Skip to content
GitLab
  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
  • Sign in / Register
  • apparmor apparmor
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 103
    • Issues 103
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 21
    • Merge requests 21
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • AppArmor
  • apparmorapparmor
  • Merge requests
  • !724

abstractions: Add missing rule in wutmp abstraction

  • Review changes

  • Download
  • Email patches
  • Plain diff
Merged John Johansen requested to merge jjohansen/apparmor:wtmp into master Mar 14, 2021
  • Overview 1
  • Commits 1
  • Pipelines 2
  • Changes 1

Currently the wutmp abstraction has the following rules: /var/log/lastlog rwk, /var/log/wtmp wk, @{run}/utmp rwk,

According to what I see in my apparmor profiles, just a few apps want to interact with the files listed above, especially with the /var/log/wtmp . But when the apps do this, they sometimes want the read access to this file. An example could be the last command. Is there any reason for not having the r in the rule? The second thing is the file /var/log/btmp (which isn't included in the abstracion). Whenever I see an app, which wants to access the /var/log/wtmp file, it also tries to interact with the /var/log/btmp file, for instance lightdm/sddm or su . Most of the time they need just wk permissions, but sometimes apps need also r on this file, an example could be the lastb command, which is just a link to last.

Signed-off-by: John Johansen john.johansen@canonical.com

Assignee
Assign to
Reviewer
Request review from
Time tracking
Source branch: wtmp