logo

apparmor.d

Unnamed repository; edit this file 'description' to name the repository. git clone https://hacktivis.me/git/apparmor.d.git

usr.sbin.ntpd (2216B)

    

  1. # ------------------------------------------------------------------
  2. #
  3. #    Copyright (C) 2002-2009 Novell/SUSE
  4. #    Copyright (C) 2010 Canonical Ltd.
  5. #
  6. #    This program is free software; you can redistribute it and/or
  7. #    modify it under the terms of version 2 of the GNU General Public
  8. #    License published by the Free Software Foundation.
  9. #
  10. # ------------------------------------------------------------------
  12. abi <abi/3.0>,
  14. include <tunables/global>
  15. include <tunables/ntpd>
  16. profile ntpd /usr/{bin,sbin}/{,open}ntpd flags=(attach_disconnected) {
  17.   include <abstractions/base>
  18.   include <abstractions/nameservice>
  19.   include <abstractions/openssl>
  20.   include <abstractions/ssl_certs>
  21.   include <abstractions/xad>
  23.   capability dac_override,
  24.   capability ipc_lock,
  25.   capability net_bind_service,
  26.   capability setgid,
  27.   capability setuid,
  28.   capability sys_chroot,
  29.   capability sys_resource,
  30.   capability sys_time,
  31.   capability sys_nice,
  33.   network unspec dgram,
  35.   /drift/ntp.drift rwl,
  36.   /drift/ntp.drift.TEMP rwl,
  37.   /etc/ntp.conf r,
  38.   /etc/ntp/drift* rwl,
  39.   /etc/ntp.keys r,
  40.   /etc/ntp/step-tickers r,
  41.   /etc/ntpd.conf r,
  42.   /etc/ntpd.conf.tmp r,
  44.   /tmp/ntp* rwl,
  45.   /{usr/,usr/local/,}{s,}bin/ r,
  46.   /usr/{bin,sbin}/{,open}ntpd rmix,
  47.   /var/db/ r,
  48.   /var/db/ntpd.drift rwl,
  49.   /var/lib/ntp/drift rwl,
  50.   /var/lib/ntp/drift.TEMP rwl,
  51.   /var/lib/ntp/drift/driftfile rw,
  52.   /var/lib/ntp/drift/driftfile.TEMP rw,
  53.   /var/lib/ntp/drift/ntp.drift rw,
  54.   /var/lib/ntp/drift/ntp.drift.TEMP rw,
  55.   /var/lib/ntp/etc/* r,
  56.   /var/lib/ntp/ntp.drift rw,
  57.   /var/lib/ntp/ntp.drift.TEMP rw,
  58.   /var/lib/ntp@{run}/ntp/ntpd.pid w,
  59.   /var/log/ntp w,
  60.   /var/log/ntp.log w,
  61.   /var/log/ntpstats/clockstats* lrw,
  62.   /var/log/ntpstats/loopstats* lrw,
  63.   /var/log/ntpstats/peerstats* lrw,
  64.   /var/opt/novell/xad/rpc/xadsd rw,
  65.   @{run}/nscd/services r,
  66.   @{run}/ntpd.pid w,
  67.   @{run}/ntp/ntpd.pid w,
  68.   @{run}/ntpd.sock rwl,
  69.   /var/tmp/ntp* rwl,
  70.   @{PROC}/@{pid}/net/if_inet6 r,
  72.   # allow access for when chrooted
  73.   /var/lib/ntp/@{PROC}/@{pid}/net/if_inet6 r,
  74.   /var/lib/ntp/@{PROC}/sys/kernel/ngroups_max r,
  76.   @{NTPD_DEVICE} rw,
  78.   # Site-specific additions and overrides. See local/README for details.
  79.   include if exists <local/usr.sbin.ntpd>
  80. }