Merge lp:~jpds/ubuntu/trusty/vsftpd/apparmor-profile into lp:ubuntu/trusty/vsftpd

[Jonathan Davies]

AppArmor profile for vsftpd.

[lp:~jpds/ubuntu/trusty/vsftpd/apparmor-profile]

45. By Jonathan Davies on 2013-12-19

Use full-path as the other definitions in .install do.

46. By Jonathan Davies on 2013-12-19

Allow vsftpd to do locks on FTP files.

47. By Jonathan Davies on 2013-12-19

Allow access to just network.

[Seth Arnold (seth-arnold)]

Looks good to me; "network," grants an awful lot of networking privileges, but this is better than nothing and unlikely to break any user sites. Thanks!

[lp:~jpds/ubuntu/trusty/vsftpd/apparmor-profile]

48. By Jonathan Davies on 2013-12-19

Use wutmp abstractions.

[Jamie Strandboge (jdstrand)]

Thanks for this!

I think the profile looks ok overall, but I'm quite concerned about the impact on upgrades and new installations. Shipping an enforcing profile by default will break upgrades for sure because the vsftpd/directory may be non-standard. New installations will have the same problem (indeed, there is a debconf entry for this). This is a classic problem for shipping enforcing apparmor policy in highly configuratble and site-dependent server packages. I suggest that you do like we do with rsyslog (which is actually lower risk than vsftpd):
 * disable the profile on new installs
 * disable the profile on upgrades from versions of vsftpd which did not ship an apparmor profile

By doing this, users can opt in to the enforcing apparmor profile (eg, with aa-enforce) and that decision will be preserved on upgrades. The standard way of doing this is doing something like this in preinst:
disable_profile() {
    APP_CONFFILE="/etc/apparmor.d/..."
    APP_DISABLE="/etc/apparmor.d/disable/..."
    # Create a symlink to the yet-to-be-unpacked profile
    if [ ! -e "$APP_CONFFILE" ]; then
        mkdir -p `dirname $APP_DISABLE` 2>/dev/null || true
        ln -sf $APP_CONFFILE $APP_DISABLE
    fi
}

if [ "$1" = "install" ]; then
    # Disable AppArmor profile on install
    disable_profile
elif [ "$1" = "upgrade" ] && dpkg --compare-versions "$2" lt "..." ; then
    # Disable AppArmor on upgrade from earlier than when we first shipped
    # the profile if the user does not already have a profile defined
    disable_profile
fi

review: Needs Fixing

[Jamie Strandboge (jdstrand)]

I also suggest sending this to the apparmor mailing list. AppArmor upstream has a profile for vsftpd in profiles/apparmor/profiles/extras/usr.sbin.vsftpd, but your's seems more complete and up to date. Thanks again :)

Unmerged revisions

48. By Jonathan Davies on 2013-12-19

Use wutmp abstractions.

47. By Jonathan Davies on 2013-12-19

Allow access to just network.

46. By Jonathan Davies on 2013-12-19

Allow vsftpd to do locks on FTP files.

45. By Jonathan Davies on 2013-12-19

Use full-path as the other definitions in .install do.

44. By Jonathan Davies on 2013-12-19

debian/* changes to install AppArmor profile into packaging.

43. By Jonathan Davies on 2013-12-19

Added AppArmor profile for vsftpd.

=== modified file 'debian/changelog'
--- debian/changelog	2013-05-08 14:08:53 +0000
+++ debian/changelog	2013-12-19 23:57:15 +0000
@@ -1,3 +1,9 @@
+vsftpd (3.0.2-1ubuntu3) trusty; urgency=low
+
+  * debian/usr.sbin.vsftpd - Added AppArmor profile.
+
+ -- Jonathan Davies <[e-mail]>  Thu, 19 Dec 2013 05:25:56 +0000
+
 vsftpd (3.0.2-1ubuntu2) saucy; urgency=low
 
   * debian/patches/13-disable-clone-newpid.patch

=== modified file 'debian/rules'
--- debian/rules	2012-12-18 19:59:37 +0000
+++ debian/rules	2013-12-19 23:57:15 +0000
@@ -22,6 +22,9 @@
 	mkdir -p debian/vsftpd/etc/systemd/system
 	cp debian/vsftpd.systemd debian/vsftpd/etc/systemd/system/vsftpd.service
 
+	# AppArmor.
+	dh_apparmor --profile-name=usr.sbin.vsftpd -p vsftpd
+
 override_dh_installinit:
 	dh_installinit --update-rcd-params='start 20 2 3 4 5 . stop 80 1 .'
 

=== added file 'debian/usr.sbin.vsftpd'
--- debian/usr.sbin.vsftpd	1970-01-01 00:00:00 +0000
+++ debian/usr.sbin.vsftpd	2013-12-19 23:57:15 +0000
@@ -0,0 +1,59 @@
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2005 Novell/SUSE
+#    Copyright (C) 2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#include <tunables/global>
+
+/usr/sbin/vsftpd {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/authentication>
+  #include <abstractions/ssl_certs>
+  #include <abstractions/ssl_keys>
+  #include <abstractions/wutmp>
+
+  capability audit_write,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_chroot,
+
+  network,
+
+  /dev/urandom               r,
+
+  /etc/fstab                 r,
+  /etc/ftpusers              r,
+  /etc/hosts.allow           r,
+  /etc/hosts.deny            r,
+  /etc/mtab                  r,
+  /etc/shells                r,
+  /etc/vsftpd.*              r,
+  /etc/vsftpd/*              r,
+
+  /usr/sbin/vsftpd           rmix,
+
+  /var/log/vsftpd.log        wk,
+  /var/log/xferlog           w,
+  /var/run/vsftpd/           r,
+  /var/run/vsftpd/**         r,
+
+  # anon chroots
+  /                          r,
+  owner @{HOME}/             r,
+  owner @{HOME}/**           rwlk,
+
+  # 'ftp' user default home.
+  /srv/ftp/                  r,
+  /srv/ftp/**                rwlk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.vsftpd>
+}

=== modified file 'debian/vsftpd.install'
--- debian/vsftpd.install	2009-07-20 01:32:58 +0000
+++ debian/vsftpd.install	2013-12-19 23:57:15 +0000
@@ -1,3 +1,4 @@
 vsftpd			/usr/sbin
 vsftpd.conf		/etc
 debian/local/ftpusers	/etc
+debian/usr.sbin.vsftpd /etc/apparmor.d/