enterprise-support team mailing list archive

[Kartik Subbarao <subbarao@xxxxxxxxxxxx>]

Public bug reported:

Can we get /etc/krb5/** and /tmp/krb5cc_* added with the appropriate
permissions to the slapd apparmor profile? I'm getting the following
kinds of errors:

apparmor="DENIED" operation="open" profile="/usr/sbin/slapd"
name="/etc/krb5/user/389/client.keytab" pid=19080 comm="slapd"
requested_mask="r" denied_mask="r" fsuid=389 ouid=389

apparmor="DENIED" operation="file_lock" profile="/usr/sbin/slapd"
name="/tmp/krb5cc_389" pid=19080 comm="slapd" requested_mask="k"
denied_mask="k" fsuid=389 ouid=389

** Affects: openldap (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: apparmor kerberos keytab

-- 
You received this bug notification because you are a member of Ubuntu
Server/Client Support Team, which is subscribed to openldap in Ubuntu.
Matching subscriptions: Ubuntu Server/Client Support Team
https://bugs.launchpad.net/bugs/1783183

Title:
  apparmor profile denied for kerberos client keytab and credential
  cache files

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1783183/+subscriptions