Debian Bug report logs - #814314
Apparmor policy doesn't allow dynamic zones with GSS and LDAP (FreeIPA setup)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Filip Pytloun <filip@pytloun.cz>

To: submit@bugs.debian.org

Subject: Apparmor policy doesn't allow dynamic zones with GSS and LDAP (FreeIPA setup)

Date: Wed, 10 Feb 2016 09:44:43 +0100

[Message part 1 (text/plain, inline)]

Package: bind9
Version: 1:9.9.5.dfsg-12.1

When freeipa-server is setup, it configures Bind9 for dynamic zones from
LDAP using GSSAPI bind.
Unfortunately these actions are not allowed in Apparmor policy.

These rules needs to be added:

# gssapi
/var/lib/sss/pubconf/krb5.include.d/** r,
/var/lib/sss/pubconf/krb5.include.d/ r,
/var/lib/sss/mc/initgroups r,
/etc/gss/mech.d/ r,

# ldap
/etc/ldap/ldap.conf r,
/run/slapd-*.socket rw,

# dynamic updates
/var/tmp/DNS_* rw,

I have submitted fixed package to mentors here:
http://mentors.debian.net/package/bind9

Filip

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 814314-close@bugs.debian.org (full text, mbox, reply):

From: LaMont Jones <lamont@debian.org>

To: 814314-close@bugs.debian.org

Subject: Bug#814314: fixed in bind9 1:9.10.3.dfsg.P2-4

Date: Fri, 19 Feb 2016 22:38:36 +0000

Source: bind9
Source-Version: 1:9.10.3.dfsg.P2-4

We believe that the bug you reported is fixed in the latest version of
bind9, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 814314@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
LaMont Jones <lamont@debian.org> (supplier of updated bind9 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 19 Feb 2016 14:26:08 -0700
Source: bind9
Binary: bind9 bind9utils bind9-doc host bind9-host libbind-dev libbind9-140 libdns162 libirs141 libisc160 liblwres141 libisccc140 libisccfg140 dnsutils lwresd libdns162-udeb libisc160-udeb libisccfg140-udeb libirs141-udeb
Architecture: all amd64 source
Version: 1:9.10.3.dfsg.P2-4
Distribution: experimental
Urgency: medium
Maintainer: LaMont Jones <lamont@debian.org>
Changed-By: LaMont Jones <lamont@debian.org>
Closes: 814314
Description: 
 bind9      - Internet Domain Name Server
 bind9-doc  - Documentation for BIND
 bind9-host - Version of 'host' bundled with BIND 9.X
 bind9utils - Utilities for BIND
 dnsutils   - Clients provided with BIND
 host       - Transitional package
 libbind-dev - Static Libraries and Headers used by BIND
 libbind9-140 - BIND9 Shared Library used by BIND
 libdns162  - DNS Shared Library used by BIND
 libdns162-udeb - Exported DNS library for debian-installer (udeb)
 libirs141  - DNS Shared Library used by BIND
 libirs141-udeb - Exported IRS library for debian-installer (udeb)
 libisc160  - ISC Shared Library used by BIND
 libisc160-udeb - Exported ISC library for debian-installer (udeb)
 libisccc140 - Command Channel Library used by BIND
 libisccfg140 - Config File Handling Library used by BIND
 libisccfg140-udeb - Exported ISC CFG library for debian-installer (udeb)
 liblwres141 - Lightweight Resolver Library used by BIND
