Merge lp:~elmo/apparmor-profiles/wpa-supplicant into lp:apparmor-profiles

[James Troup]

A profile for wpa-supplicant. I've only tested WPA connectivity not anything more complex.

[Simon Déziel (sdeziel)]

Hi James,

I know you are targeting 15.04, but I (minimally) tested your profile on Trusty and it works well with only this small diff:

$ diff -Naur /tmp/sbin.wpa_supplicant /etc/apparmor.d/sbin.wpa_supplicant
--- /tmp/sbin.wpa_supplicant 2015-04-24 15:39:06.105592941 -0400
+++ /etc/apparmor.d/sbin.wpa_supplicant 2015-04-24 15:57:48.692200225 -0400
@@ -21,10 +21,18 @@
   /run/dbus/system_bus_socket rw,
   /run/sendsigs.omit.d/wpasupplicant.pid rw,

- @{PROC}/@{pid}/psched r,
+ owner @{PROC}/@{pid}/net/psched r,

   /dev/rfkill r,

+ dbus send
+ bus=system
+ path=/org/freedesktop/DBus,
+
+ dbus bind
+ bus=system
+ name={fi.w1.wpa_supplicant1,fi.epitest.hostap.WPASupplicant},
+
   dbus (send, receive)
        bus=system
        path=/fi/w1/wpa_supplicant1,

I don't know if this would be compatible on 15.04 or not.

[Cameron Norman (cameronnemo)]

Some suggestions inline.

review: Needs Fixing

[intrigeri (intrigeri)]

James: do you plan to work on this merge request again and resubmit it? We've migrated this repository to Git, so very soon this merge request won't be on our radar anymore, hence this friendly heads up :)

Unmerged revisions

143. By James Troup on 2015-04-24

sbin.wpa_supplicant: new profile

=== added file 'ubuntu/15.04/sbin.wpa_supplicant'
--- ubuntu/15.04/sbin.wpa_supplicant	1970-01-01 00:00:00 +0000
+++ ubuntu/15.04/sbin.wpa_supplicant	2015-04-24 19:33:31 +0000
@@ -0,0 +1,39 @@
+# Author: James Troup <[e-mail]>
+
+#include <tunables/global>
+
+/sbin/wpa_supplicant {
+  #include <abstractions/base>
+  #include <abstractions/dbus-strict>
+
+  capability net_admin,
+  capability net_raw,
+  network inet dgram,
+  network inet raw,
+  network packet dgram,
+  network netlink,
+
+  /sbin/wpa_supplicant mr,
+
+  /run/wpa_supplicant/ rw,
+  /run/wpa_supplicant/** rw,
+
+  /run/dbus/system_bus_socket rw,
+  /run/sendsigs.omit.d/wpasupplicant.pid rw,
+ 
+  @{PROC}/@{pid}/psched r,
+
+  /dev/rfkill r,
+
+  dbus (send, receive)
+       bus=system
+       path=/fi/w1/wpa_supplicant1,
+
+  dbus (send, receive)
+       bus=system
+       path=/fi/w1/wpa_supplicant1/**,
+
+  dbus (send,receive)
+       bus=system
+       path=/fi/epitest/hostap/WPASupplicant/**,
+}