mirror of
https://github.com/trailofbits/algo.git
synced 2025-07-24 14:33:02 +02:00
9187d8e637
<!--- Provide a general summary of your changes in the Title above --> ## Description Apparmor profile for dnscrypt-proxy didn't work at all ## Motivation and Context Fixes #1155 ## How Has This Been Tested? Deployed to DigitalOcean, checked that the dnscrypt-proxy binary is in enforce mode ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Bug fix (non-breaking change which fixes an issue) ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the **CONTRIBUTING** document. - [x] My code follows the code style of this project. - [x] All new and existing tests passed.
57 lines
1.4 KiB
YAML
57 lines
1.4 KiB
YAML
---
|
|
- name: Add the repository
|
|
apt_repository:
|
|
state: present
|
|
codename: bionic
|
|
repo: ppa:shevchuk/dnscrypt-proxy
|
|
register: result
|
|
until: result is succeeded
|
|
retries: 10
|
|
delay: 3
|
|
|
|
- name: Install dnscrypt-proxy
|
|
apt:
|
|
name: dnscrypt-proxy
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: Configure unattended-upgrades
|
|
copy:
|
|
src: 50-dnscrypt-proxy-unattended-upgrades
|
|
dest: /etc/apt/apt.conf.d/50-dnscrypt-proxy-unattended-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- block:
|
|
- name: Ubuntu | Unbound profile for apparmor configured
|
|
copy:
|
|
src: apparmor.profile.dnscrypt-proxy
|
|
dest: /etc/apparmor.d/usr.bin.dnscrypt-proxy
|
|
owner: root
|
|
group: root
|
|
mode: 0600
|
|
notify: restart dnscrypt-proxy
|
|
|
|
- name: Ubuntu | Enforce the dnscrypt-proxy AppArmor policy
|
|
command: aa-enforce usr.bin.dnscrypt-proxy
|
|
changed_when: false
|
|
tags: apparmor
|
|
when: apparmor_enabled|default(false)|bool == true
|
|
|
|
- name: Ubuntu | Ensure that the dnscrypt-proxy service directory exist
|
|
file:
|
|
path: /etc/systemd/system/dnscrypt-proxy.service.d/
|
|
state: directory
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Ubuntu | Add capabilities to bind ports
|
|
copy:
|
|
dest: /etc/systemd/system/dnscrypt-proxy.service.d/99-capabilities.conf
|
|
content: |
|
|
[Service]
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
notify:
|
|
- restart dnscrypt-proxy
|