# if there is a custom script, let it run unconfined
/etc/dhcp/dhclient-script Uxr,
# The dhclient-script shell script sources other shell scripts rather than
# executing them, so we can't just use a separate profile for dhclient-script
# with 'Uxr' on the hook scripts. However, for the long-running dhclient3
# daemon to run arbitrary code via /sbin/dhclient-script, it would need to be
# able to subvert dhclient-script or write to the hooks.d directories. As
# such, if the dhclient3 daemon is subverted, this effectively limits it to
# only being able to run the hooks scripts.
/{,usr/}sbin/dhclient-script Uxr,
# Run the ELF executables under their own unrestricted profiles
/usr/lib/NetworkManager/nm-dhcp-client.action Pxrm,
/usr/lib/connman/scripts/dhclient-script Pxrm,
# Support the new executable helper from NetworkManager.
/usr/lib/NetworkManager/nm-dhcp-helper Pxrm,
signal (receive) peer=/usr/lib/NetworkManager/nm-dhcp-helper,
# Site-specific additions and overrides. See local/README for details.
#include <local/sbin.dhclient>
}
apparmor version: 3.0.4-2ubuntu2. 2
the sbin.dhclient config file which isc-dhcp-client deb package provided is as follows:
dpkg -S /etc/apparmor. d/sbin. dhclient d/sbin. dhclient
isc-dhcp-client: /etc/apparmor.
cat sbin.dhclient
# vim:syntax=apparmor
#include <tunables/global>
/{,usr/ }sbin/dhclient flags=( attach_ disconnected) { nameservice> openssl>
#include <abstractions/base>
#include <abstractions/
#include <abstractions/
capability net_bind_service,
capability net_raw,
capability dac_override,
capability net_admin,
network packet,
network raw,
@{PROC} /[0-9]* /net/ r, /[0-9]* /net/** r,
@{PROC}
# dhclient wants to update its threads with functional names /gitlab. com/apparmor/ apparmor/ -/merge_ requests/ 730 /@{pid} /task/[ 0-9]*/comm rw,
# https:/
# see LP: #1918410
owner @{PROC}
# LP: #1926139
@{PROC}/cmdline r,
/{,usr/ }sbin/dhclient mr,
# LP: #1197484 and LP: #1202203 - why is this needed? :(
/{,usr/}bin/bash mr,
/etc/ dhclient. conf r,
/etc/dhcp/ r,
/etc/dhcp/** r,
/var/ lib/dhcp{ ,3}/dhclient* lrw, }run/dhclient* .pid lrw, }run/dhclient* .lease* lrw,
/{,var/
/{,var/
# NetworkManager }run/nm* conf r, }run/sendsigs. omit.d/ network- manager. dhclient* .pid lrw, }run/NetworkMan ager/dhclient* .pid lrw, lib/NetworkMana ger/dhclient* .conf lrw, lib/NetworkMana ger/dhclient* .lease* lrw, sbin/NetworkMan ager, sbin/NetworkMan ager,
/{,var/
/{,var/
/{,var/
/var/
/var/
signal (receive) peer=/usr/
ptrace (readby) peer=/usr/
# connman }run/connman/ dhclient* .pid lrw, }run/connman/ dhclient* .leases lrw,
/{,var/
/{,var/
# synce-hal share/synce- hal/dhclient. conf r,
/usr/
# if there is a custom script, let it run unconfined dhcp/dhclient- script Uxr,
/etc/
# The dhclient-script shell script sources other shell scripts rather than script, it would need to be }sbin/dhclient- script Uxr,
# executing them, so we can't just use a separate profile for dhclient-script
# with 'Uxr' on the hook scripts. However, for the long-running dhclient3
# daemon to run arbitrary code via /sbin/dhclient-
# able to subvert dhclient-script or write to the hooks.d directories. As
# such, if the dhclient3 daemon is subverted, this effectively limits it to
# only being able to run the hooks scripts.
/{,usr/
# Run the ELF executables under their own unrestricted profiles lib/NetworkMana ger/nm- dhcp-client. action Pxrm, lib/connman/ scripts/ dhclient- script Pxrm,
/usr/
/usr/
# Support the new executable helper from NetworkManager. lib/NetworkMana ger/nm- dhcp-helper Pxrm, lib/NetworkMana ger/nm- dhcp-helper,
/usr/
signal (receive) peer=/usr/
# Site-specific additions and overrides. See local/README for details. sbin.dhclient>
#include <local/
}
/usr/lib/ NetworkManager/ nm-dhcp- client. action { lib/NetworkMana ger/nm- dhcp-client. action mr,
#include <abstractions/base>
#include <abstractions/dbus>
/usr/
/var/ lib/NetworkMana ger/*lease r, sbin/NetworkMan ager, sbin/NetworkMan ager,
signal (receive) peer=/usr/
ptrace (readby) peer=/usr/
network inet dgram,
network inet6 dgram,
}
/usr/lib/ NetworkManager/ nm-dhcp- helper { lib/NetworkMana ger/nm- dhcp-helper mr,
#include <abstractions/base>
#include <abstractions/dbus>
/usr/
/run/ NetworkManager/ private- dhcp rw, dhclient,
signal (send) peer=/sbin/
/var/ lib/NetworkMana ger/*lease r, sbin/NetworkMan ager, sbin/NetworkMan ager,
signal (receive) peer=/usr/
ptrace (readby) peer=/usr/
network inet dgram,
network inet6 dgram,
}
/usr/lib/ connman/ scripts/ dhclient- script { lib/connman/ scripts/ dhclient- script mr,
#include <abstractions/base>
#include <abstractions/dbus>
/usr/
network inet dgram,
network inet6 dgram,
}
I am using ec2 ubuntu22 quick boot images,and I haven't made any changes.