 lwresd     - Lightweight Resolver Daemon
Changes:
 bind9 (1:9.10.3.dfsg.P2-4) experimental; urgency=medium
 .
   [Matthias Klose]
 .
   * Fix .so symlinks.
   * libbind-dev: Depend on libirs141.
   * For the udeb's, use a separate build with a reduced feature set, drop the
     name difference, and do both builds in a separate directory.
 .
   [Filip Pytloun]
 .
   * Add apparmor rules needed by freeipa-server.  Closes: #814314
 .
   [LaMont Jones]
 .
   * Do not deliver libraries (left in /lib) as part of bind9.  LP: #1547052
   * clean up library path for libirs.
Checksums-Sha1: 
 ade00bf9762d108dd17164a13caf75227015b926 3169 bind9_9.10.3.dfsg.P2-4.dsc
 28bc6ac9161daa2d86047610c62eb82a2d5d6384 87344 bind9_9.10.3.dfsg.P2-4.debian.tar.xz
 f4add1632e1b80e6af8eebf7c5e80699aba3e1f5 790786 bind9-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 5c87a9dd815efbfc6d772d994cde7e950b884111 375168 bind9-doc_9.10.3.dfsg.P2-4_all.deb
 f1eea9a327d49d6a95626aa3e7f54a07b2c3ace9 66832 bind9-host-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 8c73be12db64a92bd13ab2bbe80206753ca404c6 57918 bind9-host_9.10.3.dfsg.P2-4_amd64.deb
 44f36a61caa93709f0cc14ba904dbe590b0cfcdf 351558 bind9_9.10.3.dfsg.P2-4_amd64.deb
 a7660cc539de2780ef24511d59fc7f5b1d94e6e3 446726 bind9utils-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 d0f4d5e571f51939df3416285d7db478b9d08d0f 171964 bind9utils_9.10.3.dfsg.P2-4_amd64.deb
 4cefb231a64c353ed7ddd71e113c75e13ff2dfc4 188384 dnsutils-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 b0a3baa1a07a1e660cece8e39654058f2b96ab35 107970 dnsutils_9.10.3.dfsg.P2-4_amd64.deb
 80de72d9ca3a11d5ca01afbf83cf3e4cc6ab5eb8 23370 host_9.10.3.dfsg.P2-4_all.deb
 8d4f5f47a72cbd640668bcef6891fcc30978ca8a 1349662 libbind-dev_9.10.3.dfsg.P2-4_amd64.deb
 d3db807f8af3920689cbcbffdb552f25e1b9abe3 47410 libbind9-140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 057574cd72cc6725e34591dbb7dd19530a69056f 44218 libbind9-140_9.10.3.dfsg.P2-4_amd64.deb
 506add8a7c812a0f2bad0b91d0d8ecb44c1d2865 2135472 libdns162-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 513d73210ee666ffe2b4945d8e3134527adedc42 664860 libdns162-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 092930aa507459409bacc62fe175f8cdd93483a5 723144 libdns162_9.10.3.dfsg.P2-4_amd64.deb
 1162bff053040a0467cc04b712331b9eae918745 52506 libirs141-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 a9e88a3fbfb8f6815bdcf2c54d9b60bbde8cdb31 14964 libirs141-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 fc44685bc8dd8bb428acd761d2945f628c9a057b 38298 libirs141_9.10.3.dfsg.P2-4_amd64.deb
 28cc4c5a1c52a670fa66f7b0d5afff2669e5b72b 384054 libisc160-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 fed3de897ae4a4ee6b54755dd6c475ca5708eb43 150128 libisc160-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 2348f498244a7455b79dce7978a5e2ae859e47a0 181184 libisc160_9.10.3.dfsg.P2-4_amd64.deb
 8914094776107aae2b10e51659ad0f8cf0d66f39 34750 libisccc140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 c54a18d728606c2a2fe2f1b9effdb2027bcf0010 36660 libisccc140_9.10.3.dfsg.P2-4_amd64.deb
