no longer confined by AppArmor

This is a race between /etc/init/cups and /etc/init.d/apparmor. /etc/init/cups should include a stanza to load the AppArmor profile like all the other /etc/init services that have AppArmor profiles.

$ sudo aa-status
...
1 processes are unconfined but have a profile defined.
   /usr/sbin/cupsd (2137)

Workaround: sudo service cups restart

Kees,

thanks for pointing out. I guess for maverick we won't get around adding these extra calls to the upstart script, but this is really expensive (it starts a big perl process for each of those). For natty, is it planned to move apparmor to an upstart job, so that jobs can just wait for it to be available? Otherwise I'd just go back to using an init.d script; right now, cups starts too early for my taste, and the original reason why we moved to upstart in the first place (starting before samba) turned out to not work anyway.

Perl? What? No, it should just use the logic all the other services do. For example:

pre-start script
    [ -d /sys/module/apparmor ] || exit 0
    [ -x /sbin/apparmor_parser ] || exit 0
    /sbin/apparmor_parser -r -W /etc/apparmor.d/usr.sbin.avahi-daemon || true
end script

There will be a helper for this in natty soon, but for maverick, something like above should be backported. There are no plans to move apparmor wholesale into /etc/init because blocking on it for everything would slow too much down. Instead, individual services are responsible for loading their profiles in their init scripts.

Sorry, it should also include a test for being enabled (this is missing from avahi, but is what others are using aa-status for).

read profile < /sys/kernel/security/apparmor/profiles || true
[ -z "$profile" ] && exit 0 # quit if disabled

(Or not, since this is early-boot and there may be no profiles loaded yet, so we should skip that test.)

Helper script for upstart is now bug 692801.

This bug was fixed in the package cups - 1.4.5-1ubuntu5

---------------
cups (1.4.5-1ubuntu5) natty; urgency=low

  * Use AppArmor profile loading helper (LP: #690040):
    - debian/patches/ubuntu-upstart.dpatch: load profile.
    - debian/control: Depend on upstart.
 -- Kees Cook <email address hidden> Mon, 03 Jan 2011 17:16:27 -0800

I have uploaded an updated package using the attached debdiff to the security PPA.

This bug was fixed in the package cups - 1.4.4-6ubuntu2.3

---------------
cups (1.4.4-6ubuntu2.3) maverick-security; urgency=low

  * ubuntu-upstart.dpatch: update to explicitly load the AppArmor profile
    to avoid race condition where cups could load before AppArmor and run
    unconfined (LP: #690040)
 -- Jamie Strandboge <email address hidden> Tue, 04 Jan 2011 09:52:12 -0600