0

After instaling debian buster apparmor made my life harder. But I want to familiar with it, so i try to tune profiles (i'm very debianish, so I hope that it is temporary, next upgrade should fix most problems I suppose).

One of message looks for me very easy:

Jul 25 13:01:03 zenon kernel: audit: type=1400 audit(1564052463.462:1334): apparmor="DENIED" operation="open" profile="/usr/sbin/postdrop" name="/etc/postfix/dynamicmaps.cf.d/" pid=25297 comm="postdrop" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I thought that I should add /etc/postfix/dynamicmaps.cf.d r, to /etc/apparmor.d/usr.sbin.postdrop

and reload profile ... But still denied. So i thought maybe I should also add /etc/postfix/dynamicmaps.cf.d/* r, to /etc/apparmor.d/usr.sbin.postdrop and reload profile...

But still denied...

Maybe I add it to wrong place???

whole file:

# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2005 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:syntax=apparmor

#include <tunables/global>

/usr/sbin/postdrop {
  #include <abstractions/base>
  #include <abstractions/kerberosclient>
  #include <abstractions/nameservice>
  #include <abstractions/postfix-common>

  # This is needed at least for permissions=paranoid
  capability dac_override,
  capability dac_read_search,

  /etc/postfix r,
  /etc/postfix/main.cf r,
  /etc/postfix/dynamicmaps.cf.d r,
  /etc/postfix/dynamicmaps.cf.d/* r,
  /etc/postfix/postfix-script mixr,
  @{PROC}/net/if_inet6 r,
  /usr/sbin/postdrop rmix,
  /var/spool/postfix r,
  /var/spool/postfix/maildrop r,
  /var/spool/postfix/maildrop/* rwl,
  /var/spool/postfix/pid r,
  /var/spool/postfix/public/pickup w,
}
1

Existing entries in the profile file

/etc/postfix/dynamicmaps.cf.d r,
/etc/postfix/dynamicmaps.cf.d/* r,

don't match the /etc/postfix/dynamicmaps.cf.d/ directory. Only rules that match a trailing slash will match directories. Any of the following should work:

/etc/postfix/dynamicmaps.cf.d/ r
/etc/postfix/** r

See apparmor.d - syntax of security profiles for AppArmor for more details.

You can run AppArmor or a separate profile in complain mode to debug.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.