 a1433feb6ba4afbf545ad9ad4cafb8a2060396f5 80258 libisccfg140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 5da363035d001e5652ba3b413ef7173096ce205a 36126 libisccfg140-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 8faf3a0c1d91c132a33a8029cff113691a349ce6 60838 libisccfg140_9.10.3.dfsg.P2-4_amd64.deb
 e6bf57c1cad861639e7c0c1021cd1472cd2cdc38 77652 liblwres141-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 a2c5b1d95a3c7dde2f8d997d5bb27280226b264f 52258 liblwres141_9.10.3.dfsg.P2-4_amd64.deb
 6c292e765d2f2b19a2219b473c0dc52058d0bc29 669484 lwresd-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 9042a8333dfc376499f1f7f7a713eaee0bd6476b 244684 lwresd_9.10.3.dfsg.P2-4_amd64.deb
Checksums-Sha256: 
 4e880c5b7dee3c5acec18cc7847ae9822f68a6e78a4a81f3226579550790bb4c 3169 bind9_9.10.3.dfsg.P2-4.dsc
 92504cedaed8799d42bd93751130adfffcf429248f366d360b8c13fe5019a424 87344 bind9_9.10.3.dfsg.P2-4.debian.tar.xz
 936db95ce0da1e6be86beb4abc5f06aa4fc1eb025d064425ea84e68629825d3f 790786 bind9-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 d7c02ca0b3c0d40b65c9965f51e9f4651c53a22d3c77c9b63e995f14f60ef9b2 375168 bind9-doc_9.10.3.dfsg.P2-4_all.deb
 aee94541e491268314d42bf8b457cd2f254f80f9dd3c638d1886b93be4165b3d 66832 bind9-host-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 50289bb59152c610dc1830a85f6a29dc3c16fc211885dea1adcbf34c9f09f86a 57918 bind9-host_9.10.3.dfsg.P2-4_amd64.deb
 5ef2cd06359d9dae82737d84de49362d8bf4546e37acee0502bd69b31402db16 351558 bind9_9.10.3.dfsg.P2-4_amd64.deb
 48aa999564a63514957c918b2bf47bf164df4b2ae53530f0e25b684dba0a7b49 446726 bind9utils-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 ae12165c6d3de514a521934e90c2f64264f35553ea1de51d7291ea86bceddf1e 171964 bind9utils_9.10.3.dfsg.P2-4_amd64.deb
 4c6cd66b3708936deef0e01f62272e195bc5450146abbf890df57ffbd69f8fb6 188384 dnsutils-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 0d3e39a1e409db58ab52fcff52d3562370d5607a0f489a17e441829a7fa8563a 107970 dnsutils_9.10.3.dfsg.P2-4_amd64.deb
 705bdfa1a867b9a98f582885452abcd0e553209d36265199c156caa672257a30 23370 host_9.10.3.dfsg.P2-4_all.deb
 5daadef56b9a0395357b932ca223c65def6110929139ca80a5bf90b72a4b0b1a 1349662 libbind-dev_9.10.3.dfsg.P2-4_amd64.deb
 5745f087366fcf39b0c6aadc6071e75c2c06dfebe3d9299e521412384f7a8b9b 47410 libbind9-140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 eced683269dc5fc68d211250551a1cfe874c3e02c61e95e6bf2a1a13eb2927d2 44218 libbind9-140_9.10.3.dfsg.P2-4_amd64.deb
 4fba17c24e692bb25ed8b28391b3d1c9b253b86c64e6303682bc93dcc750c91f 2135472 libdns162-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 3e5f4c91dea6b62fe5a152f1bb0f3324bd783bd2e772a2ef399c51761be71c42 664860 libdns162-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 cf3b4cb7c4e74adc63f7911534cd1089a098745060e4088722fb980b8912d19e 723144 libdns162_9.10.3.dfsg.P2-4_amd64.deb
