Current Dir: /snap/core22/2955/etc/apparmor.d/abstractions/
[DIR] apparmor_api [ delete | rename ]
[DIR] ubuntu-browsers.d [ delete | rename ]
[FILE] apache2-common [ edit | delete | rename ]
[FILE] aspell [ edit | delete | rename ]
[FILE] audio [ edit | delete | rename ]
[FILE] authentication [ edit | delete | rename ]
[FILE] base [ edit | delete | rename ]
[FILE] bash [ edit | delete | rename ]
[FILE] consoles [ edit | delete | rename ]
[FILE] crypto [ edit | delete | rename ]
[FILE] cups-client [ edit | delete | rename ]
[FILE] dbus [ edit | delete | rename ]
[FILE] dbus-accessibility [ edit | delete | rename ]
[FILE] dbus-accessibility-strict [ edit | delete | rename ]
[FILE] dbus-network-manager-strict [ edit | delete | rename ]
[FILE] dbus-session [ edit | delete | rename ]
[FILE] dbus-session-strict [ edit | delete | rename ]
[FILE] dbus-strict [ edit | delete | rename ]
[FILE] dconf [ edit | delete | rename ]
[FILE] dovecot-common [ edit | delete | rename ]
[FILE] dri-common [ edit | delete | rename ]
[FILE] dri-enumerate [ edit | delete | rename ]
[FILE] enchant [ edit | delete | rename ]
[FILE] exo-open [ edit | delete | rename ]
[FILE] fcitx [ edit | delete | rename ]
[FILE] fcitx-strict [ edit | delete | rename ]
[FILE] fonts [ edit | delete | rename ]
[FILE] freedesktop.org [ edit | delete | rename ]
[FILE] gio-open [ edit | delete | rename ]
[FILE] gnome [ edit | delete | rename ]
[FILE] gnupg [ edit | delete | rename ]
[FILE] gtk [ edit | delete | rename ]
[FILE] gvfs-open [ edit | delete | rename ]
[FILE] hosts_access [ edit | delete | rename ]
[FILE] ibus [ edit | delete | rename ]
[FILE] kde [ edit | delete | rename ]
[FILE] kde-globals-write [ edit | delete | rename ]
[FILE] kde-icon-cache-write [ edit | delete | rename ]
[FILE] kde-language-write [ edit | delete | rename ]
[FILE] kde-open5 [ edit | delete | rename ]
[FILE] kerberosclient [ edit | delete | rename ]
[FILE] ldapclient [ edit | delete | rename ]
[FILE] libpam-systemd [ edit | delete | rename ]
[FILE] likewise [ edit | delete | rename ]
[FILE] mdns [ edit | delete | rename ]
[FILE] mesa [ edit | delete | rename ]
[FILE] mir [ edit | delete | rename ]
[FILE] mozc [ edit | delete | rename ]
[FILE] mysql [ edit | delete | rename ]
[FILE] nameservice [ edit | delete | rename ]
[FILE] nis [ edit | delete | rename ]
[FILE] nss-systemd [ edit | delete | rename ]
[FILE] nvidia [ edit | delete | rename ]
[FILE] opencl [ edit | delete | rename ]
[FILE] opencl-common [ edit | delete | rename ]
[FILE] opencl-intel [ edit | delete | rename ]
[FILE] opencl-mesa [ edit | delete | rename ]
[FILE] opencl-nvidia [ edit | delete | rename ]
[FILE] opencl-pocl [ edit | delete | rename ]
[FILE] openssl [ edit | delete | rename ]
[FILE] orbit2 [ edit | delete | rename ]
[FILE] p11-kit [ edit | delete | rename ]
[FILE] perl [ edit | delete | rename ]
[FILE] php [ edit | delete | rename ]
[FILE] php-worker [ edit | delete | rename ]
[FILE] php5 [ edit | delete | rename ]
[FILE] postfix-common [ edit | delete | rename ]
[FILE] private-files [ edit | delete | rename ]
[FILE] private-files-strict [ edit | delete | rename ]
[FILE] python [ edit | delete | rename ]
[FILE] qt5 [ edit | delete | rename ]
[FILE] qt5-compose-cache-write [ edit | delete | rename ]
[FILE] qt5-settings-write [ edit | delete | rename ]
[FILE] recent-documents-write [ edit | delete | rename ]
[FILE] ruby [ edit | delete | rename ]
[FILE] samba [ edit | delete | rename ]
[FILE] smbpass [ edit | delete | rename ]
[FILE] snap_browsers [ edit | delete | rename ]
[FILE] ssl_certs [ edit | delete | rename ]
[FILE] ssl_keys [ edit | delete | rename ]
[FILE] svn-repositories [ edit | delete | rename ]
[FILE] ubuntu-bittorrent-clients [ edit | delete | rename ]
[FILE] ubuntu-browsers [ edit | delete | rename ]
[FILE] ubuntu-console-browsers [ edit | delete | rename ]
[FILE] ubuntu-console-email [ edit | delete | rename ]
[FILE] ubuntu-email [ edit | delete | rename ]
[FILE] ubuntu-feed-readers [ edit | delete | rename ]
[FILE] ubuntu-gnome-terminal [ edit | delete | rename ]
[FILE] ubuntu-helpers [ edit | delete | rename ]
[FILE] ubuntu-konsole [ edit | delete | rename ]
[FILE] ubuntu-media-players [ edit | delete | rename ]
[FILE] ubuntu-unity7-base [ edit | delete | rename ]
[FILE] ubuntu-unity7-launcher [ edit | delete | rename ]
[FILE] ubuntu-unity7-messaging [ edit | delete | rename ]
