snap-confine profile uses 'include' instead of '#include' which breaks apparmor-utils python tools

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1734038

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

The /etc/apparmor.d/usr.lib.snapd.snap-confine.real file from affected system.

We believe this is a kernel/apparmor issue. The apparmor documentation (http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference#Include_statements) lists "include" as a valid include. We are happy to fix snapd but I'm sure there a many existing profiles (beside snapd from other packages or user written ones) that will break if this change lands.

Tested with snapd 2.29.3+17.10 on Artful with kernel 4.13.0-17 (the proposed one will be 4.13.0-18), this issue can be reproduced.

Could you please also include the output of "snap version" and "apt list snapd" ?

Ok this seems to be an issue with some of the basic apparmor commands not preprocessing the profiles when working on them.

If we ask apparmor to parse the file in question it is happy to do so:

apparmor_parser -p -Q /etc/apparmor.d/snap.core.3440.usr.lib.snapd.snap-confine
[...]
    # Those are discussed on https://forum.snapcraft.io/t/snapd-vs-upstream-kernel-vs-apparmor
    # and https://forum.snapcraft.io/t/snaps-and-nfs-home/

##included "/var/lib/snapd/apparmor/snap-confine.d"

    # We run privileged, so be fanatical about what we include and don't use
    # any abstractions
    /etc/ld.so.cache r,
[...]

However, it does not seem to handle this well when we use some of the associated utilities:

$ sudo aa-complain foo

ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/snap.core.3440.usr.lib.snapd.snap-confine line 15:
    include "/var/lib/snapd/apparmor/snap-confine.d" /etc/ld.so.cache r,

$ sudo aa-disable foo

ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/snap.core.3440.usr.lib.snapd.snap-confine line 15:
    include "/var/lib/snapd/apparmor/snap-confine.d" /etc/ld.so.cache r,

These errors are throwing the qrt-apparmor test suite out.

This appears to be being triggered because there are actually two independent profile parsers in apparmor. There is a C version used by the apparmor_parse which correctly interprets the 'include "xxx"' syntax and then loads the profile. There is also a python parser (in aa.py) which only seems to understand the 'include <xxx>' syntax and it is this which throws errors when running the utility commands.

> There is also a python parser (in aa.py) which only seems to understand the 'include <xxx>'
> syntax and it is this which throws errors when running the utility commands.

Exactly, that's the cause of this bug. I'll change the title to make it obvious.

Interestingly, it has been this way for years (I checked 2.9, but it probably also affects even older versions) without someone noticing it. Therefore this bug doesn't qualify as regression IMHO ;-)

Yes, the split parser has been a issue for a long time. There has been a plan to make the flex/yacc/C parser code available as a lib for the other tools but its one of those things that never gets resources allocated.

The short term fix for this is probably a backport of a newer version of the python utils.

@mvo - this is probably obvious, but if you used '#include' instead of 'include', it would side-step the issue.

We merged https://github.com/snapcore/snapd/pull/4306 which fixes this.

Since snapd is using this bug for its SRU blocker and we have bug #1733700 that is the same issue, I'm going to use this bug as the snapd one and for the apparmor one.

FYI, we discussed how to move forward on this:

* mvo will update the SRU deb in -proposed for all releases to include the fix
* mvo will create a 2.29.4.2 stable core snap
* jdstrand will perform an apparmor SRU to fix the tools (tracked in bug #1733700)

@Po-Hsu Lin and @apw - when the deb is updated, qrt should stop failing since it will have a fixed rule

When the deb and stable core snap are available, all non-snap users and all not-yet-snap users will no longer be affected by this bug.

People who have installed snaps and have a core snap >= 2.29 and < 2.29.4.2 installed will still be affected by this bug even when the deb and updated stable core snap become available until the apparmor userspace (bug #1733700) is fixed. This is because snapd keeps up to 3 revisions of snaps on the disk to support rollbacks and the earlier affected snap-confine profiles are still on disk. Until bug #1733700 is fixed, you can look in /snap/core to see what revisions are on disk, then use 'sudo snap remove core --revision=<affected revision>' to remove the older affected revisions and workaround the problem.

My Core is 16-2-.29.4.2 and I am seeing the issue as
sudo aa-complain foo

ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/snap.core.3440.usr.lib.snapd.snap-confine line 15:
    include "/var/lib/snapd/apparmor/snap-confine.d" /etc/ld.so.cache r,

@Matthew, your bug is now being tracked separately, here: https://bugs.launchpad.net/bugs/1733700

2.29.4 debs and 16-2.30 core snaps use:

  #include "/var/lib/snapd/apparmor/snap-confine.d"

This is sufficient to mark this bug Fix Released for snapd. For systems that are affected by this bug with older revisions of the core snap, please see the workaround in https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1734038/comments/15 and follow the progress in the apparmor bug: https://bugs.launchpad.net/bugs/1733700