Ubuntu
apparmor package

profile for usr.sbin.dnsmasq needs adjustment

Bug #445818 reported by C de-Avillez on 2009-10-07

This bug affects 1 person

	Status	Importance	Assigned to
AppArmor	Fix Released	Undecided	Jamie Strandboge
apparmor (Ubuntu)	Fix Released	Low	Jamie Strandboge
Karmic	Fix Released	Undecided	Jamie Strandboge
Lucid	Fix Released	Low	Jamie Strandboge

Bug Description

Binary package hint: apparmor

Currently (as of Karmic Beta, at least) usr.sbin.dnsmasq reads:

(...)
  /etc/dnsmasq.conf r,
  /usr/sbin/dnsmasq mr,
  /var/run/dnsmasq.pid w,
  /var/lib/misc/dnsmasq.leases rw, # Required only for DHCP server usage
}

The line '/var/run/dsnmasq.pid w' will reflect -- at least on my system -- the wrong interface if I am using wireless. The actual file created under /var/run has the interface name on it, like '/var/run/dsnmasq.wlan0.pid'.

c.f., messages issued by audit:

[18682.250062] b43-phy0: Loading firmware version 410.2160 (2007-05-26 15:32:10)
[18682.400783] Registered led device: b43-phy0::tx
[18682.400843] Registered led device: b43-phy0::rx
[18682.400907] Registered led device: b43-phy0::radio
[18682.492454] wlan0: Trigger new scan to find an IBSS to join
[18683.627086] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[18683.627709] CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
[18683.627716] nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
[18683.627721] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[18683.940921] type=1502 audit(1254949451.286:128): operation="mknod" pid=10379 parent=1841 profile="/usr/sbin/dnsmasq" requested_mask="w::" denied_mask="w::" fsuid=0 ouid=0 name="/var/run/nm-dnsmasq-wlan0.pid"
[18683.941005] type=1502 audit(1254949451.286:129): operation="open" pid=10379 parent=1841 profile="/usr/sbin/dnsmasq" requested_mask="w::" denied_mask="w::" fsuid=0 ouid=0 name="/var/run/nm-dnsmasq-wlan0.pid"
[18683.941124] type=1502 audit(1254949451.286:130): operation="file_perm" pid=10379 parent=1841 profile="/usr/sbin/dnsmasq" requested_mask="w::" denied_mask="w::" fsuid=0 ouid=0 name="/var/run/nm-dnsmasq-wlan0.pid"
[18686.012729] wlan0: Trigger new scan to find an IBSS to join
[18689.010238] wlan0: Trigger new scan to find an IBSS to join
[18689.982701] wlan0: Creating new IBSS network, BSSID 92:56:7a:40:52:69
[18692.560043] wlan0: no IPv6 routers present

ProblemType: Bug
Architecture: amd64
Date: Wed Oct 7 16:24:17 2009
Dependencies:

DistroRelease: Ubuntu 9.10
Package: apparmor-profiles 2.3.1+1403-0ubuntu25
ProcEnviron:
PATH=(custom, no user)
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-12.40-generic
SourcePackage: apparmor
Uname: Linux 2.6.31-12-generic x86_64

Tags:

Related branches

lp:ubuntu/lucid/apparmor

lp:ubuntu/karmic-proposed/apparmor

Revision history for this message

C de-Avillez (hggdh2) wrote on 2009-10-07:

ApparmorPackages.txt Edit (341 bytes, text/plain; charset="utf-8")
ApparmorStatusOutput.txt Edit (1.5 KiB, text/plain; charset="utf-8")
KernLog.txt Edit (1.1 MiB, text/plain; charset="utf-8")
PstreeP.txt Edit (11.0 KiB, text/plain; charset="utf-8")
XsessionErrors.txt Edit (792 bytes, text/plain; charset="utf-8")

Jamie Strandboge (jdstrand) on 2009-10-26

tags:

added: apparmor

Jamie Strandboge (jdstrand) on 2009-10-26

Changed in apparmor (Ubuntu):
importance:	Undecided → Low
status:	New → Triaged

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-10-28:

Can you add the following to your profile:
/var/run/dnsmasq*.pid w,

Then perform in a terminal:
$ sudo apparmor_parser -r -T -W /etc/apparmor.d/usr.sbin.dnsmasq

and report back if it fixes it for you?

Changed in apparmor:
assignee:	nobody → Jamie Strandboge (jdstrand)
status:	New → Fix Committed

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-11-03:

SRU REQUEST

1. dnsmasq profile does not work when using a wireless interface. Fix is trivial.