 dfefced84c3eeda020735fb76af5eab61d7d0f05dcfe6d6a0e1c76a4e951a3ef 52506 libirs141-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 2b06ded41cd4c5435768f1bf02d54cbfff48c8f985245300b5e14a126c8d4574 14964 libirs141-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 6b413d41c6755ab57f62532be3a41f95e1d6c290b813c3d0f503c96d0f33685f 38298 libirs141_9.10.3.dfsg.P2-4_amd64.deb
 a08da44180a5ffbd3c0bfc021e7de85ae6f43700a5798dd61e9bd7f12670970f 384054 libisc160-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 8dbad9c0b522b18fbb59d8078eeaf88a67aa3bd50285434e739c952c622cf2d8 150128 libisc160-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 36643e1782ee60c5ff4fd2b0af8106c994a23079f2daea78386ee2d600183a64 181184 libisc160_9.10.3.dfsg.P2-4_amd64.deb
 6545df832202842f178d69de6cbfb16de427aa84c469860d560c3abe9a08de50 34750 libisccc140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 4f28c54604ba05f243d56d0e47a88fcf5e0d1352f2c03564993cdaa068e6d82a 36660 libisccc140_9.10.3.dfsg.P2-4_amd64.deb
 29120aeace83f197596780866c0f334f43b5cc17d23a94846001b452ad03faf7 80258 libisccfg140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 91e68b89e2d3b88de451d2101c07e97ff090e51f10b6be757ded9add9a41e5a5 36126 libisccfg140-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 75eec236bada118580bfc806aa51dd823d0801b2b2415c20a8b3d45fb952e74a 60838 libisccfg140_9.10.3.dfsg.P2-4_amd64.deb
 c9c2f1666bf58440c5b03776899a5994dd340dd9f9c1e177d67ed758c3898bf6 77652 liblwres141-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 3b14a79344069d42a6506a6cab7373c3ff20cf02c6b3a74c85aacae47af3a3f1 52258 liblwres141_9.10.3.dfsg.P2-4_amd64.deb
 de68460e6ed01aac2311fbe224b2528d78d9cd8873bf2a1fb6c9a768723d1c8d 669484 lwresd-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 46d1599a61a1e22ae9fa5428ccf132464a4e30cde1ca0e599faf6f48ab610308 244684 lwresd_9.10.3.dfsg.P2-4_amd64.deb
Files: 
 4dae5360e3d3f9683da2625b05eab3e0 3169 net optional bind9_9.10.3.dfsg.P2-4.dsc
 3348243e06482dc5c53339960734b29d 87344 net optional bind9_9.10.3.dfsg.P2-4.debian.tar.xz
 a12aea1aaa4c955fe13ed831a040efd5 790786 debug extra bind9-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 7aff639ea549163a189a5293d9670ef6 375168 doc optional bind9-doc_9.10.3.dfsg.P2-4_all.deb
 02d303820b510645d721dafa3c3e83f8 66832 debug extra bind9-host-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 19f5fbb5906ae250d637da0d0fd31b66 57918 net standard bind9-host_9.10.3.dfsg.P2-4_amd64.deb
 c4aa6a73b7cf4ad6bf91b3fbc40a6dde 351558 net optional bind9_9.10.3.dfsg.P2-4_amd64.deb
 67174e4b0097373b620df7674c3b8ce8 446726 debug extra bind9utils-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 bdc8c52b90b9ca12bdcc4cb4f19f1659 171964 net optional bind9utils_9.10.3.dfsg.P2-4_amd64.deb
 ac6b259a925b0230383411ab2935b47a 188384 debug extra dnsutils-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 2543507bef57358d8867399ee99170e2 107970 net standard dnsutils_9.10.3.dfsg.P2-4_amd64.deb
 b11733ed552cf165109788cdf18ecd2d 23370 net standard host_9.10.3.dfsg.P2-4_all.deb
 bc864becfc413fe22f00e9f04332dddf 1349662 libdevel optional libbind-dev_9.10.3.dfsg.P2-4_amd64.deb
