wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-08-15 17:23:07 +02:00
Code Issues Projects Releases Wiki Activity

dnscrypt-proxy apparmor fix

Browse source
This commit is contained in:
Jack Ivanov 2018-11-15 15:30:00 +01:00
parent affadd401d
commit 65ceb8092f
2 changed files with 14 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
roles/dns_encryption/files/apparmor.profile.dnscrypt-proxy
View file

@ -1,6 +1,6 @@
#include <tunables/global> #include <tunables/global>
/usr/sbin/dnscrypt-proxy { /usr/bin/dnscrypt-proxy {
#include <abstractions/base> #include <abstractions/base>
#include <abstractions/nameservice> #include <abstractions/nameservice>
#include <abstractions/openssl> #include <abstractions/openssl>
@ -12,12 +12,18 @@
capability setuid, capability setuid,
capability sys_resource, capability sys_resource,
/etc/dnscrypt-proxy.toml r, /etc/dnscrypt-proxy/** r,
/usr/bin/dnscrypt-proxy mr,
/tmp/public-resolvers.md* rw,
/tmp/*.tmp w,
owner /tmp/*.tmp r,
/run/systemd/notify rw,
/lib/x86_64-linux-gnu/ld-*.so mr,
@{PROC}/sys/kernel/hostname r,
@{PROC}/sys/net/core/somaxconn r,
/etc/ld.so.cache r, /etc/ld.so.cache r,
/usr/sbin/dnscrypt-proxy mr,
/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv r,
/usr/local/lib/{@{multiarch}/,}libldns.so* mr, /usr/local/lib/{@{multiarch}/,}libldns.so* mr,
/usr/local/lib/{@{multiarch}/,}libsodium.so* mr, /usr/local/lib/{@{multiarch}/,}libsodium.so* mr,
/run/dnscrypt-proxy.pid rw,
/run/systemd/notify rw,
} }

4
roles/dns_encryption/tasks/ubuntu.yml
View file

@ -27,14 +27,14 @@
- name: Ubuntu | Unbound profile for apparmor configured - name: Ubuntu | Unbound profile for apparmor configured
copy: copy:
src: apparmor.profile.dnscrypt-proxy src: apparmor.profile.dnscrypt-proxy
dest: /etc/apparmor.d/usr.sbin.dnscrypt-proxy dest: /etc/apparmor.d/usr.bin.dnscrypt-proxy
owner: root owner: root
group: root group: root
mode: 0600 mode: 0600
notify: restart dnscrypt-proxy notify: restart dnscrypt-proxy
- name: Ubuntu | Enforce the dnscrypt-proxy AppArmor policy - name: Ubuntu | Enforce the dnscrypt-proxy AppArmor policy
command: aa-enforce usr.sbin.dnscrypt-proxy command: aa-enforce usr.bin.dnscrypt-proxy
changed_when: false changed_when: false
tags: apparmor tags: apparmor
when: apparmor_enabled|default(false)|bool == true when: apparmor_enabled|default(false)|bool == true