File: apparmor-profile

package info (click to toggle)
unbound 1.6.0-2~bpo8+1
  • links: PTS, VCS
  • area: main
  • in suites: jessie-backports
  • size: 20,444 kB
  • sloc: ansic: 79,862; sh: 5,040; yacc: 1,900; makefile: 1,315; python: 1,302; perl: 141
file content (45 lines) | stat: -rw-r--r-- 1,049 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# Author: Simon Deziel
# vim:syntax=apparmor
#include <tunables/global>

/usr/sbin/unbound {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/openssl>

  # needlessly chown'ing the PID
  deny capability chown,

  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_chroot,
  capability sys_resource,

  # root trust anchor
  owner /var/lib/unbound/root.key* rw,

  # root hints from dns-data-root
  /usr/share/dns/root.* r,

  # non-chrooted paths
  /etc/unbound/** r,
  owner /etc/unbound/*.key* rw,
  audit deny /etc/unbound/unbound_control.{key,pem} rw,
  audit deny /etc/unbound/unbound_server.key w,

  # chrooted paths
  /var/lib/unbound/** r,
  owner /var/lib/unbound/**/*.key* rw,
  audit deny /var/lib/unbound/**/unbound_control.{key,pem} rw,
  audit deny /var/lib/unbound/**/unbound_server.key w,

  /usr/sbin/unbound mr,

  /{,var/}run/{unbound/,}unbound.pid rw,

  # Unix control socket
  /{,var/}run/unbound.ctl rw,

  #include <local/usr.sbin.unbound>
}