https://bugzilla.novell.com/show_bug.cgi?id=692428 https://bugzilla.novell.com/show_bug.cgi?id=692428#c0 Summary: AppArmor usr.sbin.dhcpd needs modification (one solution supplied) Classification: openSUSE Product: openSUSE 11.4 Version: Final Platform: x86-64 OS/Version: openSUSE 11.4 Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor AssignedTo: jeffm@novell.com ReportedBy: suseforum@roocomputing.co.uk QAContact: qa@suse.de Found By: --- Blocker: --- User-Agent: Opera/9.80 (X11; Linux x86_64; U; en-GB) Presto/2.8.131 Version/11.10 FYI ** I was getting multiple dhcpd errors. I copied: /etc/apparmour/profiles/extras/usr.sbin.dhcpd to /etc/apparmour.d/ because it was missing then changed it as follows: OLD --> NEW --- /etc/apparmor/profiles/extras/usr.sbin.dhcpd 2011-02-23 11:49:51.000000000 +0000 +++ /etc/apparmor.d/usr.sbin.dhcpd 2011-05-07 09:54:30.000000000 +0100 @@ -1,33 +1,39 @@ # $Id$ # ------------------------------------------------------------------ # # Copyright (C) 2002-2005 Novell/SUSE # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General Public # License published by the Free Software Foundation. # # ------------------------------------------------------------------ #include <tunables/global> /usr/sbin/dhcpd { #include <abstractions/base> #include <abstractions/nameservice> capability dac_override, capability net_bind_service, capability net_raw, capability setgid, capability setuid, capability sys_chroot, + network inet raw, + network packet raw, + /db/dhcpd.leases* lrw, /etc/dhcpd.conf r, /etc/hosts.allow r, /etc/hosts.deny r, /usr/sbin/dhcpd rmix, - /var/lib/dhcp/dhcpd.leases* rwl, + /var/lib/dhcp/db/dhcpd.leases* rwl, /var/lib/dhcp/etc/dhcpd.conf r, /var/run/dhcpd.pid wl, + /etc/named.d/*tsig r, + + @{PROC}/[0-9]*/net/dev r, } Hope this helps. Reproducible: Always Steps to Reproduce: 1.Use /etc/apparmour/profiles/extras/usr.sbin.dhcpd supplied with 11.4 2.rcapparmor restart 3.rcdhcpd restart 4.tail /var/log/audit/audit.log 5.tail /var/log/messages Actual Results: **Note these errors were incrementally displayed over a number of iterations as I went through the dhcpd config and fixed each error in turn *** dhcpd: Can't create PID file /var/run/dhcpd.pid: Permission denied. dhcpd: Can't open /etc/named.d//roo_tsig: Permission denied dhcpd: unable to create icmp socket: Permission denied dhcpd: Can't open lease database /var/lib/dhcp/db/dhcpd.leases: Permission denied -- dhcpd: Error opening '/proc/net/dev' to list interfaces dhcpd: Can't get list of interfaces. dhcpd: Open a socket for LPF: Permission denied Expected Results: No errors in /var/log/messages Note that the /etc/named.d/*tsig r, line is from my personal dhcpd <--> named setup so a generic solution would have to be tied back to the key generating activity in YAST: YAST > Network Services > DNS Server > TSIG Keys -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.