AppArmor tunables handling

Registered by Jamie Strandboge

AppArmor usability can be improved in Ubuntu, especially when considering profiles shipped in the default installation (eg cups, evince, firefox-3.5). In particular: dealing with tunables and likewise-open

Blueprint information

Status:
Complete
Approver:
Robbie Williamson
Priority:
Essential
Drafter:
Jamie Strandboge
Direction:
Approved
Assignee:
Jamie Strandboge
Definition:
Approved
Series goal:
Accepted for lucid
Implementation:
Implemented
Milestone target:
None
Started by
Jamie Strandboge
Completed by
Jamie Strandboge

Related branches

Sprints

Whiteboard

Feedback jdstrand 2009-12-04: The following was discussed on irc with likewise developers (Gerald Carter). lwiauthd.conf will be adjusted to use /home/likewise-open/%D/%U. This will allow easy adjustment of /etc/apparmor.d/tunables/home, with minimal changes to likewise packaging. Upgrades should not try to perform a migration, as it is assumed that likewise administers have already adjusted tunables.

Feedback jdstrand 2010-01-07: apparmor now supports /etc/apparmor.d/tunables/home.d. AppArmor will not have the likewise-open path by default but instead likewise-open will need to ship a file in /etc/apparmor.d/tunables/home.d

Feedback jdstrand 2010-02-17: on upgrades, if the administrator has not preseeded a value for apparmor/homedirs, then postinst will look at /etc/passwd for directories to add to /etc/apparmor.d/tunables/home.d/ubuntu. getent was not used since this would be very cumbersome on large deployments. Administrators in such environments are encouraged to use the preseed.

Work items:
[coffeedude.jerry] adjust 'template homedir' in lwiauthd.conf in likewise-open for apparmor (LP: #274350): DONE
[coffeedude.jerry] adjust likewise-open packages for upgrades to Lucid (LP: #274350): DONE
test homedir path by adjusting apparmor tunables for change in lwiauthd.conf template (LP: #274350): DONE
adjust likewise-open to add a file to tunables/home.d for change in lwiauthd.conf template homedir path: DONE
alias /usr: DONE
have a debconf preseedable setting of the home directories tunable (LP: #447292): DONE

Work items (lucid-beta-2):
parse password file to locate home directories (LP: #447292): DONE

(?)

Work Items

This blueprint contains Public information 
Everyone can see this information.