please add /etc/mdns.allow to /etc/apparmor.d/abstractions/mdns

As a workaround, hanging /etc/apparmor.d/local/usr.sbin.chronyd to include

   /etc/mdns.allow r,

and reloading with

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.chronyd

made it shut up.

Hi,
/etc/apparmor.d/usr.sbin.chronyd has

  #include <abstractions/nameservice>

And thereby should have:
/etc/apparmor.d/abstractions/nameservice: #include <abstractions/mdns>

Which in turn defines:
/etc/apparmor.d/abstractions/mdns: # mdnsd
/etc/apparmor.d/abstractions/mdns: /etc/nss_mdns.conf r,
/etc/apparmor.d/abstractions/mdns: /{,var/}run/mdnsd w,

There is no mdns.allow but if that is a common thing for mdns we should add the rule.
The file belongs to apparmor itself and I think that abstraction would need a fix:
  apparmor: /etc/apparmor.d/abstractions/mdns

It seems it is a common pattern, see
https://github.com/lathiat/nss-mdns#etcmdnsallow

Therefore this bug IMHO is actually: "please add /etc/mdns.allow to /etc/apparmor.d/abstractions/mdns"

I'll modify it accordingly, but please speak up if you disagree.

Since this potentially hits any apparmor isolated application using nameservices I'd mark it as critical until the security Team explains why it is not. OTOH such a one line addition should be easily done in apparmor.

This problem is indeed somewhat pervasive, I also filed bug 1869632 on cups-browsed doing the same thing, for the same reason. I suspect more will pop up. I don't think libnss_mdns is too widely used, most people would use libnss_mdns_minimal. I only have to use libnss_mdns because my ISP is insane. If this bug were fixed by adding /etc/mdns.allow to /etc/apparmor.d/abstractions/mdns bug 1869632 would be fixed as well (I've verified this by patching it on my system.)

Not sure why /etc/apparmor.d/abstractions/mdns contains /etc/nss_mdns.conf, though: libnss_mdns.so.2 doesn't refer to that file (it appears to be used in the NetBSD implementation?)

Hi Rich,
thanks for your continued help - yes I agree that we need to fix this in the apparmor abstraction and not each individual other affected package.

FYI: I pinged jjohansen yesterday and he said he will make an upload ready and will ask jdstrand to sponsor it. I subscribed them both here now to make that clear.

This is a debdiff for focal applicable to apparmor_2.13.3-7ubuntu2

It is picked from upstream, and has been through upstream build and checks.

It seems Rich has already requested the same change upstream after we identified it is not chrony but a general issue. That is great that allowed to backport an official commit.

Thanks jjohansen for making the debdiff of that.

I polished the dep3 headers and changelog a bit to fit in lines and be more detailed.
But other than that +1 and sponsored.

Not quite, I pulled Rich's patch from here and pushed it through upstream first so we could have an official commit.

That way debian can pick it up as well.

The attachment "apparmor-mdns-fix.patch" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

@lathiat, added you FYI only

This also has a snapd task, which I've added and assigned to myself. This can happen as part of the normal snapd update process.

@Jamie/John - did you let this upload cancel from focal-unapproved?
It was, but is no more in -unapproved - but it also does not show up in -proposed.
I'm confused and was wondering if this was lost in work of the release-team or if you cancelled (and plan to re-upload) it intentionally?

Lol - sorry for the noise after seeing another case like that I had to realize that focal-unapproved just is multiple pages now :-)
It is on the second page still waiting for the release team to accept after beta is out.

This bug was fixed in the package apparmor - 2.13.3-7ubuntu3

---------------
apparmor (2.13.3-7ubuntu3) focal; urgency=medium

  * Add upstream-abstractions-add-etc-mdns.allow-to-etc-apparmor.d-ab.patch
    (LP: #1869629)

 -- John Johansen <email address hidden> Wed, 01 Apr 2020 01:05:30 -0700

FYI, I submitted https://github.com/snapcore/snapd/pull/8443 for this.

I'm marking this as fix released based on the history of the referenced pull request.