[Bug 662761] New: nscd needs read access to /etc/openldap/cacerts
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c0 Summary: nscd needs read access to /etc/openldap/cacerts Classification: openSUSE Product: openSUSE 11.4 Version: Milestone 5 of 6 Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor AssignedTo: jeffm@novell.com ReportedBy: rhafer@novell.com QAContact: qa@suse.de Found By: Development Blocker: --- yast2-ldap-client stores CA certificates in /etc/openldap/cacerts by default. However apparmor denies read access to it for nscd (through the nameservice abstraction). Changing /etc/openldap/* to /etc/openldap/** in /etc/apparmor.d/abstractions/nameservice should to the trick. I'll prepare a submitrequest. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c1 Jeff Mahoney <jeffm@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |rhafer@novell.com --- Comment #1 from Jeff Mahoney <jeffm@novell.com> 2011-01-06 15:20:34 UTC --- Please make sure the SR is against the apparmor package in security:apparmor:factory and not the apparmor-profiles package in openSUSE:Factory. Most of the individual apparmor-* source packages are going away in favor of a single apparmor source package, which is how the upstream project ships the code now. That said, the nscd profile should be simpler than it is. OpenLDAP should have its own abstraction profile that is included from the nscd one. That is how other plugins work, like nis, kerberos, even Novell eDirectory. So instead of adding ldap support to nscd, please move the existing ldap support to a new abstractions/openldap profile and include it into the nscd profile with #include <abstractions/openldap> -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c2 --- Comment #2 from Jeff Mahoney <jeffm@novell.com> 2011-01-06 15:28:42 UTC --- Oops, replace "nscd" with abstractions/nameservice in the last comment. :) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c3 Ralf Haferkamp <rhafer@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|rhafer@novell.com | --- Comment #3 from Ralf Haferkamp <rhafer@novell.com> 2011-01-06 16:36:45 CET --- (In reply to comment #1)
Please make sure the SR is against the apparmor package in security:apparmor:factory and not the apparmor-profiles package in openSUSE:Factory. Most of the individual apparmor-* source packages are going away in favor of a single apparmor source package, which is how the upstream project ships the code now. Ok. Thanks for the hint. Seems I was a little too fast with my SR. I revoked it again ;).
That said, the nscd profile should be simpler than it is. OpenLDAP should have its own abstraction profile that is included from the nscd one. That is how other plugins work, like nis, kerberos, even Novell eDirectory. Ok. I'll try to do it that way.
-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c4 Ralf Haferkamp <rhafer@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO CC| |jsuchome@novell.com InfoProvider| |jeffm@novell.com --- Comment #4 from Ralf Haferkamp <rhafer@novell.com> 2011-01-06 16:50:14 CET --- I just saw that abstractions/kerberosclient (and friends) are comment by default in abstractions/nameservice. How are they enabled? Do the specific yast modules (e.g. yast2 kerberos-client) handle that? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c5 Jeff Mahoney <jeffm@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|jeffm@novell.com | --- Comment #5 from Jeff Mahoney <jeffm@novell.com> 2011-01-06 15:53:14 UTC --- In general, # indicates a comment -- but #include is special and is a directive to include that file's contents in-line when being processed. Just like C code. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c6 --- Comment #6 from Ralf Haferkamp <rhafer@novell.com> 2011-01-06 17:06:14 CET --- Argh, I just realized that myself. :| -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c7 --- Comment #7 from Ralf Haferkamp <rhafer@novell.com> 2011-01-06 19:48:22 CET --- I just created SR#57268, which contains the new profile "ldapclient". I extended the profile a bit (appart from what was already in "nameservice") to also make SASL authentication work for LDAP clients. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=662761 https://bugzilla.novell.com/show_bug.cgi?id=662761#c8 Jeff Mahoney <jeffm@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #8 from Jeff Mahoney <jeffm@novell.com> 2011-01-06 18:56:10 UTC --- Accepted. Thanks. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com