Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
interfaces/builtin: silence ptrace denial for network-manager #3427
Conversation
Some checks were not successful
jdstrand
approved these changes
Jun 2, 2017
Approving since the rule is correct, but please adjust the comment.
| @@ -103,6 +103,10 @@ network packet, | ||
| #include <abstractions/nameservice> | ||
| +# Explicitly deny ptrace. This doesn't influence any NetworkManager | ||
| +# functionality but silences AppArmor denials in the system log. | ||
| +deny ptrace (trace) peer=###PLUG_SECURITY_TAGS###, |
jdstrand
Jun 2, 2017
Contributor
It would be nice if this comment was more specific. Ie:
# Explicitly deny plugging snaps from ptracing the slot to silence noisy
# denials. Neither the NetworkManager service nor nmcli require ptrace
# trace for full functionality.
|
Note, I did recommend this based on the assetion that NM didn't need it, which @morphis states is true. Also, I'll mention we don't typically like to use explicit denies because we can't undo them with later allow rules, but this particular explicit deny is very specific to plugging and slotting apps of this interface, and therefore it shouldn't get in the way of anything else. |
added some commits
Jun 2, 2017
Some checks were not successful
All checks have passed
codecov-io
commented
Jun 6, 2017
Codecov Report
@@ Coverage Diff @@
## master #3427 +/- ##
==========================================
+ Coverage 77.55% 77.56% +<.01%
==========================================
Files 371 371
Lines 25519 25519
==========================================
+ Hits 19792 19793 +1
Misses 3976 3976
+ Partials 1751 1750 -1
Continue to review full report at Codecov.
|
morphis commentedJun 2, 2017
Adding this was recommended by @jdstrand on https://forum.snapcraft.io/t/use-of-nmcli-from-inside-a-snap/822/13 to silence the ptrace denials we still get with the network-manager interface. Adding this explicit denial does not affect the NetworkManager functionality.