Ubuntu
bind9 package

Apparmor profile blocks geoip db access

Bug #834901 reported by Dominic Benson
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
bind9 (Ubuntu)
Fix Released
Low
Unassigned

Bug Description

Using the GeoIP functionality to select a view based on origin country, the lookup fails, and the following appears in the kernel log:

type=1503 audit(1314378773.754:948): operation="open" pid=21253 parent=1 profile="/usr/sbin/named" requested_mask="::r" denied_mask="::r" fsuid=111 ouid=0 name="/usr/share/GeoIP/GeoIP.dat"

The apparmor profile installed with bind9 doesn't permit read access to the GeoIP data files in /usr/share/GeoIP

Observed in Lucid, I can't see a mention of a fix in the changelog to Natty.
bind9 version: 1:9.7.0.dfsg.P1-1ubuntu0.3

Tags: patch
Revision history for this message
Dominic Benson (dom-q) wrote :
Serge Hallyn (serge-hallyn)
Changed in bind9 (Ubuntu):
importance: Undecided → Medium
importance: Medium → Low
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "Patch to apparmor-profile to permit use of GeoIP databases" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-sponsors please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

tags: added: patch
Revision history for this message
James Page (james-page) wrote :

Will still be an issue in precise.

I think that this would be a nice addition but it might make more sense to add some documentation about how to setup this feature to this package rather than having it implicitly enabled.

Marked 'Triaged' as more that enough information for dev's to take this forward.

Changed in bind9 (Ubuntu):
status: New → Triaged
LaMont Jones (lamont)
Changed in bind9 (Ubuntu):
status: Triaged → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package bind9 - 1:9.9.3.dfsg.P2-4

---------------
bind9 (1:9.9.3.dfsg.P2-4) unstable; urgency=low

  [Peter Marschall]

  * If rndc.conf exists, skip creation of rndc.key. Closes: #620394

  [Al Tarakanoff]

  * properly quote check of pid in bind9 init.d. LP: #1092243

  [LaMont Jones]

  * include distro and package version in version string
  * apparmor: allow GeoIP data file access. LP: #834901
  * enable filter-aaaa. Closes: #701704 LP: #1115168

 -- LaMont Jones <email address hidden> Thu, 29 Aug 2013 16:22:29 -0600

Changed in bind9 (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.