[FILE] ubuntu-xterm [ edit | delete | rename ]
[FILE] user-download [ edit | delete | rename ]
[FILE] user-mail [ edit | delete | rename ]
[FILE] user-manpages [ edit | delete | rename ]
[FILE] user-tmp [ edit | delete | rename ]
[FILE] user-write [ edit | delete | rename ]
[FILE] video [ edit | delete | rename ]
[FILE] vulkan [ edit | delete | rename ]
[FILE] wayland [ edit | delete | rename ]
[FILE] web-data [ edit | delete | rename ]
[FILE] winbind [ edit | delete | rename ]
[FILE] wutmp [ edit | delete | rename ]
[FILE] X [ edit | delete | rename ]
[FILE] xad [ edit | delete | rename ]
[FILE] xdg-desktop [ edit | delete | rename ]
[FILE] xdg-open [ edit | delete | rename ]
Viewing: /snap/core22/2955/etc/apparmor.d/abstractions/nameservice
# ------------------------------------------------------------------
#
# Copyright (C) 2002-2009 Novell/SUSE
# Copyright (C) 2009-2011 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
abi <abi/3.0>,
# Many programs wish to perform nameservice-like operations, such as
# looking up users by name or id, groups by name or id, hosts by name
# or IP, etc. These operations may be performed through files, dns,
# NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
@{etc_ro}/group r,
@{etc_ro}/host.conf r,
@{etc_ro}/hosts r,
@{etc_ro}/nsswitch.conf r,
@{etc_ro}/gai.conf r,
@{etc_ro}/passwd r,
@{etc_ro}/protocols r,
# libtirpc (used for NIS/YP login) needs this
@{etc_ro}/netconfig r,
# When using libnss-extrausers, the passwd and group files are merged from
# an alternate path
/var/lib/extrausers/group r,
/var/lib/extrausers/passwd r,
# When using sssd, the passwd and group files are stored in an alternate path
# and the nss plugin also needs to talk to a pipe
/var/lib/sss/mc/group r,
/var/lib/sss/mc/initgroups r,
/var/lib/sss/mc/passwd r,
/var/lib/sss/pipes/nss rw,
@{etc_ro}/resolv.conf r,
# On systems where /etc/resolv.conf is managed programmatically, it is
# a symlink to @{run}/(whatever program is managing it)/resolv.conf.
@{run}/{resolvconf,NetworkManager,systemd/resolve,connman,netconfig}/resolv.conf r,
@{etc_ro}/resolvconf/run/resolv.conf r,
@{run}/systemd/resolve/stub-resolv.conf r,
@{etc_ro}/samba/lmhosts r,
@{etc_ro}/services r,
# db backend
/var/lib/misc/*.db r,
# The Name Service Cache Daemon can cache lookups, sometimes leading
# to vast speed increases when working with network-based lookups.
@{run}/.nscd_socket rw,
@{run}/nscd/socket rw,
/{var/db,var/cache,var/lib,var/run,run}/nscd/{passwd,group,services,hosts} r,
# nscd renames and unlinks files in it's operation that clients will
# have open
@{run}/nscd/db* rmix,
# The nss libraries are sometimes used in addition to PAM; make sure
# they are available
/{usr/,}lib{,32,64}/libnss_*.so* mr,
/{usr/,}lib/@{multiarch}/libnss_*.so* mr,
@{etc_ro}/default/nss r,
# avahi-daemon is used for mdns4 resolution
@{run}/avahi-daemon/socket rw,
# libnl-3-200 via libnss-gw-name
@{PROC}/@{pid}/net/psched r,
@{etc_ro}/libnl-*/classid r,
# nis
include <abstractions/nis>
# ldap
include <abstractions/ldapclient>
# winbind
include <abstractions/winbind>
# likewise
include <abstractions/likewise>
# mdnsd
include <abstractions/mdns>
# kerberos
include <abstractions/kerberosclient>
#libnss-systemd
include <abstractions/nss-systemd>
# Also allow lookups for systemd-exec's DynamicUsers via D-Bus
# https://www.freedesktop.org/software/systemd/man/systemd.exec.html
dbus send
bus=system
path="/org/freedesktop/systemd1"
interface="org.freedesktop.systemd1.Manager"
member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
peer=(name="org.freedesktop.systemd1"),
# resolve
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
# https://www.freedesktop.org/wiki/Software/systemd/resolved/
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
# https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
#include <abstractions/dbus-strict>
dbus send
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="Resolve{Address,Hostname,Record,Service}"
peer=(name="org.freedesktop.resolve1"),
# TCP/UDP network access
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
# TODO: adjust when support finer-grained netlink rules
# Netlink raw needed for nscd
network netlink raw,
# interface details
@{PROC}/@{pid}/net/route r,
# Include additions to the abstraction
include if exists <abstractions/nameservice.d>