wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-06-05 22:54:01 +02:00
Code Issues Projects Releases Wiki Activity

Tighten the dnsmasq AppArmor policy #62

Browse source
This commit is contained in:
Evgeniy Ivanov 2016-08-20 16:49:34 +03:00
parent 1a6e3775d1
commit 4b2ae71ffe
1 changed files with 0 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
roles/dns_adblocking/templates/usr.sbin.dnsmasq.j2
View file

@ -1,40 +1,18 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2009 John Dong <jdong@ubuntu.com>
# Copyright (C) 2010 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
@{TFTP_DIR}=/var/tftp /srv/tftpboot
#include <tunables/global>
/usr/sbin/dnsmasq {
#include <abstractions/base>
#include <abstractions/dbus>
#include <abstractions/nameservice>
capability net_bind_service,
capability setgid,
capability setuid,
capability dac_override,
capability net_admin, # for DHCP server
capability net_raw, # for DHCP server ping checks
network inet raw,
signal (receive) peer=/usr/sbin/libvirtd,
ptrace (readby) peer=/usr/sbin/libvirtd,
/etc/dnsmasq.conf r,
/etc/dnsmasq.d/ r,
/etc/dnsmasq.d/* r,
/etc/ethers r,
/etc/NetworkManager/dnsmasq.d/ r,
/etc/NetworkManager/dnsmasq.d/* r,
/etc/block.hosts r,
/usr/sbin/dnsmasq mr,
@ -44,25 +22,4 @@
/{,var/}run/dnsmasq/ r,
/{,var/}run/dnsmasq/* rw,
/var/lib/misc/dnsmasq.leases rw, # Required only for DHCP server usage
# for the read-only TFTP server
@{TFTP_DIR}/ r,
@{TFTP_DIR}/** r,
# libvirt config, lease and hosts files for dnsmasq
/var/lib/libvirt/dnsmasq/ r,
/var/lib/libvirt/dnsmasq/* r,
/var/lib/libvirt/dnsmasq/*.leases rw,
# libvirt pid files for dnsmasq
/{,var/}run/libvirt/network/ r,
/{,var/}run/libvirt/network/*.pid rw,
# NetworkManager integration
/{,var/}run/nm-dns-dnsmasq.conf r,
/{,var/}run/sendsigs.omit.d/*dnsmasq.pid w,
/{,var/}run/NetworkManager/dnsmasq.conf r,
/{,var/}run/NetworkManager/dnsmasq.pid w,
}