Ubuntu
apparmor package

aa-logprof doesn't generate policy due to missing abstractions/apache2-common

Bug #539441 reported by thosjo
30
This bug affects 4 people
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Fix Released
Undecided
Jamie Strandboge
Lucid
Fix Released
Undecided
Marc Deslauriers
Maverick
Fix Released
Undecided
Jamie Strandboge
Natty
Fix Released
Undecided
Jamie Strandboge

Bug Description

SRU Justification

1. impact of the bug is medium for stable releases since aa-logprof is rendered inoperable when apparmor-profiles is installed

2. This has been addressed in the development branch

3. Patch is in packaging and consists of shipping apache2-common in apparmor.

4. TEST CASE:
$ sudo apt-get remove --purge apparmor # only if downgraded first
$ sudo apt-get install apparmor apparmor-utils apparmor-profiles
$ sudo aa-logprof
Can't find include file abstractions/apache2-common: No such file or directory

A fixed package will not have the above error.

5. The regression potential of the patch is very low, as it only moves apache2-common to the apparmor package.

Initial Report:

Binary package hint: apparmor

aa-logprof doesn't generate (or modify) policies due to missing abstractions/apache2-common

~# aa-logprof
Can't find include file abstractions/apache2-common: No such file or directory
~#

Audit messages are present in the log file:

~# grep audit /var/log/messages | tail -n 10
Mar 16 09:53:57 panopticon kernel: [ 2117.122866] type=1502 audit(1268729637.896:3405): operation="file_perm" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="r::" denied_mask="r::" fsuid=0 ouid=0 name="/etc/cups/cupsd.conf"
Mar 16 09:53:57 panopticon kernel: [ 2117.122978] type=1502 audit(1268729637.896:3406): operation="open" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="r::" denied_mask="r::" fsuid=0 ouid=0 name="/etc/papersize"
Mar 16 09:53:57 panopticon kernel: [ 2117.122989] type=1502 audit(1268729637.896:3407): operation="file_perm" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="r::" denied_mask="r::" fsuid=0 ouid=0 name="/etc/papersize"
Mar 16 09:54:28 panopticon kernel: [ 2147.329908] type=1502 audit(1268729668.105:3738): operation="rename_src" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="rw::" denied_mask="rw::" fsuid=0 ouid=0 name="/etc/cups/printers.conf"
Mar 16 09:54:28 panopticon kernel: [ 2147.329916] type=1502 audit(1268729668.105:3739): operation="rename_dest" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="wc::" denied_mask="wc::" fsuid=0 ouid=0 name="/etc/cups/printers.conf.O"
Mar 16 09:54:28 panopticon kernel: [ 2147.329970] type=1502 audit(1268729668.105:3740): operation="mknod" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="c::" denied_mask="c::" fsuid=0 ouid=0 name="/etc/cups/printers.conf"
Mar 16 09:54:28 panopticon kernel: [ 2147.329987] type=1502 audit(1268729668.105:3741): operation="open" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="wc::" denied_mask="wc::" fsuid=0 ouid=0 name="/etc/cups/printers.conf"
Mar 16 09:54:28 panopticon kernel: [ 2147.330006] type=1502 audit(1268729668.105:3742): operation="chown" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="w::" denied_mask="w::" fsuid=0 ouid=0 name="/etc/cups/printers.conf"
Mar 16 09:54:28 panopticon kernel: [ 2147.330021] type=1502 audit(1268729668.105:3743): operation="chmod" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="w::" denied_mask="w::" fsuid=0 ouid=0 name="/etc/cups/printers.conf"
Mar 16 09:54:28 panopticon kernel: [ 2147.330062] type=1502 audit(1268729668.105:3744): operation="file_perm" pid=2983 parent=1 profile="/usr/sbin/cupsd" requested_mask="w::" denied_mask="w::" fsuid=0 ouid=0 name="/etc/cups/printers.conf"

~# lsb_release -a
LSB Version: core-2.0-ia32:core-2.0-noarch:core-3.0-ia32:core-3.0-noarch:core-3.1-ia32:core-3.1-noarch:core-3.2-ia32:core-3.2-noarch:core-4.0-ia32:core-4.0-noarch
Distributor ID: Ubuntu
Description: Ubuntu lucid (development branch)
Release: 10.04
Codename: lucid

~# dpkg -l |grep appar
ii apparmor 2.5-0ubuntu1 User-space parser utility for AppArmor
ii apparmor-profiles 2.5-0ubuntu1 Profiles for AppArmor Security policies
ii apparmor-utils 2.5-0ubuntu1 Utilities for controlling AppArmor
ii libapparmor-perl 2.5-0ubuntu1 AppArmor library Perl bindings
ii libapparmor1 2.5-0ubuntu1 changehat AppArmor library

See original description
Marc Deslauriers (mdeslaur)
Changed in apparmor (Ubuntu):
assignee: nobody → Marc Deslauriers (mdeslaur)
status: New → Confirmed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.5-0ubuntu2

---------------
apparmor (2.5-0ubuntu2) lucid; urgency=low

  [ Jamie Strandboge ]
  * debian/patches/0001-lp538561.patch: add 'k' to /var/lib/samba/**.tdb in
    the samba abstraction (LP: #538561)

  [ Marc Deslauriers ]
  * debian/patches/0002-aalogprof-warnings.patch: get rid of warnings when
    aa-logprof is run.
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put apache2 profiles into the -profiles package without
    aa-logprof bailing out. (LP: #539441)
  * debian/patches/0003-fix-memleaks.patch: include a couple of leak
    patches from upstream.
 -- Marc Deslauriers <email address hidden> Fri, 26 Mar 2010 11:39:18 -0400

Changed in apparmor (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

This crept back into Maverick due to the bzr branches forking and the commit not getting applied to ubuntu-trunk (which eventually ended up maverick's branch).

