[2217] in athena10
Re: [Debathena] #166: Report /etc/krb5.conf apparmor issue upstream
daemon@ATHENA.MIT.EDU (Debathena Trac)
Sun Apr 12 02:11:45 2009
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
From: "Debathena Trac" <debathena@MIT.EDU>
Cc: debathena@mit.edu
To: tabbott@mit.edu, broder@mit.edu, geofft@mit.edu
Date: Sun, 12 Apr 2009 06:11:10 -0000
Reply-To:
Message-ID: <053.9687377e4c473c5250b47c47eb6e73a9@mit.edu>
In-Reply-To: <044.f36c26fbb44e1ab6542f9137458cc23a@mit.edu>
Content-Transfer-Encoding: 8bit
#166: Report /etc/krb5.conf apparmor issue upstream----------------------+-----------------------------------------------------
Reporter: tabbott | Owner:
Type: task | Status: new
Priority: major | Component: --
Resolution: | Keywords:
----------------------+-----------------------------------------------------
Comment(by geofft):
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/132468
and
https://bugs.launchpad.net/ubuntu/+source/openldap2.3/+bug/203898
are two cases where Ubuntu ran into this issue themselves. In the first
case they added /var/run/resolvconf/resolv.conf to the AppArmor profile;
in the second case they switched to hardlinks. On the assumption that
hardlinks are not an option for Debian diversions, what we're doing now
(diverting and transforming the AppArmor profile) appears to be what we
should do.
dtchen, some dude on #ubuntu-devel, indicated that he was interested in
seeing this too, so proposing something to upstream to solve this in
general wouldn't be out of the question.
This is, though, slightly harder than "AppArmor should follow symlinks" --
it is certainly the case that a program protected by AppArmor that needs
to write to a config file in your homedir _shouldn't_ follow symlinks, if
it's able to create that file as a symlink to some arbitrary other place.
Perhaps we can mark /etc/krb5.conf (being in a safe directory) as a file
that is safe to follow symlinks through, with another AppArmor permission.
-- Ticket URL: <http://debathena.mit.edu/trac/ticket/166#comment:2>Debathena <http://debathena.mit.edu/>MIT Debian-Athena Project
