logo

apparmor.d

Unnamed repository; edit this file 'description' to name the repository. git clone https://hacktivis.me/git/apparmor.d.git

nameservice (3762B)

    

  1. # ------------------------------------------------------------------
  2. #
  3. #    Copyright (C) 2002-2009 Novell/SUSE
  4. #    Copyright (C) 2009-2011 Canonical Ltd.
  5. #
  6. #    This program is free software; you can redistribute it and/or
  7. #    modify it under the terms of version 2 of the GNU General Public
  8. #    License published by the Free Software Foundation.
  9. #
  10. # ------------------------------------------------------------------
  12.   abi <abi/3.0>,
  14.   # Many programs wish to perform nameservice-like operations, such as
  15.   # looking up users by name or id, groups by name or id, hosts by name
  16.   # or IP, etc. These operations may be performed through files, dns,
  17.   # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
  18.   @{etc_ro}/group          r,
  19.   @{etc_ro}/host.conf      r,
  20.   @{etc_ro}/hosts          r,
  21.   @{etc_ro}/nsswitch.conf  r,
  22.   @{etc_ro}/gai.conf       r,
  23.   @{etc_ro}/passwd         r,
  24.   @{etc_ro}/protocols      r,
  26.   # libtirpc (used for NIS/YP login) needs this
  27.   @{etc_ro}/netconfig r,
  29.   # When using libnss-extrausers, the passwd and group files are merged from
  30.   # an alternate path
  31.   /var/lib/extrausers/group  r,
  32.   /var/lib/extrausers/passwd r,
  34.   # When using sssd, the passwd and group files are stored in an alternate path
  35.   # and the nss plugin also needs to talk to a pipe
  36.   /var/lib/sss/mc/group   r,
  37.   /var/lib/sss/mc/initgroups r,
  38.   /var/lib/sss/mc/passwd  r,
  39.   /var/lib/sss/pipes/nss  rw,
  41.   @{etc_ro}/resolv.conf r,
  42.   # On systems where /etc/resolv.conf is managed programmatically, it is
  43.   # a symlink to @{run}/(whatever program is managing it)/resolv.conf.
  44.   @{run}/{resolvconf,NetworkManager,systemd/resolve,connman,netconfig}/resolv.conf r,
  45.   @{etc_ro}/resolvconf/run/resolv.conf  r,
  46.   @{run}/systemd/resolve/stub-resolv.conf r,
  48.   @{etc_ro}/samba/lmhosts  r,
  49.   @{etc_ro}/services       r,
  50.   # db backend
  51.   /var/lib/misc/*.db      r,
  52.   # The Name Service Cache Daemon can cache lookups, sometimes leading
  53.   # to vast speed increases when working with network-based lookups.
  54.   @{run}/.nscd_socket   rw,
  55.   @{run}/nscd/socket    rw,
  56.   /{var/db,var/cache,var/lib,var/run,run}/nscd/{passwd,group,services,hosts}    r,
  57.   # nscd renames and unlinks files in it's operation that clients will
  58.   # have open
  59.   #@{run}/nscd/db*  rmix,
  61.   # The nss libraries are sometimes used in addition to PAM; make sure
  62.   # they are available
  63.   /{usr/,}lib{,32,64}/libnss_*.so*      mr,
  64.   /{usr/,}lib/@{multiarch}/libnss_*.so*      mr,
  65.   @{etc_ro}/default/nss               r,
  67.   # avahi-daemon is used for mdns4 resolution
  68.   @{run}/avahi-daemon/socket rw,
  70.   # libnl-3-200 via libnss-gw-name
  71.   @{PROC}/@{pid}/net/psched r,
  72.   @{etc_ro}/libnl-*/classid r,
  74.   # nis
  75.   include <abstractions/nis>
  77.   # ldap
  78.   include <abstractions/ldapclient>
  80.   # winbind
  81.   include <abstractions/winbind>
  83.   # likewise
  84.   include <abstractions/likewise>
  86.   # mdnsd
  87.   include <abstractions/mdns>
  89.   # kerberos
  90.   include <abstractions/kerberosclient>
  92.   #libnss-systemd
  93.   include <abstractions/nss-systemd>
  95.   # Also allow lookups for systemd-exec's DynamicUsers via D-Bus
  96.   #   https://www.freedesktop.org/software/systemd/man/systemd.exec.html
  97.   dbus send
  98.        bus=system
  99.        path="/org/freedesktop/systemd1"
  100.        interface="org.freedesktop.systemd1.Manager"
  101.        member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
  102.        peer=(name="org.freedesktop.systemd1"),
  104.   # TCP/UDP network access
  105.   network inet  stream,
  106.   network inet6 stream,
  107.   network inet  dgram,
  108.   network inet6 dgram,
  110.   # TODO: adjust when support finer-grained netlink rules
  111.   # Netlink raw needed for nscd
  112.   network netlink raw,
  114.   # interface details
  115.   @{PROC}/@{pid}/net/route r,
  117.   # Include additions to the abstraction
  118.   include if exists <abstractions/nameservice.d>