2. The fix is not in Lucid yet

3. The fix is to adjust profiles/apparmor.d/usr.sbin.dnsmasq:
- /var/run/dnsmasq.pid w,
+ /var/run/dnsmasq*.pid w,

4. TEST CASE:
- apt-get install apparmor-profiles dnsmasq
- enable the dnsmasq profile with 'aa-enforce /etc/apparmor.d/usr.sbin.dnsmasq'
- bring up a wireless interface

5. The regression potential is very low. We only allow access to files that we didn't previously have access to and the dnsmasq profile is a complain-mode file in the default install.

Jamie Strandboge (jdstrand) on 2009-11-03

Changed in apparmor (Ubuntu):
status:	Triaged → Fix Committed
assignee:	nobody → Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu Karmic):
status:	New → Fix Committed
assignee:	nobody → Jamie Strandboge (jdstrand)

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-11-03:

Uploaded apparmor_2.3.1+1403-0ubuntu27.1 to karmic-proposed.

Revision history for this message

Martin Pitt (pitti) wrote on 2009-11-03: Please test proposed package

Accepted apparmor into karmic-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags:

added: verification-needed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-11-04:

This bug was fixed in the package apparmor - 2.3.1+1403-0ubuntu28

---------------
apparmor (2.3.1+1403-0ubuntu28) lucid; urgency=low

  [ Jamie Strandboge ]
  * update skype profile in extras. Based on work by Андрей Калинин.
    (LP: #226624)
  * abstractions/ubuntu-browsers: add opera and icecat (LP: #432778)
  * abstractions/ubuntu-browsers: add epiphany (epiphany-browser and
    epiphany-webkit were already present, but the recent changes in
    epiphany packaging require /usr/bin/epiphany) (LP: #472952)
  * usr.sbin.dnsmasq: allow pidfiles for /var/run/dnsmasq*.pid (LP: #445818)
  * abstractions/gnome: allow access to ~/.themes (LP: #460125)
  * abstractions/kde: allow access to /etc/kde4rc and /usr/bin/kde4-config
    (LP: #447006)

  [ Marc Deslauriers ]
  * utils/Subdomain.pm: don't skip reading profiles that are also in the
    cache directory (LP: #446449)
  * utils/Subdomain.pm: correctly parse PUxr modes
  * utils/Subdomain.pm: support include directories

-- Jamie Strandboge <email address hidden> Wed, 04 Nov 2009 11:02:27 -0600

Changed in apparmor (Ubuntu):
status:	Fix Committed → Fix Released

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-11-04:

Updated test case:
- apt-get install apparmor-profiles dnsmasq
- enable the dnsmasq profile with 'aa-enforce /etc/apparmor.d/usr.sbin.dnsmasq'
- sudo /usr/sbin/dnsmasq -x /var/run/dnsmasq/dnsmasq.pid -u dnsmasq -7 /etc/dnsmasq.d
- sudo /usr/sbin/dnsmasq -x /var/run/nm-dnsmasq.wlan0.pid -u dnsmasq -7 /etc/dnsmasq.d

While the profile addressed the original reporter's claim that /var/run/dsnmasq.wlan0.pid is the pid to look for, looking in the attached dmesg output and doing 'sudo /etc/init.d/dnsmasq start' showed additional locations for pidfiles and config files. The updated profile should have these additions:
  capability dac_override,
  /etc/dnsmasq.d/ r,
  /etc/dnsmasq.d/* r,
  /var/run/*dnsmasq*.pid w,
  /var/run/dnsmasq/ r,
  /var/run/dnsmasq/* rw,

At present, the profile is useless without these additions, as dnsmasq won't even start when the profile is in enforce mode.

Jamie Strandboge (jdstrand) on 2009-11-04

Changed in apparmor (Ubuntu Lucid):
status:	Fix Released → In Progress

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-11-04:

apparmor_2.3.1+1403-0ubuntu27.2.debdiff Edit (1.2 KiB, text/plain)

I uploaded 2.3.1+1403-0ubuntu27.2. See the attached debdiff between 2.3.1+1403-0ubuntu27.1 and 2.3.1+1403-0ubuntu27.2.

Changed in apparmor:
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-11-04:

This bug was fixed in the package apparmor - 2.3.1+1403-0ubuntu29

---------------
apparmor (2.3.1+1403-0ubuntu29) lucid; urgency=low

  * parser/Makefile: generate af_names.h based on bits/socket.h since
    linux/socket.h no longer has what we need (LP: #474751)
  * usr.sbin.dnsmasq: fully address LP: #445818
    - more pidfile refinements
    - allow access to /var/run/dnsmasq
    - allow access to /etc/dnsmasq.d
    - allow dac_override so it can write its pidfile

-- Jamie Strandboge <email address hidden> Wed, 04 Nov 2009 17:07:23 -0600

Changed in apparmor (Ubuntu Lucid):
status:	In Progress → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-11-09:

