netatalk apparmor

usr.local.sbin.afpd

#include <tunables/global>

/usr/local/sbin/afpd {
  #include <abstractions/authentication>
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/nis>
  #include <abstractions/wutmp>
  #include <abstractions/dbus-strict>
  #include <local/usr.local.sbin.afpd>


  capability audit_write,
  capability dac_override,
  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_resource,
  capability sys_ptrace,

  ptrace (read, readby),
  ptrace (trace) peer=@{profile_name},
  
  signal (receive) peer=/usr/local/sbin/netatalk,
  
  dbus send
       bus=system
       path=/org/freedesktop/login1
       interface=org.freedesktop.login1.Manager
       peer=(name=org.freedesktop.login1),

  /etc/hosts.allow r,
  /etc/hosts.deny r,
  /etc/mtab r,
  /usr/local/etc/afp.conf rk,
  /usr/local/etc/extmap.conf r,
  /usr/local/lib/libatalk.so.* mr,
  /usr/local/lib/netatalk/*.so mr,
  /usr/local/sbin/afpd mr,
  /usr/local/var/netatalk/* r,
  /var/log/afpd.log w,
  @{PROC}/1/environ r,
  @{PROC}/@{pid}/loginuid r,

}

usr.local.sbin.cnid_dbd

#include <tunables/global>

/usr/local/sbin/cnid_dbd {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability dac_override,
  capability setuid,
  capability setgid,

  /usr/local/etc/afp.conf rk,
  /usr/local/etc/extmap.conf r,
  /usr/local/lib/libatalk.so.* mr,
  /usr/local/sbin/cnid_dbd mr,
  /usr/local/var/netatalk/** rwk,
  /var/log/afpd.log w,

}

usr.local.sbin.cnid_metad

#include <tunables/global>

/usr/local/sbin/cnid_metad {
  #include <abstractions/base>
  #include <abstractions/nameservice>


  capability dac_override,
  capability setuid,
  capability setgid,
  capability sys_resource,

  signal (receive) peer=/usr/local/sbin/netatalk,

  /usr/local/etc/afp.conf rk,
  /usr/local/etc/extmap.conf r,
  /usr/local/lib/libatalk.so.* mr,
  /usr/local/sbin/cnid_dbd Px,
  /usr/local/sbin/cnid_metad mr,
  /usr/local/var/netatalk/* r,
  /var/log/afpd.log w,

}

usr.local.sbin.netatalk

# Last Modified: Sun Nov  9 20:21:18 2014
#include <tunables/global>

/usr/local/sbin/netatalk flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/dbus-strict>


  capability dac_override,
  capability setuid,
  capability setgid,
  capability sys_resource,
  capability kill,

  signal (send) peer=/usr/local/sbin/afpd,
  signal (send) peer=/usr/local/sbin/cnid_metad,

  /run/lock/netatalk rwk,
  /usr/local/etc/afp.conf rk,
  /usr/local/etc/extmap.conf r,
  /usr/local/lib/libatalk.so.* mr,
  /usr/local/sbin/afpd Px,
  /usr/local/sbin/cnid_metad Px,
  /usr/local/sbin/netatalk Pxmr,
  /usr/local/var/netatalk/afp_voluuid.conf r,
  /var/log/afpd.log w,

  dbus (send,receive)
       bus=system
       interface="org.freedesktop.*",

}