Merge ~ahasenack/ubuntu/+source/openldap:trusty-slapd-gssapi-apparmor-1783183 into ubuntu/+source/openldap:ubuntu/trusty-devel

[Andreas Hasenack]

Add two rules to the slapd apparmor profile to allow for ldap replication using gssapi/kerberos authentication via the default_client_keytab_name feature present in the MIT kerberos package since v1.11, which for Ubuntu means since Trusty.

Testing this setup is complicated, so I wrote scripts to help and configure each of the services involved in this: the kerberos server (KDC), openldap provider, and openldap consumer. The instructions are in the linked bug.

This can't land anywhere until ubnutu-DD is open, but reviews can be done already in preparation for that. As soon as DD opens, I'll make an MP for it as well.

I want to push this to Debian too, but I'd like reviews here first before doing that. Since it's not a quilt patch, there is no need to update a DEP3 header. But I'll update our changelog to close the upcoming debian bug when I have that.

The security team's review is in the cosmic mp at https://code.launchpad.net/~ahasenack/ubuntu/+source/openldap/+git/openldap/+merge/357712

Bileto ticket and PPA: https://bileto.ubuntu.com/#/ticket/3490

[Christian Ehrhardt  (paelzer)]

I did only test cosmic, but the changes are small and ok to me.
There is next to no risk that it would not fix it here and in addition I assume you have done the tests on all releases already when you wrote the scripts.

Packaging review +1

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, tagged and uploaded.

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
index eeb68ad..69b4174 100644
--- a/debian/apparmor-profile
+++ b/debian/apparmor-profile
@@ -30,6 +30,8 @@
   # kerberos/gssapi
   /dev/tty rw,
   /etc/krb5.keytab kr,
+  /etc/krb5/user/*/client.keytab kr,
+  owner /tmp/krb5cc_* rwk,
   /var/tmp/ rw,
   /var/tmp/** rw,
 
diff --git a/debian/changelog b/debian/changelog
index 7fbd880..a97e7f3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openldap (2.4.31-1+nmu2ubuntu8.5) trusty; urgency=medium
+
+  * d/apparmor-profile: update apparmor profile to allow reading of
+    files needed when slapd is behaving as a kerberos/gssapi client
+    and acquiring its own ticket. (LP: #1783183)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 22 Oct 2018 09:49:38 -0300
+
 openldap (2.4.31-1+nmu2ubuntu8.4) trusty-security; urgency=medium
 
   * SECURITY UPDATE: denial of service via search with page size of 0