applications-19.12.3

2020-03-30 18:37:59 +03:00
parent a4284283b9
commit 9c003a0981
92 changed files with 878 additions and 83 deletions
@@ -0,0 +1,165 @@
+From 9c33b1b4f71c45f9943418ab1d6c8abf1ce8c90f Mon Sep 17 00:00:00 2001
+From: nl 6720 <nl6720@gmail.com>
+Date: Thu, 26 Dec 2019 03:02:57 +0100
+Subject: Support more distributions in the AppArmor profiles
+
+Summary:
+This fixes Akonadi on Arch Linux (and possibly others).
+
+Changes to the AppArmor profiles:
+
+- Allow writing and locking `/run/user/${uid}/akonadi`, the database engine socket is stored there.
+- Add `abstractions/consoles`, needed for console output.
+
+PostgreSql specific:
+- Add bash (it is a common default shell).
+- Support `/usr/bin/*` paths for PostgreSQL binaries.
+- Support `pg_upgrade`.
+
+MySQL specific:
+- Add bash (it is a common default shell).
+- Add `/usr/bin/mysqld` as a path for the MySQL daemon binary.
+- Add `abstractions/openssl`. When using MySQL, both `akonadiserver` and `mysqld` will try to read `/etc/ssl/openssl.cnf`.
+- Add `/etc/my.cnf` and `/etc/my.cnf.d/`, on Arch Linux the `my.cnf` configuration is stored there.
+
+Test Plan: `akonadictl start` on a system with active AppArmor and loaded profiles.
+
+Reviewers: #kde_pim, knauss
+
+Reviewed By: #kde_pim, knauss
+
+Subscribers: arojas, dvratil, knauss, jriddell, kde-pim, #kde_pim
+
+Tags: #kde_pim
+
+Differential Revision: https://phabricator.kde.org/D25964
+---
+ apparmor/mysqld_akonadi        |  8 +++++++-
+ apparmor/postgresql_akonadi    | 24 ++++++++++++++++++++----
+ apparmor/usr.bin.akonadiserver | 11 +++++++++--
+ 3 files changed, 36 insertions(+), 7 deletions(-)
+
+diff --git a/apparmor/mysqld_akonadi b/apparmor/mysqld_akonadi
+index c769d87..224b5b0 100644
+--- a/apparmor/mysqld_akonadi
+++ b/apparmor/mysqld_akonadi
+@@ -4,7 +4,10 @@
+ 
+ profile mysqld_akonadi {
+   #include <abstractions/base>
+  #include <abstractions/bash>
+  #include <abstractions/consoles>
+   #include <abstractions/nameservice>
+  #include <abstractions/openssl>
+   #include <abstractions/user-tmp>
+ 
+   capability setgid,
+@@ -15,7 +18,9 @@ profile mysqld_akonadi {
+ 
+   /etc/mysql/ r,
+   /etc/mysql/** r,
+  /etc/my.cnf{,.d/**} r,
+   @{sys}/devices/system/cpu/ r,
+  /{usr/,}bin/{b,d}ash mrix,
+   /{usr/,}bin/cat mrix,
+   /{usr/,}bin/chmod mrix,
+   /{usr/,}bin/dirname mrix,
+@@ -26,8 +31,9 @@ profile mysqld_akonadi {
+   /usr/bin/mysql_install_db mrix,
+   /usr/bin/mysqladmin mrix,
+   /usr/bin/mysqlcheck mrix,
+-  /usr/sbin/mysqld mrix,
+  /usr/{,s}bin/mysqld mrix,
+   /usr/share/mysql/** r,
+   owner @{xdg_data_home}/akonadi/** rwk,
+   owner @{PROC}/@{pid}/loginuid r,
+  owner /{,var/}run/user/@{uid}/akonadi** rwk,
+ }
+diff --git a/apparmor/postgresql_akonadi b/apparmor/postgresql_akonadi
+index 3992204..e5f7712 100644
+--- a/apparmor/postgresql_akonadi
+++ b/apparmor/postgresql_akonadi
+@@ -4,19 +4,35 @@
+ 
+ profile postgresql_akonadi {
+   #include <abstractions/base>
