[PR PATCH] apparmor: fix dhcpcd profile for dhcpcd version 9

[PR PATCH] apparmor: fix dhcpcd profile for dhcpcd version 9

[the-antz]

[-- Attachment #1: Type: text/plain, Size: 577 bytes --]

There is a new pull request by the-antz against master on the void-packages repository

https://github.com/the-antz/void-packages apparmor
https://github.com/void-linux/void-packages/pull/20752

apparmor: fix dhcpcd profile for dhcpcd version 9
Some filename changes introduced by dhcpcd 9 seem unintended, like using
```
/run/pid
/run/sock
/run/unpriv.sock
```
instead of
```
/run/dhcpcd{-*,}.pid
/run/dhcpcd.sock
/run/dhcpcd.unpriv.sock
```
but the profile works for now.

A patch file from https://github.com/void-linux/void-packages/pull/20752.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-apparmor-20752.patch --]
[-- Type: text/x-diff, Size: 1911 bytes --]

From cbf8d09b8cc93c608e50f9fd4d2bea0b5de7a0f8 Mon Sep 17 00:00:00 2001
From: Antz <antzz@protonmail.ch>
Date: Wed, 8 Apr 2020 12:40:03 +0200
Subject: [PATCH] apparmor: fix dhcpcd profile for dhcpcd version 9

---
 srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd | 15 ++++++++++++---
 srcpkgs/apparmor/template                      |  2 +-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd b/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
index 65c3970ab15..30f5b712e75 100644
--- a/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
+++ b/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
@@ -7,9 +7,15 @@ profile dhcpcd /{usr/,}bin/dhcpcd {
   #include <abstractions/nameservice>
 
   capability chown,
+  capability fowner,
+  capability fsetid,
+  capability kill,
   capability net_admin,
   capability net_raw,
+  capability setuid,
+  capability setgid,
   capability sys_admin,
+  capability sys_chroot,
 
   network packet dgram,
   network inet raw,
@@ -26,9 +32,12 @@ profile dhcpcd /{usr/,}bin/dhcpcd {
   /proc/sys/net/ipv{4,6}/neigh/*/retrans_time_ms w,
   /proc/sys/net/ipv{4,6}/neigh/*/base_reachable_time_ms w,
 
-  /{var/,}run/dhcpcd{-*,}.pid rwk,
-  /{var/,}run/dhcpcd.sock rw,
-  /{var/,}run/dhcpcd.unpriv.sock rw,
+  #/{var/,}run/dhcpcd{-*,}.pid rwk,
+  #/{var/,}run/dhcpcd.sock rw,
+  #/{var/,}run/dhcpcd.unpriv.sock rw,
+  /{var/,}run/pid rwk,
+  /{var/,}run/sock w,
+  /{var/,}run/unpriv.sock w,
   /{var/,}run/udev/data/* r,
 
   /sys/devices/**/net/*/uevent r,
diff --git a/srcpkgs/apparmor/template b/srcpkgs/apparmor/template
index a0e04bf6a61..cd7073fdcfb 100644
--- a/srcpkgs/apparmor/template
+++ b/srcpkgs/apparmor/template
@@ -1,7 +1,7 @@
 # Template file for 'apparmor'
 pkgname=apparmor
 version=2.13.4
-revision=1
+revision=2
 wrksrc="${pkgname}-v${version}"
 build_wrksrc=libraries/libapparmor
 build_style=gnu-configure

Re: [PR PATCH] [Updated] [NOMERGE] apparmor: fix dhcpcd profile for dhcpcd version 9

[the-antz]

[-- Attachment #1: Type: text/plain, Size: 592 bytes --]

There is an updated pull request by the-antz against master on the void-packages repository

https://github.com/the-antz/void-packages apparmor
https://github.com/void-linux/void-packages/pull/20752

[NOMERGE] apparmor: fix dhcpcd profile for dhcpcd version 9
Some filename changes introduced by dhcpcd 9 seem unintended, like using
```
/run/pid
/run/sock
/run/unpriv.sock
```
instead of
```
/run/dhcpcd{-*,}.pid
/run/dhcpcd.sock
/run/dhcpcd.unpriv.sock
```
but the profile works for now.

