aboutsummaryrefslogtreecommitdiff
path: root/straper/db/public/apparmor/apparmor.d/abstractions/nameservice
diff options
context:
space:
mode:
authorLukasz Kasprzak <lukasz.kasprzak@pm.me>2026-04-14 22:32:43 +0200
committerLukasz Kasprzak <lukasz.kasprzak@pm.me>2026-04-14 22:32:43 +0200
commit83f7fe4b8402bab171d110703a1b1115efbc9b28 (patch)
tree19110702c7d740f6bd8ee4f5d2ebcb97442be237 /straper/db/public/apparmor/apparmor.d/abstractions/nameservice
parent51d43498b07dc97d795947964534f0903cd05db5 (diff)
downloadbin-83f7fe4b8402bab171d110703a1b1115efbc9b28.tar.gz
bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.zip
cleaned up many scrits and deleted some that were of no use; renamed a lot
Diffstat (limited to 'straper/db/public/apparmor/apparmor.d/abstractions/nameservice')
-rw-r--r--straper/db/public/apparmor/apparmor.d/abstractions/nameservice106
1 files changed, 0 insertions, 106 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice b/straper/db/public/apparmor/apparmor.d/abstractions/nameservice
deleted file mode 100644
index efba4ac..0000000
--- a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice
+++ /dev/null
@@ -1,106 +0,0 @@
-# ------------------------------------------------------------------
-#
-# Copyright (C) 2002-2009 Novell/SUSE
-# Copyright (C) 2009-2011 Canonical Ltd.
-# Copyright (C) 2011-2024 Christian Boltz
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of version 2 of the GNU General Public
-# License published by the Free Software Foundation.
-#
-# ------------------------------------------------------------------
-
- abi <abi/4.0>,
-
- include <abstractions/nameservice-strict>
-
- # libtirpc (used for NIS/YP login) needs this
- @{etc_ro}/netconfig r,
-
- # When using sssd, the passwd and group files are stored in an alternate path
- # and the nss plugin also needs to talk to a pipe
- /var/lib/sss/mc/group r,
- /var/lib/sss/mc/initgroups r,
- /var/lib/sss/mc/passwd r,
- /var/lib/sss/pipes/nss rw,
-
- # On systems where /etc/resolv.conf is managed programmatically, it is
- # a symlink to @{run}/(whatever program is managing it)/resolv.conf.
- @{run}/{NetworkManager,connman,netconfig}/resolv.conf r,
- @{etc_ro}/resolvconf/run/resolv.conf r,
- /mnt/wsl/resolv.conf r,
-
- @{etc_ro}/samba/lmhosts r,
- # db backend
- /var/lib/misc/*.db r,
- # The Name Service Cache Daemon can cache lookups, sometimes leading
- # to vast speed increases when working with network-based lookups.
- @{run}/.nscd_socket rw,
- @{run}/nscd/socket rw,
- /{var/db,var/cache,var/lib,var/run,run}/nscd/{passwd,group,services,hosts} r,
- # nscd renames and unlinks files in it's operation that clients will
- # have open
- @{run}/nscd/db* mix,
-
- # make libnss-libvirt name resolution work.
- /var/lib/libvirt/dnsmasq/* r,
-
- # make libnss-libvirt name resolution work.
- /var/lib/libvirt/dnsmasq/ r,
- /var/lib/libvirt/dnsmasq/*.status r,
-
- # The nss libraries are sometimes used in addition to PAM; make sure
- # they are available
- /{usr/,}lib{,32,64}/libnss_*.so* mr,
- /{usr/,}lib/@{multiarch}/libnss_*.so* mr,
-
- # avahi-daemon is used for mdns4 resolution
- @{run}/avahi-daemon/socket rw,
-
- # libnl-3-200 via libnss-gw-name
- @{PROC}/@{pid}/net/psched r,
- @{etc_ro}/libnl-*/classid r,
-
- # nis
- include <abstractions/nis>
-
- # ldap
- include <abstractions/ldapclient>
-
- # winbind
- include <abstractions/winbind>
-
- # likewise
- include <abstractions/likewise>
-
- # mdnsd
- include <abstractions/mdns>
-
- # kerberos
- include <abstractions/kerberosclient>
-
- # Also allow lookups for systemd-exec's DynamicUsers via D-Bus
- # https://www.freedesktop.org/software/systemd/man/systemd.exec.html
- dbus send
- bus=system
- path="/org/freedesktop/systemd1"
- interface="org.freedesktop.systemd1.Manager"
- member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
- peer=(name="org.freedesktop.systemd1"),
-
- # TCP/UDP network access
- network inet stream,
- network inet6 stream,
- network inet dgram,
- network inet6 dgram,
-
- # TODO: adjust when support finer-grained netlink rules
- # Netlink raw needed for nscd
- network netlink raw,
-
- # interface details
- @{PROC}/@{pid}/net/ipv6_route r,
- @{PROC}/@{pid}/net/route r,
-
- # Include additions to the abstraction
- include if exists <abstractions/nameservice.d>