finalize a chrony apparmor profile and enable it by default

Bug #1744662 reported by Christian Ehrhardt  on 2018-01-22
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
chrony (Debian)
Fix Released
Unknown
chrony (Ubuntu)
Undecided
Jamie Strandboge

Bug Description

Hi,
there currently is no chrony apparmor profile so please add one.
This could be based on the ntp profile minus all the special HW it needed to access (which chrony only does through gpsd).

It might need a few extra rules for GPSD shared memory access.

1. create initial template bases on ntp
2. stip ntpd only rules
3. study gpsd usage, add rules
4. run tests for common cases if we hit false denies
5. add to the package as default enabled

Jamie Strandboge (jdstrand) wrote :

This is now done in https://launchpad.net/ubuntu/+source/chrony/3.2-1ubuntu1 (sorry, I didn't realize this bug existed).

Here is the upstream submission: https://gitlab.com/apparmor/apparmor-profiles/merge_requests/10

Here is the Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888038

Changed in chrony (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
status: New → Fix Committed
tags: added: apparmor
Changed in chrony (Debian):
status: Unknown → New

I like the solution for ipc_owner with a comment and the reference.
That is the best safe&working tradeoff for this case I can think of.
Thanks Jamie!

Changed in chrony (Debian):
status: New → Fix Committed
Changed in chrony (Debian):
status: Fix Committed → Fix Released
Changed in chrony (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.