Did you need to add more rules to the smbd, nmbd or winbindd profile or one of the abstractions (besides what we added at FrOSCon)? If yes, please tell me so that I can integrate it in the official profiles/abstractions.

I might be able to do AppArmor maintenance updates with the updated profiles (and some other fixes). For this, knowing your schedule (when do you need the updated packages?) would be helpful ;-) (getting upstream maintenance releases usually takes some days, and the openSUSE maintenance process typically needs two weeks)

Also, if you want a review of the added profiles, tell me where I can find them ;-)

cboltz wrote:

Did you need to add more rules to the smbd, nmbd or winbindd profile or one of the abstractions (besides what we added at FrOSCon)? If yes, please tell me so that I can integrate it in the official profiles/abstractions.

I've added two new profiles "sssd" and "sssd_be". They are still "work in progress"....

I might be able to do AppArmor maintenance updates with the updated profiles (and some other fixes). For this, knowing your schedule (when do you need the updated packages?) would be helpful ;-) (getting upstream maintenance releases usually takes some days, and the openSUSE maintenance process typically needs two weeks)

Also, if you want a review of the added profiles, tell me where I can find them ;-)

You find our profiles in github: https://github.com/invisserver/invisAD-setup/tree/master/usr/share/sine/templates/samba_ad/apparmor

It would be nice, if you can have a look on it.

We don't have a fix schedule for this. At the moment we install our profiles out of our invisAD-setup RPM by just copying them from our templatedir to /etc/apparmor.d. If they are ready we can bring them upstream.

Thank you for your support.

Stefan

The changes to existing profiles are (compared to what AppArmor bzr contains):

ntpd¶

+  /var/lib/sss/mc/initgroups r,

(covered by the upstream change in abstractions/nameservice, so you can drop the custom ntpd profile when the updated abstraction gets shipped)

smbd¶

+  /dev/urandom rw,
+  /usr/lib{,32,64}/** mr,
+  /var/lib/sss/mc/initgroups r,

writing to /dev/urandom surprises me - any idea why this could be done?

The /usr/lib{,32,64}/** mr, addition looks too broad to me. Can you please remove it and use more specific rules? (It's easy to merge multiple rules using a wildcard later, but making an overly broad rule more restrictive is close to impossible.)

sss/mc/initgroups is covered by the updated abstractions/nameservice

nmbd¶

matches the latest upstream profile

winbindd¶

+  /usr/lib{,32,64}/** mr,
-  /usr/lib*/samba/gensec/krb*.so mr,

Again, /usr/lib{,32,64}/** mr, looks too broad. Can you please remove it and use more specific rules? (Re-adding the deleted gensec/krb*.so rule might save you some log events ;-)

added profiles¶

I only had a quick look at the new profiles, so please take the following more as impressions, not as a full review:

sssd_be¶

/usr/lib{,32,64}/** mr,

too broad, see above

samba_dnsupdate¶

 /usr/lib{,32,64}/python{2.[4-7],3.[0-5]}/**.{pyc,so} mrw,

I'd recommend to remove this rule. mr is covered by abstractions/python, and samba_dnsupdate shouldn't be allowed to write those files. (Better open a bugreport about the *.pyc write attemps, it generally points to missing python cache files in the package.)

samba_kcc¶

/usr/lib{,32,64}/python{2.[4-7],3.[0-5]}/**.{pyc,so} mrw,
/tmp/* w,
/var/tmp/* w,

For the python files, see above.

For /tmp/ and /var/tmp/, two notes:

• if there is a filename pattern (for example /tmp/samba_kcc_*), then use it instead of just *
• rules for world-writeable directories should have the owner conditional whenever possible -> owner /tmp/* w,

sssd¶

/usr/lib/sssd/sssd_be px,
/usr/lib{,32,64}/** mr,

Do you really need to preserve environment variables in this exec? Otherwise please use Px.

Also, we have the overly broad /usr/lib{,32,64}/** mr, rule again.

Hi Christian,

thank's a lot for your input. I try to implement your suggestions. Apparmor is very new for me, but your objections sounds reasonable. I let you know if i've further questions.

Stefan

Hi Christian,

I have just renewed our apparmor Profiles. You may have a look at them.

Stefan