From c1f743ab2e4a7046d5500875a47d1f62c8624603 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Mon, 8 Apr 2024 22:37:50 +0200
Subject: Adding upstream version 5.7.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 scripts/kresd.apparmor | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 scripts/kresd.apparmor

(limited to 'scripts/kresd.apparmor')

diff --git a/scripts/kresd.apparmor b/scripts/kresd.apparmor
new file mode 100644
index 0000000..ad6f911
--- /dev/null
+++ b/scripts/kresd.apparmor
@@ -0,0 +1,29 @@
+#include <tunables/global>
+
+/usr/sbin/kresd {
+  #include <abstractions/base>
+  #include <abstractions/p11-kit>
+  #include <abstractions/nameservice>
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  # seems to be needed during start to read /var/lib/knot-resolver
+  # while we still run as root.
+  capability dac_override,
+
+  network tcp,
+  network udp,
+
+  /proc/sys/net/core/somaxconn r,
+  /etc/knot-resolver/* r,
+  /var/lib/knot-resolver/ r,
+  /var/lib/knot-resolver/** rwlk,
+
+  # modules
+  /usr/lib{,64}/kdns_modules/*.lua r,
+  /usr/lib{,64}/kdns_modules/*.so rm,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.kresd>
+}
+
-- 
cgit v1.2.3