Merge lp:~debfx/apparmor-profiles/master into lp:apparmor-profiles

[Felix Geyer]

Add 3 new profiles: apt-cacher-ng, ejabberd and murmurd (mumble-server).

[lp:~debfx/apparmor-profiles/master]

73. By Jamie Strandboge on 2011-10-13

copy over 11.10 Ubuntu profiles to 12.04

74. By Steve Beattie on 2011-11-29

Merge from Simon Déziel

[Simon Déziel (sdeziel)]

@Felix, I have tested your ejabberd profile on a Lucid and I am pleased with it. No problem to report in the last 2 days after some inter-op tests. Thanks for sharing this.

P.S.: I just wanted to give some feedback after testing but let me know if I should avoid commenting on merge requests.

[Jamie Strandboge (jdstrand)]

Thanks for the submission! (sorry for the delay)

ACK to add to the repository, though I would prefer to see this in a child profile instead of PUx:
  /usr/bin/lsb_release PUx,

review: Approve

[lp:~debfx/apparmor-profiles/master]

75. By Jamie Strandboge on 2011-11-29

merge from Felix Geyer
updated usr.sbin.murmurd with comment on lsb_release

Acked-by: Jamie Strandboge <email address hidden>

[Steve Beattie (sbeattie)]

Simon, comments from testers on merge requests are very much welcome. Thanks!

=== added file 'ubuntu/11.10/usr.sbin.apt-cacher-ng'
--- ubuntu/11.10/usr.sbin.apt-cacher-ng	1970-01-01 00:00:00 +0000
+++ ubuntu/11.10/usr.sbin.apt-cacher-ng	2011-10-06 21:30:35 +0000
@@ -0,0 +1,20 @@
+# Author: Felix Geyer <[e-mail]>
+
+#include <tunables/global>
+
+/usr/sbin/apt-cacher-ng {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+
+  /etc/apt-cacher-ng/ r,
+  /etc/apt-cacher-ng/** r,
+  /{,var/}run/apt-cacher-ng/* rw,
+  /var/cache/apt-cacher-ng/ r,
+  /var/cache/apt-cacher-ng/** rw,
+  /var/log/apt-cacher-ng/ r,
+  /var/log/apt-cacher-ng/* rw,
+
+  /bin/dash ixr,
+  /bin/ed ixr,
+}

=== added file 'ubuntu/11.10/usr.sbin.ejabberd'
--- ubuntu/11.10/usr.sbin.ejabberd	1970-01-01 00:00:00 +0000
+++ ubuntu/11.10/usr.sbin.ejabberd	2011-10-06 21:30:35 +0000
@@ -0,0 +1,33 @@
+# Author: Felix Geyer <[e-mail]>
+
+#include <tunables/global>
+
+/usr/sbin/ejabberd {
+  #include <abstractions/base>
+  #include <abstractions/user-tmp>
+  #include <abstractions/nameservice>
+  #include <abstractions/ssl_certs>
+
+  /etc/default/ejabberd r,
+  /etc/ejabberd/* r,
+  /usr/sbin/ejabberd r,
+  /var/log/ejabberd/* rw,
+  /{,var/}run/ejabberd/ejabberd.pid rw,
+  /var/lib/ejabberd/ r,
+  /var/lib/ejabberd/* rw,
+
+  /sys/devices/system/cpu/ r,
+  /sys/devices/system/node/ r,
+  /sys/devices/system/node/node*/ r,
+  /sys/devices/system/cpu/cpu*/topology/physical_package_id r,
+  /sys/devices/system/cpu/cpu*/topology/core_id r,
+
+  /usr/lib/erlang/lib/**/*.so mr,
+  /usr/lib/ejabberd/**/*.so mr,
+
+  /usr/lib/erlang/bin/erl ixr,
+  /usr/lib/erlang/erts-*/bin/* ixr,
+
+  /bin/dash ixr,
+  /bin/sed ixr,
+}

=== added file 'ubuntu/11.10/usr.sbin.murmurd'
--- ubuntu/11.10/usr.sbin.murmurd	1970-01-01 00:00:00 +0000
+++ ubuntu/11.10/usr.sbin.murmurd	2011-10-06 21:30:35 +0000
@@ -0,0 +1,26 @@
+# Author: Felix Geyer <[e-mail]>
+
+#include <tunables/global>
+
+/usr/sbin/murmurd {
+  #include <abstractions/base>
+  #include <abstractions/user-tmp>
+  #include <abstractions/nameservice>
+  #include <abstractions/ssl_certs>
+
+  # required for MURMUR_USE_CAPABILITIES=1
+  capability setgid,
+  capability setuid,
+  capability sys_resource,
+
+  /etc/xdg/Trolltech.conf r,
+  deny /etc/xdg/Trolltech.conf k,
+
+  /usr/bin/lsb_release PUx,
+
+  /etc/mumble-server.ini rk,
+  /var/lib/mumble-server/ r,
+  /var/lib/mumble-server/** rwk,
+  /{,var/}run/mumble-server/mumble-server.pid rw,
+  /var/log/mumble-server/* rw,
+}