/etc/apparmor.d/sbin.dhcpcanon is in dhcpcanon 0.7.3-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 | # vim:syntax=apparmor
# Last Modified: Fri Jul 17 11:46:19 2009
# Author: Jamie Strandboge <jamie@canonical.com>
# Modified for dhcpcanon by: juga <juga@riseup.net>, 2017.
#include <tunables/global>
/sbin/dhcpcanon flags=(attach_disconnected) {
#include <abstractions/base>
#include <abstractions/nameservice>
#include <abstractions/openssl>
capability net_bind_service,
capability net_raw,
capability sys_module,
capability dac_override,
capability net_admin,
network packet,
network raw,
@{PROC}/[0-9]*/net/ r,
@{PROC}/[0-9]*/net/** r,
/sbin/dhcpcanon mr,
# LP: #1197484 and LP: #1202203 - why is this needed? :(
/bin/bash mr,
/etc/dhcpcanon.conf r,
/etc/dhcp/ r,
/etc/dhcp/** r,
/var/lib/dhcp{,3}/dhcpcanon* lrw,
/{,var/}run/dhcpcanon*.pid lrw,
/{,var/}run/dhcpcanon*.lease* lrw,
# NetworkManager
/{,var/}run/nm*conf r,
/{,var/}run/sendsigs.omit.d/network-manager.dhcpcanon*.pid lrw,
/var/lib/NetworkManager/dhcpcanon*.conf lrw,
/var/lib/NetworkManager/dhcpcanon*.lease* lrw,
signal (receive) peer=/usr/sbin/NetworkManager,
ptrace (readby) peer=/usr/sbin/NetworkManager,
# connman
/{,var/}run/connman/dhcpcanon*.pid lrw,
/{,var/}run/connman/dhcpcanon*.leases lrw,
# synce-hal
/usr/share/synce-hal/dhcpcanon.conf r,
# if there is a custom script, let it run unconfined
/etc/dhcp/dhcpcanon-script Uxr,
# The dhcpcanon-script shell script sources other shell scripts rather than
# executing them, so we can't just use a separate profile for dhcpcanon-script
# with 'Uxr' on the hook scripts. However, for the long-running dhcpcanon3
# daemon to run arbitrary code via /sbin/dhcpcanon-script, it would need to be
# able to subvert dhcpcanon-script or write to the hooks.d directories. As
# such, if the dhcpcanon3 daemon is subverted, this effectively limits it to
# only being able to run the hooks scripts.
/sbin/dhcpcanon-script Uxr,
# Run the ELF executables under their own unrestricted profiles
/usr/lib/NetworkManager/nm-dhcp-client.action Pxrm,
/usr/lib/connman/scripts/dhcpcanon-script Pxrm,
# Support the new executable helper from NetworkManager.
/usr/lib/NetworkManager/nm-dhcp-helper Pxrm,
signal (receive) peer=/usr/lib/NetworkManager/nm-dhcp-helper,
# Site-specific additions and overrides. See local/README for details.
#include <local/sbin.dhcpcanon>
}
/usr/lib/NetworkManager/nm-dhcp-client.action {
#include <abstractions/base>
#include <abstractions/dbus>
/usr/lib/NetworkManager/nm-dhcp-client.action mr,
/var/lib/NetworkManager/*lease r,
signal (receive) peer=/usr/sbin/NetworkManager,
ptrace (readby) peer=/usr/sbin/NetworkManager,
network inet dgram,
network inet6 dgram,
}
/usr/lib/NetworkManager/nm-dhcp-helper {
#include <abstractions/base>
#include <abstractions/dbus>
/usr/lib/NetworkManager/nm-dhcp-helper mr,
/run/NetworkManager/private-dhcp rw,
signal (send) peer=/sbin/dhcpcanon,
/var/lib/NetworkManager/*lease r,
signal (receive) peer=/usr/sbin/NetworkManager,
ptrace (readby) peer=/usr/sbin/NetworkManager,
network inet dgram,
network inet6 dgram,
}
/usr/lib/connman/scripts/dhcpcanon-script {
#include <abstractions/base>
#include <abstractions/dbus>
/usr/lib/connman/scripts/dhcpcanon-script mr,
network inet dgram,
network inet6 dgram,
}
|