From 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Fri, 20 Mar 2026 19:16:32 +0100 Subject: feat: first fully successful run e2e on straper --- straper/db/public/apparmor/apparmor.d/unix-chkpwd | 35 +++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 straper/db/public/apparmor/apparmor.d/unix-chkpwd (limited to 'straper/db/public/apparmor/apparmor.d/unix-chkpwd') diff --git a/straper/db/public/apparmor/apparmor.d/unix-chkpwd b/straper/db/public/apparmor/apparmor.d/unix-chkpwd new file mode 100644 index 0000000..a338a5f --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/unix-chkpwd @@ -0,0 +1,35 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2019-2021 Mikhail Morfikov +# SPDX-License-Identifier: GPL-2.0-only + +# The apparmor.d project comes with several variables and abstractions +# that are not part of upstream AppArmor yet. Therefore this profile was +# adopted to use abstractions and variables that are available. +# Copyright (C) Christian Boltz 2024 + +abi , + +include + +profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd flags=(complain) { + include + include + + # To write records to the kernel auditing log. + capability audit_write, + + network netlink raw, + + /{,usr/}{,s}bin/unix_chkpwd mr, + + /etc/shadow r, + + # systemd userdb, used in nspawn + /run/host/userdb/*.user r, + /run/host/userdb/*.user-privileged r, + + # file_inherit + owner /dev/tty[0-9]* rw, + + include if exists +} -- cgit v1.3