gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-20 11:21:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ovn): grant charon AppArmor read on /etc/spinifex/ipsec

Browse Source 
The strongswan-charon profile only allows reads from /etc/ipsec.*,
/etc/strongswan.*, and a small fixed allowlist. ovs-monitor-ipsec writes
the per-tunnel strongSwan config with absolute paths to our peer cert +
key under /etc/spinifex/ipsec/, so charon hits 'Permission denied'
loading them (it runs as uid 0 but AppArmor still blocks) and no xfrm
SAs come up. Drop a read grant for /etc/spinifex/ipsec/** into the
profile's local override hook + reload.
This commit is contained in:
joshsiv-mulga
2026-05-25 17:01:24 +10:00
parent 0b70f84c29
commit 97b6c249ca
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup-ovn.sh
+16
View File
@@ -238,6 +238,22 @@ install_packages() {
install_packages
# strongswan-charon ships an AppArmor profile for /usr/lib/ipsec/charon that
# only allows reading from /etc/ipsec.*, /etc/strongswan.*, and a few other
# fixed paths. ovs-monitor-ipsec writes the per-tunnel strongSwan config with
# absolute paths to our cert + key under /etc/spinifex/ipsec/, so charon hits
# "Permission denied" when loading them and no SAs come up. The profile
# includes a 'local' override file expressly for site additions — drop a
# read grant for our cert dir there and reload the profile.
if [ -d /etc/apparmor.d/local ]; then
LOCAL_OVERRIDE=/etc/apparmor.d/local/usr.lib.ipsec.charon
if ! grep -q '/etc/spinifex/ipsec/' "$LOCAL_OVERRIDE" 2>/dev/null; then
echo " Adding AppArmor read grant for /etc/spinifex/ipsec to charon profile"
echo "/etc/spinifex/ipsec/** r," | sudo tee "$LOCAL_OVERRIDE" >/dev/null
sudo apparmor_parser -r /etc/apparmor.d/usr.lib.ipsec.charon 2>/dev/null || true
fi
fi
# --- Step 2: Enable services ---
echo ""
echo "Step 2: Enabling services..."