Changed in apparmor (Ubuntu Lucid):
assignee: nobody → Marc Deslauriers (mdeslaur)
status: New → Fix Released
Changed in apparmor (Ubuntu Natty):
assignee: Marc Deslauriers (mdeslaur) → Jamie Strandboge (jdstrand)
status: Fix Released → Triaged
Changed in apparmor (Ubuntu Maverick):
status: New → Triaged
assignee: nobody → Jamie Strandboge (jdstrand)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.5.1-0ubuntu2

---------------
apparmor (2.5.1-0ubuntu2) natty; urgency=low

  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put apache2 profiles into the -profiles package without
    aa-logprof bailing out. Patch by Marc Deslauriers.
    (LP: #539441)
 -- Jamie Strandboge <email address hidden> Tue, 19 Oct 2010 15:44:43 -0500

Changed in apparmor (Ubuntu Natty):
status: Triaged → Fix Released
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Uploaded 2.5.1-0ubuntu0.10.10.1 to maverick-proposed.

Changed in apparmor (Ubuntu Maverick):
status: Triaged → In Progress
Revision history for this message
Martin Pitt (pitti) wrote : Please test proposed package

Accepted apparmor into maverick-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in apparmor (Ubuntu Maverick):
status: In Progress → Fix Committed
tags: added: verification-needed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Upgraded to 2.5.1-0ubuntu0.10.10.2 and this issue is resolved.

description: updated
Jamie Strandboge (jdstrand)
description: updated
Martin Pitt (pitti)
tags: added: verification-donee
removed: verification-needed
tags: added: verification-done
removed: verification-donee
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.5.1-0ubuntu0.10.10.2

---------------
apparmor (2.5.1-0ubuntu0.10.10.2) maverick-proposed; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0004-ubuntu-abstractions-updates.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put apache2 profiles into the -profiles package without
    aa-logprof bailing out. Patch by Marc Deslauriers.
    (LP: #539441)
  * debian/patches/0009-sensible-browser-pix.patch: use Pix with
    sensible-browser
  * debian/patches/0010-ubuntu-buildd.patch: skip parser caching test if
    the AppArmor securityfs introspection directory is not mounted, as
    is the case on Ubuntu buildds.
 -- Jamie Strandboge <email address hidden> Tue, 02 Nov 2010 12:04:06 -0500

Changed in apparmor (Ubuntu Maverick):
status: Fix Committed → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

Accepted apparmor into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags: removed: verification-done
tags: added: verification-needed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Upgraded to 2.5.1-0ubuntu0.10.04.1 in lucid-proposed and there is no regression (ie, aa-logprof behaves the same before and after the upgrade).

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

(This bug only affected maverick, btw).

tags: added: verification-done
removed: verification-needed
Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu Lucid):
status: Fix Released → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (10.1 KiB)

This bug was fixed in the package apparmor - 2.5.1-0ubuntu0.10.04.1

---------------
apparmor (2.5.1-0ubuntu0.10.04.1) lucid-proposed; urgency=low

  * Backport 2.5.1-0ubuntu0.10.10.1 from maverick for userspace tools to work
    with newer kernels (LP: #660077)
    NOTE: user-tmp now uses 'owner' match, so non-default profiles will have
    to be adjusted when 2 separately confined applications that both use the
    user-tmp abstraction depend on being able to cooperatively share files
    with each other in /tmp or /var/tmp.
  * remove the following patches (features not appropriate for SRU):
    - 0002-add-chromium-browser.patch
    - 0003-local-includes.patch
    - 0004-ubuntu-abstractions-updates.patch
  * debian/rules (this makes it the same as what was shipped in 10.04 LTS
    release):
    - don't ship aa-update-browser and its man page (requires
      0004-ubuntu-abstractions-updates.patch)
    - don't ship apparmor.d/local/ (requires 0003-local-includes.patch)
    - don't use dh_apparmor (not in Ubuntu 10.04 LTS)
    - don't ship chromium profile
  * remove debian/profiles/chromium-browser
  * remove debian/aa-update-browser*
  * debian/apparmor-profiles.postinst: revert to that in lucid release
    (requires dh_apparmor and 0002-add-chromium-browser.patch)
  * remove debian/apparmor-profiles.postrm: doesn't make sense without
    0002-add-chromium-browser.patch
  * debian/control:
    - revert Build-Depends on debhelper (>= 5)
    - revert Standards-Version to 3.8.4
    - revert Vcs-Bzr
    - use Conflicts/Replaces version that was in Ubuntu 10.04 LTS
  * debian/patches/0011-lucid-compat-dbus.patch: move /var/lib/dbus/machine-id
    back into dbus, since profiles on 10.04 LTS expect it there
  * debian/patches/0012-lucid-compat-kde.patch: add kde4-config to kde
    abstraction, since the firefox profile on Ubuntu 10.04 LTS expects it to
    be there

apparmor (2.5.1-0ubuntu0.10.10.2) maverick-proposed; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0004-ubuntu-abstractions-updates.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put ...

Changed in apparmor (Ubuntu Lucid):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.