AppArmor Profiles

Merge lp://staging/~elmo/apparmor-profiles/bprobe into lp://staging/apparmor-profiles

bprobe
Merge into master

Proposed by James Troup on 2012-09-29

Status:	Needs review
Proposed branch:	lp://staging/~elmo/apparmor-profiles/bprobe
Merge into:	lp://staging/apparmor-profiles
Diff against target:	141 lines (+127/-0) 3 files modified ubuntu/10.04/usr.local.bin.bprobe (+43/-0) ubuntu/12.04/usr.local.bin.bprobe (+42/-0) ubuntu/8.04/usr.local.bin.bprobe (+42/-0)
To merge this branch:	bzr merge lp://staging/~elmo/apparmor-profiles/bprobe
Related bugs:	Link a bug report

Reviewer	Review Type	Date Requested	Status
AppArmor Developers		2012-09-29	Pending
Review via email: mp+127090@code.staging.launchpad.net

Description of the change

An apparmor profile for bprobe, the client side agent of Boundary (http://boundary.com/). bprobe uses libpcap, so the profile looks superficially similar to tcpdump but is more restrictive. I've included versions for 8.04, 10.04 and 12.04, i.e. all current LTSes. All have been tested and are in use in production.

Revision history for this message

Seth Arnold (seth-arnold) wrote on 2012-09-29:

Excellent comments, good descriptions, but I'm concerned/surprised about a /usr/local/bin/ profile -- seems to somewhat violate the idea that /usr/local is for admins.

Thanks!

Revision history for this message

James Troup (elmo) wrote on 2012-09-29:

> Excellent comments, good descriptions, but I'm concerned/surprised
> about a /usr/local/bin/ profile -- seems to somewhat violate the
> idea that /usr/local is for admins.

Ah, sorry, I did mean to mention that. The Debian/Ubuntu packages
that Boundary provide unfortunately install bprobe into
/usr/local/bin. I've suggested to them that they either use /usr/sbin
or /opt, but I don't think fixing it (and/or FHS and Debian/Ubuntu
policy) is high on their list of concerns right now.

If the consensus is that the profile should have a sane name
regardless of the current state of the packages, I'm happy to fix up
my branch.