Ubuntu
apparmor package

usr.sbin.nscd needs r/w access to nslcd socket

Bug #1575438 reported by Daniel Richard G.
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor
Fix Released
Undecided
Unassigned
apparmor (Ubuntu)
Fix Committed
Undecided
Unassigned

Bug Description

I am usinc nscd with nslcd (LDAP lookup daemon) for NSS services via LDAP.

It is typical to configure nslcd to connect to the actual LDAP server, and then set up /etc/ldap.conf (which is what NSS/nscd uses for "ldap" type lookups in /etc/nsswitch.conf) with a server URI of ldapi:///var/run/nslcd/socket . This way, only nslcd needs to talk with the LDAP server, rather than every application that wants to do getpwent() et al.

Unfortunately, the usr.sbin.nscd profile in apparmor-profiles 2.10.95-0ubuntu2 (Xenial) makes no mention of the nslcd socket, which results in NSS LDAP lookups not working when the profile is enforced in this configuration.

This is the new line that is needed:

    /{,var/}run/nslcd/socket rw,

Tags: aa-policy
Revision history for this message
Daniel Richard G. (skunk) wrote :

Minor addendum: It's conceivable that the new line should go into <abstractions/nameservice> rather than just the nscd profile. I do see that the nscd socket is already mentioned there.

I don't know if/why anything else would need access to the nslcd socket, but that may be a valid use case for other folks.

Christian Boltz (cboltz)
tags: added: aa-policy
Revision history for this message
Seth Arnold (seth-arnold) wrote :

I think you're right that adding the nslcd socket to the abstractions/nameservice probably makes sense; I didn't see anything in the nslcd manpages that suggested nscd was the only way to use the module.

Thanks

Revision history for this message
Daniel Richard G. (skunk) wrote :

An update to the "ldapclient" abstraction has been merged upstream:

https://gitlab.com/apparmor/apparmor/merge_requests/153/diffs?commit_id=ac1d0545f458b11728f2bcb4a7de0567538fa94a

Changed in apparmor:
status: New → Fix Committed
Changed in apparmor (Ubuntu):
status: New → Fix Committed
Revision history for this message
intrigeri (intrigeri) wrote :

Fix released in 3.0.0.

Changed in apparmor:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.