File apparmor-traceroute.patch of Package apparmor.9786

Index: apparmor-2.8.2/profiles/apparmor.d/usr.sbin.traceroute
===================================================================
--- apparmor-2.8.2.orig/profiles/apparmor.d/usr.sbin.traceroute
+++ apparmor-2.8.2/profiles/apparmor.d/usr.sbin.traceroute
@@ -15,13 +15,16 @@
   #include <abstractions/consoles>
   #include <abstractions/nameservice>
 
+  deny capability net_admin, # noisy setsockopt() calls
   capability net_raw,
 
   network inet raw,
   network inet6 raw,
 
-  /usr/sbin/traceroute rmix,
+  /usr/sbin/traceroute mrix,
+  /usr/bin/traceroute.db mrix,
   @{PROC}/net/route r,
+  @{PROC}/sys/net/ipv4/{tcp_ecn,tcp_sack,tcp_timestamps,tcp_window_scaling} r,
 
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.traceroute>