Merge ~ahasenack/ubuntu/+source/apparmor:jammy-samba-systemd-notify into ubuntu/+source/apparmor:ubuntu/devel

[Andreas Hasenack]

samba links with libsystemd, and when started by systemd, a few more apparmor rules are needed.

The ptrace one is probably the weirdest one. Needed when poking around some /proc files. From https://man7.org/linux/man-pages/man2/ptrace.2.html#NOTES:
PTRACE_MODE_READ
              For "read" operations or other operations that are less
              dangerous, such as: get_robust_list(2); kcmp(2); reading
              /proc/[pid]/auxv, /proc/[pid]/environ, or
              /proc/[pid]/stat; or readlink(2) of a /proc/[pid]/ns/*
              file.

About the other /proc rules, the upstream apparmor bug was at first just about avahi, but then they realized other packages also need similar rules. Once they reach a consensus and create an abstraction for it, then we can drop this bit of the patch here specifically for smbd.

To test, install apparmor-profiles and restart smbd. You should only see an ALLOWED message for net_admin, which we won't grant.

[John Johansen (jjohansen)]

I am really not thrilled with some of the new rules. With that said I don't see a way to avoid them so ...

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded

diff --git a/debian/changelog b/debian/changelog
index 104f7e5..eca1b3e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+apparmor (3.0.3-0ubuntu4) jammy; urgency=medium
+
+  * d/p/u/samba-systemd-interaction.patch: allow smbd to interact with
+    systemd (LP: #1952242):
+    - allow notify access
+    - allow specific /proc access
+    - allow ptrace read
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 29 Nov 2021 14:43:28 +0000
+
 apparmor (3.0.3-0ubuntu3) jammy; urgency=medium
 
   * No-change rebuild with fixed py3versions
diff --git a/debian/patches/series b/debian/patches/series
index 0fc2ba7..de214a6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -16,3 +16,4 @@ ubuntu/libnss-systemd.patch
 ubuntu/enable-pinning-of-pre-AppArmor-3.x-poli.patch
 ubuntu/adjust-for-ibus-1.5.22.patch
 ubuntu/regression-tests-fix-aa_policy_cache-when-using-syst.patch
+ubuntu/samba-systemd-interaction.patch
diff --git a/debian/patches/ubuntu/samba-systemd-interaction.patch b/debian/patches/ubuntu/samba-systemd-interaction.patch
new file mode 100644
index 0000000..f42eaa3
--- /dev/null
+++ b/debian/patches/ubuntu/samba-systemd-interaction.patch
@@ -0,0 +1,50 @@
+Description: Allow systemd interaction
+ When started by systemd, we need to allow notify access, and access to
+ certain /proc areas.
+Origin: upstream, https://gitlab.com/apparmor/apparmor/-/merge_requests/236,
+ https://gitlab.com/apparmor/apparmor/-/merge_requests/811
+Bug: https://gitlab.com/apparmor/apparmor/-/issues/203
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1952242
+Applied-Upstream: https://gitlab.com/apparmor/apparmor/-/commit/924d4e87adbf02cafa169b3eed7892d0d35a2088,
+ https://gitlab.com/apparmor/apparmor/-/commit/ee9e61aad284f4edbebbd7cd0e8d9ac452455958
+Last-Update: 2021-11-26
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Ubuntu notes:
+ - upstream missed the smbd profile wrt access the systemd notify socket
+ - upstream merged the fix for #203 just in the avahi profile and left the bug
+   open pending discussion of adding a more generic fix as an abstraction
+--- a/profiles/apparmor.d/usr.sbin.smbd
++++ b/profiles/apparmor.d/usr.sbin.smbd
+@@ -24,12 +24,22 @@
+   capability sys_resource,
+   capability sys_tty_config,
+ 
++  # when started by systemd
++  ptrace read peer=unconfined,
++
+   /etc/mtab r,
+   /etc/netgroup r,
+   /etc/printcap r,
+   /etc/samba/* rwk,
+   @{PROC}/@{pid}/mounts r,
+   @{PROC}/sys/kernel/core_pattern r,
++
++  # https://gitlab.com/apparmor/apparmor/-/issues/203
++  # needed when smbd is started by systemd
++  @{PROC}/1/environ r,
++  @{PROC}/cmdline r,
++  @{PROC}/sys/kernel/osrelease r,
++
+   /usr/lib*/samba/vfs/*.so mr,
+   /usr/lib*/samba/auth/*.so mr,
+   /usr/lib*/samba/charset/*.so mr,
+@@ -51,6 +61,8 @@
+   @{run}/samba/ncalrpc/ rw,
+   @{run}/samba/ncalrpc/** rw,
+   @{run}/samba/smbd.pid rw,
++  # when started by systemd
++  @{run}/systemd/notify w,
+   /var/spool/samba/** rw,
+ 
+   @{HOMEDIRS}/** lrwk,