From 7ad55027da4df9720bb48be311fc9a0afeb453d4 Mon Sep 17 00:00:00 2001
From: David Prevot <dprevot+git@evolix.fr>
Date: Thu, 9 Nov 2023 18:19:42 +0100
Subject: [PATCH] bind: Adapt apparmor rules as in
 https://wiki.debian.org/Bind9

---
 bind/files/apparmor.usr.sbin.named        |  5 ++
 bind/tasks/main.yml                       | 10 +--
 bind/templates/apparmor.usr.sbin.named.j2 | 97 -----------------------
 3 files changed, 10 insertions(+), 102 deletions(-)
 create mode 100644 bind/files/apparmor.usr.sbin.named
 delete mode 100644 bind/templates/apparmor.usr.sbin.named.j2

diff --git a/bind/files/apparmor.usr.sbin.named b/bind/files/apparmor.usr.sbin.named
new file mode 100644
index 00000000..3ee197b0
--- /dev/null
+++ b/bind/files/apparmor.usr.sbin.named
@@ -0,0 +1,5 @@
+/var/chroot-bind/etc/bind/** r,
+/var/chroot-bind/var/** rw,
+/var/chroot-bind/dev/** rw,
+/var/chroot-bind/run/** rw,
+/var/chroot-bind/usr/** r,
diff --git a/bind/tasks/main.yml b/bind/tasks/main.yml
index 0e5c7fea..45918760 100644
--- a/bind/tasks/main.yml
+++ b/bind/tasks/main.yml
@@ -17,13 +17,13 @@
   register: check_apparmor
 
 - name: configure apparmor
-  ansible.builtin.template:
-    src: apparmor.usr.sbin.named.j2
-    dest: /etc/apparmor.d/usr.sbin.named
-    owner: root
-    group: root
+  ansible.builtin.copy:
+    src: apparmor.usr.sbin.named
+    dest: /etc/apparmor.d/local/usr.sbin.named
     mode: "0644"
+    owner: root
     force: true
+    backup: yes
   notify: restart apparmor
   when: check_apparmor.rc == 0
 
diff --git a/bind/templates/apparmor.usr.sbin.named.j2 b/bind/templates/apparmor.usr.sbin.named.j2
deleted file mode 100644
index d9f0be04..00000000
--- a/bind/templates/apparmor.usr.sbin.named.j2
+++ /dev/null
@@ -1,97 +0,0 @@
-# vim:syntax=apparmor
-# Last Modified: Tue Mar  9 14:17:50 EST 2021
-#include <tunables/global>
-
-/usr/sbin/named flags=(attach_disconnected) {
-  #include <abstractions/base>
-  #include <abstractions/nameservice>
-
-  capability net_bind_service,
-  capability setgid,
-  capability setuid,
-  capability sys_chroot,
-  capability sys_resource,
-
-  # /etc/bind should be read-only for bind
-  # /var/lib/bind is for dynamically updated zone (and journal) files.
-  # /var/cache/bind is for slave/stub data, since we're not the origin of it.
-  # See /usr/share/doc/bind9/README.Debian.gz
-  /etc/bind/** r,
-  /var/lib/bind/** rw,
-  /var/lib/bind/ rw,
-  /var/cache/bind/** lrw,
-  /var/cache/bind/ rw,
-
-  # Database file used by allow-new-zones
-  /var/cache/bind/_default.nzd-lock rwk,
-
-  # gssapi
-  /etc/krb5.keytab kr,
-  /etc/bind/krb5.keytab kr,
-
-  # ssl
-  /etc/ssl/openssl.cnf r,
-
-  # root hints from dns-data-root
-  /usr/share/dns/root.* r,
-
-  # GeoIP data files for GeoIP ACLs
-  /usr/share/GeoIP/** r,
-
-  # dnscvsutil package
-  /var/lib/dnscvsutil/compiled/** rw,
-
-  # Allow changing worker thread names
-  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
-
-  @{PROC}/net/if_inet6 r,
-  @{PROC}/*/net/if_inet6 r,
-  @{PROC}/sys/net/ipv4/ip_local_port_range r,
-  /usr/sbin/named mr,
-  /{,var/}run/named/named.pid w,
-  /{,var/}run/named/session.key w,
-  # support for resolvconf
-  /{,var/}run/named/named.options r,
-
-  # some people like to put logs in /var/log/named/ instead of having
-  # syslog do the heavy lifting.
-  {{ bind_log_file }} rw,
-{% if bind_query_file_enabled | bool %}
-  {{ bind_query_file }} rw,
-{% endif %}
-
-  # gssapi
-  /var/lib/sss/pubconf/krb5.include.d/** r,
-  /var/lib/sss/pubconf/krb5.include.d/ r,
-  /var/lib/sss/mc/initgroups r,
-  /etc/gss/mech.d/ r,
-
-  # ldap
-  /etc/ldap/ldap.conf r,
-  /{,var/}run/slapd-*.socket rw,
-
-  # dynamic updates
-  /var/tmp/DNS_* rw,
-
-  # dyndb backends
-  /usr/lib/bind/*.so rm,
-
-  # Samba DLZ
-  /{usr/,}lib/@{multiarch}/samba/bind9/*.so rm,
-  /{usr/,}lib/@{multiarch}/samba/gensec/*.so rm,
-  /{usr/,}lib/@{multiarch}/samba/ldb/*.so rm,
-  /{usr/,}lib/@{multiarch}/ldb/modules/ldb/*.so rm,
-  /var/lib/samba/bind-dns/dns.keytab rk,
-  /var/lib/samba/bind-dns/named.conf r,
-  /var/lib/samba/bind-dns/dns/** rwk,
-  /var/lib/samba/private/dns.keytab rk,
-  /var/lib/samba/private/named.conf r,
-  /var/lib/samba/private/dns/** rwk,
-  /etc/samba/smb.conf r,
-  /dev/urandom rwmk,
-  owner /var/tmp/krb5_* rwk,
-
-  # Site-specific additions and overrides. See local/README for details.
-  #include <local/usr.sbin.named>
-}
-