A patch file from https://github.com/void-linux/void-packages/pull/20752.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-apparmor-20752.patch --]
[-- Type: text/x-diff, Size: 1820 bytes --]

From caa2705874ec9b9db77c73fd5b90fd568d06afcd Mon Sep 17 00:00:00 2001
From: Antz <antzz@protonmail.ch>
Date: Wed, 8 Apr 2020 12:40:03 +0200
Subject: [PATCH] apparmor: fix dhcpcd profile for dhcpcd version 9

---
 srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd | 12 +++++++++---
 srcpkgs/apparmor/template                      |  2 +-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd b/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
index 65c3970ab15..0eb9a84f093 100644
--- a/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
+++ b/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
@@ -7,9 +7,15 @@ profile dhcpcd /{usr/,}bin/dhcpcd {
   #include <abstractions/nameservice>
 
   capability chown,
+  capability fowner,
+  capability fsetid,
+  capability kill,
   capability net_admin,
   capability net_raw,
+  capability setuid,
+  capability setgid,
   capability sys_admin,
+  capability sys_chroot,
 
   network packet dgram,
   network inet raw,
@@ -26,9 +32,9 @@ profile dhcpcd /{usr/,}bin/dhcpcd {
   /proc/sys/net/ipv{4,6}/neigh/*/retrans_time_ms w,
   /proc/sys/net/ipv{4,6}/neigh/*/base_reachable_time_ms w,
 
-  /{var/,}run/dhcpcd{-*,}.pid rwk,
-  /{var/,}run/dhcpcd.sock rw,
-  /{var/,}run/dhcpcd.unpriv.sock rw,
+  /{var/,}run/dhcpcd/pid rwk,
+  /{var/,}run/dhcpcd/sock w,
+  /{var/,}run/dhcpcd/unpriv.sock w,
   /{var/,}run/udev/data/* r,
 
   /sys/devices/**/net/*/uevent r,
diff --git a/srcpkgs/apparmor/template b/srcpkgs/apparmor/template
index a0e04bf6a61..cd7073fdcfb 100644
--- a/srcpkgs/apparmor/template
+++ b/srcpkgs/apparmor/template
@@ -1,7 +1,7 @@
 # Template file for 'apparmor'
 pkgname=apparmor
 version=2.13.4
-revision=1
+revision=2
 wrksrc="${pkgname}-v${version}"
 build_wrksrc=libraries/libapparmor
 build_style=gnu-configure

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[LamaRaz]

[-- Attachment #1: Type: text/plain, Size: 236 bytes --]

New comment by LamaRaz on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-611291235

Comment:
today when I set appamor to enforce dhcpcd stopped working, devices were not being assigned ip.

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[the-antz]

[-- Attachment #1: Type: text/plain, Size: 335 bytes --]

New comment by the-antz on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-611572594

Comment:
> today when I set appamor to enforce dhcpcd stopped working, devices were not being assigned ip.

With the current upstream profile? Or did the profile changes from this PR not work for you?

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[LamaRaz]

[-- Attachment #1: Type: text/plain, Size: 459 bytes --]

New comment by LamaRaz on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-611596119

Comment:
> > today when I set appamor to enforce dhcpcd stopped working, devices were not being assigned ip.
> 
> With the current upstream profile? Or did the profile changes from this PR not work for you?

This merge request is still open so I don't see how I was able to get it with -Su
Just hoping it gets merged soon.

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[the-antz]

[-- Attachment #1: Type: text/plain, Size: 782 bytes --]

New comment by the-antz on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-611668192

Comment:
I was just wondering if there are issues with the fix as you could have manually applied the changes, e.g.
```
wget https://github.com/the-antz/void-packages/raw/apparmor/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
diff usr.bin.dhcpcd /etc/apparmor.d/usr.bin.dhcpcd # check if you like the changes, don't blindly overwrite system files
sudo cp usr.bin.dhcpcd /etc/apparmor.d/usr.bin.dhcpcd
rm usr.bin.dhcpcd
sudo apparmor_parser -R /etc/apparmor.d/usr.bin.dhcpcd
sudo apparmor_parser /etc/apparmor.d/usr.bin.dhcpcd
sudo sv stop dhcpcd
sudo killall dhcpcd
sudo sv start dhcpcd
```
This won't interfere with any future updates.

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[LamaRaz]

[-- Attachment #1: Type: text/plain, Size: 391 bytes --]

New comment by LamaRaz on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-611682816

Comment:
It worked.

Though curiously the apparmor_parser commands were required even after a reboot (apparmor was not set to enforce due to the bug before reboot) i guess it loads the profiles from elsewhere than the directory and they need to be compiled?

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[the-antz]

[-- Attachment #1: Type: text/plain, Size: 611 bytes --]

New comment by the-antz on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-611688356

Comment:
> It worked.
> 
> Though curiously the apparmor_parser commands were required even after a reboot (apparmor was not set to enforce due to the bug before reboot) i guess it loads the profiles from elsewhere than the directory and they need to be compiled?

Did you maybe enable the profile caching (it's off by default)? That'd do that. The cache gets updated when you load a profile manually.
Otherwise, no idea why it would not pick it up automatically on reboot.

Re: [PR PATCH] [Updated] apparmor: fix dhcpcd profile for dhcpcd version 9

[the-antz]

[-- Attachment #1: Type: text/plain, Size: 685 bytes --]

There is an updated pull request by the-antz against master on the void-packages repository

https://github.com/the-antz/void-packages apparmor
https://github.com/void-linux/void-packages/pull/20752

apparmor: fix dhcpcd profile for dhcpcd version 9
**edit**: this is fixed with the latest update of the dhcpcd package (thx duncaen).

