usr.sbin.nscd needs r/w access to nslcd socket
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
AppArmor |
Fix Released
|
Undecided
|
Unassigned | ||
apparmor (Ubuntu) |
Fix Committed
|
Undecided
|
Unassigned |
Bug Description
I am usinc nscd with nslcd (LDAP lookup daemon) for NSS services via LDAP.
It is typical to configure nslcd to connect to the actual LDAP server, and then set up /etc/ldap.conf (which is what NSS/nscd uses for "ldap" type lookups in /etc/nsswitch.conf) with a server URI of ldapi:/
Unfortunately, the usr.sbin.nscd profile in apparmor-profiles 2.10.95-0ubuntu2 (Xenial) makes no mention of the nslcd socket, which results in NSS LDAP lookups not working when the profile is enforced in this configuration.
This is the new line that is needed:
/{,
tags: | added: aa-policy |
Minor addendum: It's conceivable that the new line should go into <abstractions/ nameservice> rather than just the nscd profile. I do see that the nscd socket is already mentioned there.
I don't know if/why anything else would need access to the nslcd socket, but that may be a valid use case for other folks.