Set capability dac_override for Apache AppArmor
#2108
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
E OSError: [Errno 39] Directory not empty: '/tmp/securedrop' looks like tests racing against each other ? |
|
Yes, that's an easy toggle to kick off the Travis suite again, but I see that my omission of updated config tests is going to cause Circle CI to fail too. Patching commit... |
We were previously relying on the tor apparmor abstractions to provide `capability dac_override`. When the tor package removed the capability in favor of `dac_read_search`, the apache service started failing due to overconfinement. Editing the AppArmor profile for Apache such that the dac_override capability is now explicitly, rather than implicitly, included.
conorsch
force-pushed
the
explicitly-include-dac-override-in-apache-apparmor-profile
branch
from
5ec6800 to
5dcb4f1
Compare
|
All CI is passing. Running through the QA checklist described in #2107 prior to merging. |
|
Confirmed upgrade resolves issue on hardware. Merging and continuing with pre-release QA process in #2107. |
redshiftzero
deleted the
explicitly-include-dac-override-in-apache-apparmor-profile
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review.
Description of Changes
We were previously relying on the tor apparmor abstractions to provide
capability dac_override. When the tor package removed the capability in favor ofdac_read_search, the apache service startedfailing due to overconfinement. Editing the AppArmor profile for Apache such that the dac_override capability is now explicitly, rather than implicitly, included.
Fixes #2105.
Testing
Confirm both clean installs on staging and upgrades from 0.4.1 restore functionality for the web applications (both Source and Journalist Interfaces).
Deployment
Hotfix release to handle breaking changes from upstream tor package. Discussion of reducing exposure to this form of breakage is in #2106.
Checklist
If you made changes to the app code:
If you made changes to the system configuration:
If you made changes to documentation: