 173 +    /var/lib/libvirt/dnsmasq/*.status* rw,
 174 +    @{run}/leaseshelper.pid rwk,
 175      @{sys}/devices/system/cpu/ r,
 176      @{sys}/devices/system/node/ r,
 177      @{sys}/devices/system/node/*/meminfo r,
 178 +    owner @{PROC}/@{pid}/net/psched r,
 179 +    owner @{PROC}/@{pid}/status r,
 180
 181 -    # libvirt lease and status files for dnsmasq
 182 -    /var/lib/libvirt/dnsmasq/*.leases  rw,
 183 -    /var/lib/libvirt/dnsmasq/*.status* rw,
 184 -
 185 -    @{run}/leaseshelper.pid rwk,
 186    }
 187 -
 188 -  # Site-specific additions and overrides. See local/README for details.
 189 -  include if exists <local/usr.sbin.dnsmasq>
 190  }