------------

Some filename changes introduced by dhcpcd 9 seem unintended, like using
```
/run/pid
/run/sock
/run/unpriv.sock
```
instead of
```
/run/dhcpcd{-*,}.pid
/run/dhcpcd.sock
/run/dhcpcd.unpriv.sock
```
but the profile works for now.

A patch file from https://github.com/void-linux/void-packages/pull/20752.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-apparmor-20752.patch --]
[-- Type: text/x-diff, Size: 1860 bytes --]

From 7e565912ab852e999122f2d66ae1fd2226f1a907 Mon Sep 17 00:00:00 2001
From: Antz <antzz@protonmail.ch>
Date: Wed, 8 Apr 2020 12:40:03 +0200
Subject: [PATCH] apparmor: fix dhcpcd profile for dhcpcd version 9

---
 srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd | 13 ++++++++++---
 srcpkgs/apparmor/template                      |  2 +-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd b/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
index 65c3970ab15..26364f36385 100644
--- a/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
+++ b/srcpkgs/apparmor/files/profiles/usr.bin.dhcpcd
@@ -7,9 +7,15 @@ profile dhcpcd /{usr/,}bin/dhcpcd {
   #include <abstractions/nameservice>
 
   capability chown,
+  capability fowner,
+  capability fsetid,
+  capability kill,
   capability net_admin,
   capability net_raw,
+  capability setuid,
+  capability setgid,
   capability sys_admin,
+  capability sys_chroot,
 
   network packet dgram,
   network inet raw,
@@ -26,9 +32,10 @@ profile dhcpcd /{usr/,}bin/dhcpcd {
   /proc/sys/net/ipv{4,6}/neigh/*/retrans_time_ms w,
   /proc/sys/net/ipv{4,6}/neigh/*/base_reachable_time_ms w,
 
-  /{var/,}run/dhcpcd{-*,}.pid rwk,
-  /{var/,}run/dhcpcd.sock rw,
-  /{var/,}run/dhcpcd.unpriv.sock rw,
+  /{var/,}run/dhcpcd/ w,
+  /{var/,}run/dhcpcd/{,*.}pid rwk,
+  /{var/,}run/dhcpcd/{,*.}sock rw,
+  /{var/,}run/dhcpcd/unpriv.sock rw,
   /{var/,}run/udev/data/* r,
 
   /sys/devices/**/net/*/uevent r,
diff --git a/srcpkgs/apparmor/template b/srcpkgs/apparmor/template
index a0e04bf6a61..cd7073fdcfb 100644
--- a/srcpkgs/apparmor/template
+++ b/srcpkgs/apparmor/template
@@ -1,7 +1,7 @@
 # Template file for 'apparmor'
 pkgname=apparmor
 version=2.13.4
-revision=1
+revision=2
 wrksrc="${pkgname}-v${version}"
 build_wrksrc=libraries/libapparmor
 build_style=gnu-configure

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[the-antz]

[-- Attachment #1: Type: text/plain, Size: 371 bytes --]

New comment by the-antz on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-612450289

Comment:
Updated.

You should see the kill cap when you tell sv to stop it.

I also had to add `/run/dhcpcd/ w`, seems the directory already existed when I did the last changes so I missed it. Only today it failed trying to create it.

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[CameronNemo]

[-- Attachment #1: Type: text/plain, Size: 166 bytes --]

New comment by CameronNemo on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-612464957

Comment:
Cool looks good then.

Re: apparmor: fix dhcpcd profile for dhcpcd version 9

[CameronNemo]

[-- Attachment #1: Type: text/plain, Size: 249 bytes --]

New comment by CameronNemo on void-packages repository

https://github.com/void-linux/void-packages/pull/20752#issuecomment-613001102

Comment:
@xtraeme please merge, especially since you were the one that pushed the dhcpcd 9.0.0 and 9.0.1 updates.

Re: [PR PATCH] [Merged]: apparmor: fix dhcpcd profile for dhcpcd version 9

[xtraeme]

[-- Attachment #1: Type: text/plain, Size: 526 bytes --]

There's a merged pull request on the void-packages repository

apparmor: fix dhcpcd profile for dhcpcd version 9
https://github.com/void-linux/void-packages/pull/20752

Description:
**edit**: this is fixed with the latest update of the dhcpcd package (thx duncaen).

------------

Some filename changes introduced by dhcpcd 9 seem unintended, like using
```
/run/pid
/run/sock
/run/unpriv.sock
```
instead of
```
/run/dhcpcd{-*,}.pid
/run/dhcpcd.sock
/run/dhcpcd.unpriv.sock
```
but the profile works for now.