+  #include <abstractions/bash>
+  #include <abstractions/consoles>
+  #include <abstractions/nameservice>
+   #include <abstractions/user-tmp>
+ 
+   capability setgid,
+   capability setuid,
+ 
+   /etc/passwd r,
+-  /{usr/,}bin/dash mrix,
+  /{usr/,}bin/{b,d}ash mrix,
+   /{usr/,}bin/locale mrix,
+-  /usr/lib/postgresql/*/bin/initdb mrix,
+-  /usr/lib/postgresql/*/bin/pg_ctl mrix,
+-  /usr/lib/postgresql/*/bin/postgres mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/initdb mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_ctl mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/postgres mrix,
+   /usr/share/postgresql/** r,
+   owner /dev/shm/PostgreSQL.* rw,
+   owner @{xdg_data_home}/akonadi/** rwlk,
+   owner @{xdg_data_home}/akonadi/db_data/** l,
+  owner /{,var/}run/user/@{uid}/akonadi** rwk,
+
+  # pg_upgrade
+  /{usr/,usr/lib/postgresql/*/}bin/pg_upgrade mrix,
+  /opt/pgsql*/** mr,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_controldata mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_resetwal mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_dumpall mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_dump mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/vacuumdb mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/psql mrix,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_restore mrix,
+  /{usr/,}bin/cp mrix,
+ }
+diff --git a/apparmor/usr.bin.akonadiserver b/apparmor/usr.bin.akonadiserver
+index 7acaa06..697d315 100644
+--- a/apparmor/usr.bin.akonadiserver
+++ b/apparmor/usr.bin.akonadiserver
+@@ -6,8 +6,10 @@
+ 
+ /usr/bin/akonadiserver {
+   #include <abstractions/base>
+  #include <abstractions/consoles>
+   #include <abstractions/dbus-session-strict>
+   #include <abstractions/nameservice>
+  #include <abstractions/openssl>
+   #include <abstractions/qt5>
+   #include <abstractions/user-tmp>
+ 
+@@ -19,12 +21,15 @@
+   /usr/bin/mysql_install_db PUx -> mysqld_akonadi,
+   /usr/bin/mysqladmin PUx -> mysqld_akonadi,
+   /usr/bin/mysqlcheck PUx -> mysqld_akonadi,
+-  /usr/lib/postgresql/*/bin/initdb PUx -> postgresql_akonadi,
+-  /usr/lib/postgresql/*/bin/pg_ctl PUx -> postgresql_akonadi,
+  /usr/{,s}bin/mysqld PUx -> mysqld_akonadi,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/initdb PUx -> postgresql_akonadi,
+  /{usr/,usr/lib/postgresql/*/,opt/pgsql*/}bin/pg_ctl PUx -> postgresql_akonadi,
+  /{usr/,usr/lib/postgresql/*/}bin/pg_upgrade PUx -> postgresql_akonadi,
+   /usr/sbin/mysqld PUx -> mysqld_akonadi,
+   /usr/share/mime/mime.cache r,
+   /usr/share/mime/packages/ r,
+   /usr/share/mime/types r,
+  /usr/share/qt/translations/* r,
+   @{PROC}/sys/kernel/core_pattern r,
+   @{PROC}/sys/kernel/random/boot_id r,
+   owner @{xdg_config_home}/* r,
+@@ -43,4 +48,6 @@
+   owner @{xdg_data_home}/akonadi/** rwk,
+   owner @{PROC}/@{pid}/loginuid r,
+   owner @{PROC}/@{pid}/mounts r,
+  owner /{,var/}run/user/@{uid}/akonadi** rwk,
+  owner /tmp/#[0-9]* m,
+ }
+-- 
+cgit v1.1
+
+