Hi Christian, On 2016-01-31 11:56 AM, Christian Boltz wrote: > I just replaced my self-made unbound profile with the latest Ubuntu > profile. > > It needs exactly one change [1] to work on openSUSE, and that's the pid > file location. Additionally, I prefer to use abstractions/openssl instead > of /etc/ssl/openssl.cnf.
Good point. Your patch tested fine on Ubuntu Xenial, thanks! > As a sidenote - the capabilities fowner, fsetid and sys_chroot are not > needed on openSUSE. sys_chroot is needed but fowner/fsetid should be dropped. I just tested this on Ubuntu and they are not used any more. I audited all the other capabilities and they are used by Unbound 1.5.7. The fowner/fsetid are probably leftovers from the initial profile I had created for Ubuntu Precise. Should I send a follow-up patch or you'll drop fowner/fsetid when committing? Regards, Simon
signature.asc
Description: OpenPGP digital signature
-- AppArmor mailing list AppArmor@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
