Ubuntu
apparmor package

SubDomain.pm does not know about truncate, rename_src, and rename_dest operations

Bug #623467 reported by Steve Beattie
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor
Fix Released
High
Unassigned
apparmor (Ubuntu)
Fix Released
High
Unassigned
Lucid
Fix Released
High
Unassigned
Ubuntu lucid-updates

Bug Description

SRU

1. Impact: affects ability of users/administrators trying to create or adjust their apparmor policies.

2. Fixed in natty

3. Patch to SubDomain.pm is small (other portions of the patch add testcases to the log parsing library to confirm that they handle the corresponding apparmor event messages) and adds four tests to an if-clause. See http://bazaar.launchpad.net/~apparmor-dev/apparmor/release-2.5/revision/1432 for upstream commit.

4. TEST CASE

(1) Add the attached empty test profile for /does/not/exist (named does.not.exist) to /etc/apparmor.d
(2) Reload apparmor policy via "sudo /etc/init.d/apparmor reload"
(3) Copy the test logfile to /tmp
(4) Run logprof on the test logfile; e.g. "sudo logprof -f /tmp/testlog"

In the unfixed version, logprof will not prompt the user for any rejections (it may ask about using the repository, answer disable or later). In the fixed version, logprof should ask about three different rejections:

  /var/lib/update-notifier/release-upgrade-available
  /var/run/motd
  /var/run/motd.new

(select allow each time)

5. Regression potential is low, as the patch adds additional cases to the apparmor perl library; it can only affect the tools used to adjust apparmor profiles.

Binary package hint: apparmor

While developing a test profile(s) for sshd on lucid using logprof/genprof, the following rejections in dmesg were never processed by the tools:

  [ 878.662172] type=1503 audit(1282626827.320:411): operation="truncate" pid=1957 parent=1 profile="/etc/update-motd.d/91-release-upgrade" requested_mask="w::" denied_mask="w::" fsuid=0 ouid=0 name="/var/lib/update-notifier/release-upgrade-available"
  [ 878.663410] type=1502 audit(1282626827.320:412): operation="rename_src" pid=1881 parent=650 profile="/usr/sbin/sshd" requested_mask="r::" denied_mask="r::" fsuid=0 ouid=0 name="/var/run/motd.new"
  [ 878.663418] type=1502 audit(1282626827.320:413): operation="rename_dest" pid=1881 parent=650 profile="/usr/sbin/sshd" requested_mask="wc::" denied_mask="wc::" fsuid=0 ouid=0 name="/var/run/motd"

I first looked at the log parsing library under the assumption that it didn't understand these operations. After adding testcases for each message, I confirmed that it does indeed understand them and parses them properly. Looking at SubDomain.pm, however, it does not know about these additional operation types.

See original description

Related branches

lp:ubuntu/maverick/apparmor
Revision history for this message
Steve Beattie (sbeattie) wrote :

It also appears that the operations mkdir, link, and unlink are not covered by SubDomain.pm.

Jamie Strandboge (jdstrand)
Changed in apparmor:
status: New → Triaged
Changed in apparmor (Ubuntu):
status: New → Triaged
importance: Undecided → High
Changed in apparmor:
importance: Undecided → High
Revision history for this message
Steve Beattie (sbeattie) wrote :

This has been partially fixed in upstream trunk rev 1475 which fixes the truncate, rename_src, rename_dest, and mkdir cases. The link, unlink and possibly other operation still need to be covered.

Revision history for this message
Colin Watson (cjwatson) wrote :

apparmor (2.5.1~rc1-0ubuntu1) maverick; urgency=low

  [ Jamie Strandboge ]
  * New upstream RC release (revision 1413). In addition to getting the tools
    to work with the maverick kernel, this update fixes:
    - LP: #619521
    - LP: #633369
    - LP: #626451
    - LP: #581525
    - LP: #623467 (link and unlink still need to be addressed)
  * Dropped the following patches, included upstream:
    - 0002-lp615177.patch
    - 0004-ubuntu-pux.patch
    - 0006-kde4-config-pux.patch
    - 0007-lp605835.patch
    - 0012-lp625041.patch
    - 0013-lp623586.patch
  * Update the following patches:
    - rename 0010-fix-release.patch as 0001-fix-release.patch since this will
      likely always need to be here
    - rename 0005-add-chromium-browser.patch as
      0002-add-chromium-browser.patch
    - rename 0001-local-includes.patch as 0003-local-includes.patch and update
      to use r1493 (from trunk) of local/README file. This can be dropped in
      2.6.
    - collect the ubuntu abstractions updates pulled from trunk into
      0004-ubuntu-abstractions-updates.patch. This can be dropped in 2.6.
    - rename 0008-lp601583.patch as 0005-lp601583.patch. This can be dropped
      in 2.5.1 final.
  * fix up some lintian warnings:
    - debian/control:
      + don't use 'Section' in apparmor-notify, since it is the same as the
        source
      + updates Standards-Version to 3.9.1
      + add ${misc:Depends} to libapparmor-dev and apparmor-notify
    - add debian/source/format
    - debian/libapache2-mod-apparmor.postrm: use #DEBHELPER#
    - debian/libapache2-mod-apparmor.preinst: use #DEBHELPER#
    - add debian/watch
  * debian/notify/notify.conf: set show_notifications="yes" by default
  * debian/patches/0006-network-interface-enumeration.patch: allow network
    interface enumeration. This can be dropped in 2.5.1 final.
  * debian/patches/0007-gnome-updates.patch: update for font/icon/mime
    locations in current gnome. This can be dropped in 2.5.1 final.

