Merge lp:~sdeziel/apparmor-profiles/unbound-profile into lp:apparmor-profiles

[Simon Déziel]

This adds a profile for Unbound. It supports chroot'ing (in /var/lib/unbound) as well as privilege downgrade.

[Jamie Strandboge (jdstrand)]

ACK. Thanks!

review: Approve

[Jamie Strandboge (jdstrand)]

Can you comment why this is needed:
  capability dac_override,

I added a note in the profile in the meantime.

[lp:~sdeziel/apparmor-profiles/unbound-profile]

76. By Simon Déziel on 2011-11-30

remove the useless dac_override capability (thanks Jamie for pointing this out)

77. By Simon Déziel on 2011-11-30

remove the useless chow capability

78. By Simon Déziel on 2011-11-30

Unify rules to cover chroot'ed and non-chroot'ed configurations..
Audit/deny write access to unbound_(control|server).key while still
allowing write access to *.key to support the "auto-trust-anchor-file"
mechanism.

79. By Simon Déziel on 2011-11-30

Merged master branch

80. By Simon Déziel on 2011-11-30

The pid creation requires the dac_override and chown capabilities. Thanks Felix for pointing this out.

81. By Simon Déziel on 2011-11-30

Authorize mmap'ing /etc/{passwd,group} as Unbound insists on this. Thanks Felix for pointing this out.

82. By Simon Déziel on 2011-11-30

The root.key handling is not perfect. Ideally, this file should reside in the chroot
jail but that's not possible until LP: #898287 is addressed. For now, lets allow to
write to the file when not chroot'ed (the default is to run without chroot anyways).

83. By Simon Déziel on 2011-12-20

Merged lp:apparmor-profiles

Unmerged revisions

=== added file 'ubuntu/12.04/usr.sbin.unbound'
--- ubuntu/12.04/usr.sbin.unbound	1970-01-01 00:00:00 +0000
+++ ubuntu/12.04/usr.sbin.unbound	2011-11-29 19:47:43 +0000
@@ -0,0 +1,31 @@
+# vim:syntax=apparmor
+#include <tunables/global>
+
+/usr/sbin/unbound {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability chown,
+  capability sys_chroot,
+  capability sys_resource,
+  capability dac_override,
+
+  # for networking
+  owner @{PROC}/[0-9]*/net/if_inet6 r,
+  owner @{PROC}/[0-9]*/net/ipv6_route r,
+
+  /etc/unbound/** r,
+  owner /etc/unbound/*.key rw,
+  audit deny /etc/unbound/unbound_server.key w,
+  audit deny /etc/unbound/unbound_control.key w,
+  /var/lib/unbound/** r,
+  owner /var/lib/unbound/**/*.key rw,
+  /etc/ssl/openssl.cnf r,
+
+  /usr/sbin/unbound mr,
+
+  /{,var/}run/unbound.pid rw,
+}