cwinfo/yggdrasil-go
5
0
Fork 0
mirror of https://github.com/cwinfo/yggdrasil-go.git synced 2024-11-09 16:20:26 +00:00
Code Releases Activity

apparmor: allow yggdrasil to resolve hostnames (#739)

Browse Source 
The apparmor profile in it's current state won't allow resolving hostnames. We need `<abstractions/nameservice>` because we simply can't just allow `/etc/resolv.conf`. This is because systemd-resolved, resolvconf, and others rely on symbolic links to `/etc/resolv.conf` which would make this extremely complicated.  `<abstractions/nameservice>` deals with this complexity to allow every single one of those packages (systemd-resolved, resolvconf, ... ).

```
  network inet stream,
  network inet dgram,
  network inet6 dgram,
  network inet6 stream,
  network netlink raw,
```
was removed because it's already included in `<abstractions/nameservice>`. Some permissions that are no longer needed in newer yggdrasil versions were also removed.

`owner /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,` was changed to `/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,` because there is no guarantee that yggdrasil will always be run as root. (`owner` makes sure that the process's user and the file have the same owner, in that case, root. This might not always be the case so `owner` was removed)
This commit is contained in:
rany 2020-12-06 22:52:10 +02:00 committed by GitHub
parent b9f35c5530
commit 709ea6976c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
contrib/apparmor/usr.bin.yggdrasil
View File

@ -1,25 +1,17 @@
# Last Modified: Tue Mar 10 16:38:14 2020 # Last Modified: Fri Oct 30 11:33:31 2020
#include <tunables/global> #include <tunables/global>
/usr/bin/yggdrasil { /usr/bin/yggdrasil {
#include <abstractions/base> #include <abstractions/base>
#include <abstractions/nameservice>
capability net_admin, capability net_admin,
capability net_raw, capability net_raw,
network inet stream,
network inet dgram,
network inet6 dgram,
network inet6 stream,
network netlink raw,
/lib/@{multiarch}/ld-*.so mr,
/proc/sys/net/core/somaxconn r,
owner /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/dev/net/tun rw, /dev/net/tun rw,
/proc/sys/net/core/somaxconn r,
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/usr/bin/yggdrasil mr,
/etc/yggdrasil.conf rw, /etc/yggdrasil.conf rw,
/run/yggdrasil.sock rw, /run/yggdrasil.sock rw,
} }