  [ Kees Cook ]
  * debian/apparmor.init: rename "stop" to "teardown", drop caches on
    "stop" and warn about the dangers of "teardown".

 -- Jamie Strandboge <email address hidden> Fri, 10 Sep 2010 11:07:19 -0500

Changed in apparmor (Ubuntu):
status: Triaged → Fix Released
Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu Lucid):
importance: Undecided → High
milestone: none → lucid-updates
status: New → In Progress
Revision history for this message
Steve Beattie (sbeattie) wrote :

Empty test profile

description: updated
description: updated
Revision history for this message
Steve Beattie (sbeattie) wrote :

Test log file.

Revision history for this message
Martin Pitt (pitti) wrote : Please test proposed package

Accepted apparmor into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in apparmor (Ubuntu Lucid):
status: In Progress → Fix Committed
tags: added: verification-needed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Upgraded to 2.5.1-0ubuntu0.10.04.1 in lucid-proposed and this issue is resolved.

Martin Pitt (pitti)
tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (10.1 KiB)

This bug was fixed in the package apparmor - 2.5.1-0ubuntu0.10.04.1

---------------
apparmor (2.5.1-0ubuntu0.10.04.1) lucid-proposed; urgency=low

  * Backport 2.5.1-0ubuntu0.10.10.1 from maverick for userspace tools to work
    with newer kernels (LP: #660077)
    NOTE: user-tmp now uses 'owner' match, so non-default profiles will have
    to be adjusted when 2 separately confined applications that both use the
    user-tmp abstraction depend on being able to cooperatively share files
    with each other in /tmp or /var/tmp.
  * remove the following patches (features not appropriate for SRU):
    - 0002-add-chromium-browser.patch
    - 0003-local-includes.patch
    - 0004-ubuntu-abstractions-updates.patch
  * debian/rules (this makes it the same as what was shipped in 10.04 LTS
    release):
    - don't ship aa-update-browser and its man page (requires
      0004-ubuntu-abstractions-updates.patch)
    - don't ship apparmor.d/local/ (requires 0003-local-includes.patch)
    - don't use dh_apparmor (not in Ubuntu 10.04 LTS)
    - don't ship chromium profile
  * remove debian/profiles/chromium-browser
  * remove debian/aa-update-browser*
  * debian/apparmor-profiles.postinst: revert to that in lucid release
    (requires dh_apparmor and 0002-add-chromium-browser.patch)
  * remove debian/apparmor-profiles.postrm: doesn't make sense without
    0002-add-chromium-browser.patch
  * debian/control:
    - revert Build-Depends on debhelper (>= 5)
    - revert Standards-Version to 3.8.4
    - revert Vcs-Bzr
    - use Conflicts/Replaces version that was in Ubuntu 10.04 LTS
  * debian/patches/0011-lucid-compat-dbus.patch: move /var/lib/dbus/machine-id
    back into dbus, since profiles on 10.04 LTS expect it there
  * debian/patches/0012-lucid-compat-kde.patch: add kde4-config to kde
    abstraction, since the firefox profile on Ubuntu 10.04 LTS expects it to
    be there

apparmor (2.5.1-0ubuntu0.10.10.2) maverick-proposed; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0004-ubuntu-abstractions-updates.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put ...

Changed in apparmor (Ubuntu Lucid):
status: Fix Committed → Fix Released
Leif Atle Vold (lvold7355)
Changed in apparmor:
assignee: nobody → Leif Atle Vold (lvold7355)
Changed in apparmor (Ubuntu):
assignee: nobody → Leif Atle Vold (lvold7355)
Changed in apparmor:
status: Triaged → Incomplete
Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu):
assignee: Leif Atle Vold (lvold7355) → nobody
Changed in apparmor:
assignee: Leif Atle Vold (lvold7355) → nobody
status: Incomplete → Fix Released
Ubuntu Foundations Team Bug Bot (crichton)
tags: added: testcase
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.