mirror of
https://github.com/trailofbits/algo.git
synced 2025-06-17 04:23:54 +02:00
9187d8e637
<!--- Provide a general summary of your changes in the Title above --> ## Description Apparmor profile for dnscrypt-proxy didn't work at all ## Motivation and Context Fixes #1155 ## How Has This Been Tested? Deployed to DigitalOcean, checked that the dnscrypt-proxy binary is in enforce mode ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Bug fix (non-breaking change which fixes an issue) ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the **CONTRIBUTING** document. - [x] My code follows the code style of this project. - [x] All new and existing tests passed.
29 lines
691 B
Text
29 lines
691 B
Text
#include <tunables/global>
|
|
|
|
/usr/bin/dnscrypt-proxy {
|
|
#include <abstractions/base>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/openssl>
|
|
|
|
capability chown,
|
|
capability dac_override,
|
|
capability net_bind_service,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_resource,
|
|
|
|
/etc/dnscrypt-proxy/** r,
|
|
/usr/bin/dnscrypt-proxy mr,
|
|
/tmp/public-resolvers.md* rw,
|
|
|
|
/tmp/*.tmp w,
|
|
owner /tmp/*.tmp r,
|
|
|
|
/run/systemd/notify rw,
|
|
/lib/x86_64-linux-gnu/ld-*.so mr,
|
|
@{PROC}/sys/kernel/hostname r,
|
|
@{PROC}/sys/net/core/somaxconn r,
|
|
/etc/ld.so.cache r,
|
|
/usr/local/lib/{@{multiarch}/,}libldns.so* mr,
|
|
/usr/local/lib/{@{multiarch}/,}libsodium.so* mr,
|
|
}
|