network ACLs are not documented in manpages

On Wed, Nov 28, 2007 at 10:24:52AM -0000, Martin Pitt wrote:
> Public bug reported:
>
> Binary package hint: apparmor
>
> See bug 147800 for details, cupsys' apparmor profile causes bluez-cups
> to break because AppArmor does not allow the creation of a bluetooth
> socket:
>
> Nov 28 11:19:18 donald kernel: [ 9030.516116]
> audit(1196245158.605:22): type=1503 operation="socket_create"
> family="bluetooth" sock_type="seqpacket" protocol=0 pid=16752
> profile="/usr/sbin/cupsd"
>
> However, there is no way to configure a profile to create it. There are
> no particular socket ACLs (at least not documented ones), and it still
> happens if I allow access to all files and all capabilities. Thus the
> only working fallback is to allow unconfined execution.

I believe this is a documentation bug (and perhaps a logprof bug), but
adding the statement

  network bluetooth,

should stop this action from being rejected.

--
Steve Beattie
<email address hidden>
http://NxNW.org/~steve/

Sadly the man pages didn't get updated to reflect locking, append, network rules, or change_profile, this is a bug and you can add it to launch pad or reference the bug filed in the forge bugzilla https://bugzilla.novell.com/show_bug.cgi?id=326210.

genprof/logprof should be able to update the profile for this type, or you can manually add any of the following rules.

  network bluetooth seqpacket, # only allow sockets of family bluetooth, type seqpacket
  network bluetooth, # allow any sockets of family bluetooth (as steve mentioned)
  network, # allow all types of networking inet, inet6, bluetooth, ...

Thank you, that helps!

I tested this log event and logprof and genprof will correctly prompt the user to add this privilege in the profile.

The documentation for the network ACLs has been added to the apparmor.d manpage in Intrepid.