 c57b137187591fd434a813d3580e3b7c 47410 debug extra libbind9-140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 14203271eb50ca1adfd65f476fc2bb14 44218 libs standard libbind9-140_9.10.3.dfsg.P2-4_amd64.deb
 f91bc804ded9d20f0a2bcafe61847a6c 2135472 debug extra libdns162-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 dd4749744ef611666426f0cf994bb0ad 664860 debian-installer optional libdns162-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 256e43aaed888266554b2a0a42bb02b5 723144 libs standard libdns162_9.10.3.dfsg.P2-4_amd64.deb
 8f6b2ca05fd5dc14b86308a370b82f6e 52506 debug extra libirs141-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 6fb799c75a233f15cc1fd70f3d4b800a 14964 debian-installer optional libirs141-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 de581657367d8615c8a0bd133486a8c5 38298 libs standard libirs141_9.10.3.dfsg.P2-4_amd64.deb
 2f95b7b7ccea71b9c39e88b01e009605 384054 debug extra libisc160-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 245152caaac02ea79e7f33a4c1140abd 150128 debian-installer optional libisc160-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 71d6c9b185b704a08df0fee1a71c280a 181184 libs standard libisc160_9.10.3.dfsg.P2-4_amd64.deb
 2e5123c8a08740fe6f569e062ccc6d42 34750 debug extra libisccc140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 4ef353a2f65ca4fd1ff0c86f6219d966 36660 libs optional libisccc140_9.10.3.dfsg.P2-4_amd64.deb
 d7be295e6feb4cda0fc57f87de66f25c 80258 debug extra libisccfg140-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 f38b29babde216ab34897229cac5126e 36126 debian-installer optional libisccfg140-udeb_9.10.3.dfsg.P2-4_amd64.udeb
 d6b83f0871e146c707318d764e5871f0 60838 libs standard libisccfg140_9.10.3.dfsg.P2-4_amd64.deb
 717eae81bc5dad16e5b46ec3e38815af 77652 debug extra liblwres141-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 42fb0faec7d90e8300007ea817964f85 52258 libs standard liblwres141_9.10.3.dfsg.P2-4_amd64.deb
 9d1b7820956105a1411d05dc64cad78b 669484 debug extra lwresd-dbgsym_9.10.3.dfsg.P2-4_amd64.deb
 8db051e32193286b4f9694dba051dfde 244684 net optional lwresd_9.10.3.dfsg.P2-4_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBVsePQNVHlGMnADo/AQj0NhAApGCtWoxYfZL/NT5NLQO0lhC9GmOqctwj
FgQoS92AjTx1lthLu0OP6QaYH6eZ2h6ZImm6W98rk7weS62Zbjnn0L+OJDd7oZ51
hiJvpqlfJ0pMTssvMVHwl2sFUdQCh70oQrhCG4T8zRa0f3zdDd/ApAiDpFe8Cn2x
FVDEA1Xb7EVoDieip4hMp4po9VeeFcd4qSebJ1Z17iIaXocwBJ2eDCRfa5ApkY+H
vtrLHG2r4L8CYdv7WDKVNfN56NvgTxhaYJl8Ek4Ta3pFuzKYHptfWG4mxhsB0WbE
iUAh02VaCRu0z6sKs943WeYmpXHaCC4AwXGX5pub6zzaL6n6PvNFtD2BrEqdno4x
eXZSlfZnyES+aXPH59bpEky3yAD3WP+KYaHpaLiYAyFVVhkab/iyqf0OtRooRVdx
er1wPQQu+fG6ToP5nXpecGb7/9bLdUZRWtAt3MO82aA/Cf0stMcrZTdYzxMIP+SE
L1zQ0jzKdeNF8F4SZVLHzrdqAcNTYENeMV+s5ACduxhILocTazSdsWlGG/oDUjHb
/qgMiVJ79D6JYxRq8f8gnLTVnIM1xxS+Qn3Ge+a8VCB1tjbmv6B6uls8z6nGkhto
oiNxg+92dzRbjfIYSXfcl7TwLFck83baiYFHTNhGeGQG2aAmw0OsJhw2DmFJ4vO5
hz4BKVLboDU=
=J7sn
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.