#10

This bug was fixed in the package apparmor - 2.3.1+1403-0ubuntu27.1

---------------
apparmor (2.3.1+1403-0ubuntu27.1) karmic-proposed; urgency=low

  [ Jamie Strandboge ]
  * abstractions/ubuntu-browsers: add opera and icecat (LP: #432778)
  * abstractions/ubuntu-browsers: add epiphany (epiphany-browser and
    epiphany-webkit were already present, but the recent changes in
    epiphany packaging require /usr/bin/epiphany) (LP: #472952)
  * usr.sbin.dnsmasq: allow pidfiles for /var/run/dnsmasq*.pid (LP: #445818)
  * abstractions/gnome: allow access to ~/.themes (LP: #460125)
  * abstractions/kde: allow access to /etc/kde4rc and /usr/bin/kde4-config
    (LP: #447006)

-- Jamie Strandboge <email address hidden> Tue, 03 Nov 2009 14:30:19 -0600

Changed in apparmor (Ubuntu Karmic):
status:	Fix Committed → Fix Released

Revision history for this message

Martin Pitt (pitti) wrote on 2009-11-10:

#11

Changed in apparmor (Ubuntu Karmic):
status:	Fix Released → In Progress
status:	In Progress → Fix Committed

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-11-10:

#12

2.3.1+1403-0ubuntu27.2 allows dnsmasq to work via its initscript and the test case in comment #7.

Martin Pitt (pitti) on 2009-11-10

tags:

added: verification-done
removed: verification-needed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-11-17:

#13

This bug was fixed in the package apparmor - 2.3.1+1403-0ubuntu27.2

---------------
apparmor (2.3.1+1403-0ubuntu27.2) karmic-proposed; urgency=low

  * usr.sbin.dnsmasq: fully address LP: #445818
    - more pidfile refinements
    - allow access to /var/run/dnsmasq
    - allow access to /etc/dnsmasq.d
    - allow dac_override so it can write its pidfile

-- Jamie Strandboge <email address hidden> Wed, 04 Nov 2009 13:16:21 -0600

Changed in apparmor (Ubuntu Karmic):
status:	Fix Committed → Fix Released

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-18:

#14

I'm not sure if this is the reason why in the last update to dnsmasq it won't start during boot anymore. I have to restart the process after boot.

Revision history for this message

John Johansen (jjohansen) wrote on 2009-11-18:

#15

Jeremy,

Are you getting AppArmor rejects? They should show up in the output of dmesg.

Can you run

apport-collect -p apparmor 445818

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-18:

#16

I meant this update to apparmor stopped dnsmasq for me.

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-27: apport-collect data

#17

Architecture: amd64
DistroRelease: Ubuntu 9.10
Package: apparmor 2.3.1+1403-0ubuntu27.2
PackageArchitecture: amd64
ProcCmdline: root=UUID=af17c779-4b6b-407a-a2fe-5ffc00d6b536 ro quiet splash
ProcEnviron:
SHELL=/bin/bash
PATH=(custom, user)
LANG=en_US
LANGUAGE=en_US:en
ProcVersionSignature: Ubuntu 2.6.31-15.50-generic
Uname: Linux 2.6.31-15-generic x86_64
UserGroups: adm admin audio backup bin cdrom dialout dip disk floppy fuse games haldaemon irc klog kmem kqemu kvm libvirtd lp lpadmin mail netdev operator plugdev powerdev pulse pulse-access root rtkit sambashare sasl scanner ssh ssl-cert staff sudo sys syslog tape tty uml-net video voice www-data

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-27: ApparmorPackages.txt

#18

ApparmorPackages.txt Edit (336 bytes, text/plain)

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-27: ApparmorStatusOutput.txt

#19

ApparmorStatusOutput.txt Edit (1.0 KiB, text/plain)

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-27: Dependencies.txt

#20

Dependencies.txt Edit (1.2 KiB, text/plain)

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-27: KernLog.txt

#21

KernLog.txt Edit (5.7 KiB, text/plain)

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-27: PstreeP.txt

#22

PstreeP.txt Edit (8.7 KiB, text/plain)

Revision history for this message

Jeremy Wilkins (wjeremy) wrote on 2009-11-27: XsessionErrors.txt

#23

XsessionErrors.txt Edit (917 bytes, text/plain)

tags:

added: apport-collected

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

apparmor_2.3.1+1403-0ubuntu27.2.debdiff Edit

Add patch

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntuapparmor package

profile for usr.sbin.dnsmasq needs adjustment

Bug Description

Related branches

Other bug subscribers

Patches

Bug attachments

Remote bug watches

Ubuntu
apparmor package