This file is indexed.

/etc/apparmor.d/usr.sbin.dnsmasq is in apparmor-profiles 2.10.95-0ubuntu2.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
# ------------------------------------------------------------------
#
#    Copyright (C) 2009 John Dong <jdong@ubuntu.com>
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

@{TFTP_DIR}=/var/tftp /srv/tftpboot

#include <tunables/global>
/usr/sbin/dnsmasq flags=(complain,attach_disconnected) {
  #include <abstractions/base>
  #include <abstractions/dbus>
  #include <abstractions/nameservice>

  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability dac_override,
  capability net_admin,         # for DHCP server
  capability net_raw,           # for DHCP server ping checks
  network inet raw,
  network inet6 raw,

  signal (receive) peer=/usr/sbin/libvirtd,
  ptrace (readby) peer=/usr/sbin/libvirtd,

  owner /dev/tty rw,

  /etc/dnsmasq.conf r,
  /etc/dnsmasq.d/ r,
  /etc/dnsmasq.d/* r,
  /etc/dnsmasq.d-available/ r,
  /etc/dnsmasq.d-available/* r,
  /etc/ethers r,
  /etc/NetworkManager/dnsmasq.d/ r,
  /etc/NetworkManager/dnsmasq.d/* r,

  /usr/sbin/dnsmasq mr,

  /{,var/}run/*dnsmasq*.pid w,
  /{,var/}run/dnsmasq-forwarders.conf r,
  /{,var/}run/dnsmasq/ r,
  /{,var/}run/dnsmasq/* rw,

  /var/lib/misc/dnsmasq.leases rw, # Required only for DHCP server usage

  /{,usr/}bin/{ba,da,}sh ix, # Required to execute --dhcp-script argument

  # access to iface mtu needed for Router Advertisement messages in IPv6
  # Neighbor Discovery protocol (RFC 2461)
  @{PROC}/sys/net/ipv6/conf/*/mtu r,

  # for the read-only TFTP server
  @{TFTP_DIR}/ r,
  @{TFTP_DIR}/** r,

  # libvirt config and hosts file for dnsmasq
  /var/lib/libvirt/dnsmasq/          r,
  /var/lib/libvirt/dnsmasq/*         r,

  # libvirt pid files for dnsmasq
  /{,var/}run/libvirt/network/      r,
  /{,var/}run/libvirt/network/*.pid rw,

  # libvirt lease helper
  /usr/lib{,64}/libvirt/libvirt_leaseshelper Cx -> libvirt_leaseshelper,

  # lxc-net pid and lease files
  /{,var/}run/lxc/dnsmasq.pid    rw,
  /var/lib/misc/dnsmasq.*.leases rw,

  # lxd-bridge pid and lease files
  /{,var/}run/lxd-bridge/dnsmasq.pid   rw,
  /var/lib/lxd-bridge/dnsmasq.*.leases rw,

  # NetworkManager integration
  /{,var/}run/nm-dns-dnsmasq.conf r,
  /{,var/}run/sendsigs.omit.d/*dnsmasq.pid w,
  /{,var/}run/NetworkManager/dnsmasq.conf r,
  /{,var/}run/NetworkManager/dnsmasq.pid w,

  profile libvirt_leaseshelper flags=(complain) {
    #include <abstractions/base>

    /etc/libnl-3/classid r,

    owner @{PROC}/@{pid}/net/psched r,
    owner @{PROC}/@{pid}/status r,

    /sys/devices/system/cpu/ r,
    /sys/devices/system/node/ r,
    /sys/devices/system/node/*/meminfo r,

    # libvirt lease and status files for dnsmasq
    /var/lib/libvirt/dnsmasq/*.leases  rw,
    /var/lib/libvirt/dnsmasq/*.status* rw,

    /{,var/}run/leaseshelper.pid rwk,
  }

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.sbin.dnsmasq>
}