[Touch-packages] [Bug 2110066] Re: Online Accounts error when adding a Google account with non-snap Firefox

2025-05-22 Thread Ryan Lee
Could you share the contents of /etc/apparmor.d/firefox from your system? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2110066 Title: Online Accounts error when adding

[Touch-packages] [Bug 2111205] Re: fusermount3 profile blocks libfuse module in flatpak

2025-05-20 Thread Ryan Lee
** Tags added: sec-6337 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2111205 Title: fusermount3 profile blocks libfuse module in flatpak Status in apparmor package in

[Touch-packages] [Bug 2110236] Re: [SRU] fixes for AppArmor in Plucky

2025-05-15 Thread Ryan Lee
Updated debdiff with changelog updated based on feedback. ** Description changed: [ Impact ] This SRU contains fixes for a number of bugs: - * The unprivileged_userns profile did not have access to the root directory (https://gitlab.com/apparmor/apparmor/-/issues/505) + * The unprivileg

[Touch-packages] [Bug 2110688] [NEW] apparmor parser incorrectly treats norelatime mount flag as a no-op

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] The parser did not handle the norelatime mount flag correctly, essentially treating its addition to a list of mount flags as a no-op. A test should also be included to ensure that the behavior is fixed and not broken again. [ Test Plan ] This bug is caught by an

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + + The remmina profile is missing a bunch of rules that would be needed in + order to allow usage of all its functionality. As such, we will need to + pull the remmina profile from Plucky to avoid breaking its usages. + + [ Test Plan

[Touch-packages] [Bug 2110630] [NEW] apparmor.d man page contains incorrect information about mount flag combinations

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] The apparmor.d man page contained incorrect information about the combination of mount options=(list) options in (list), so this documentation should be fixed, and a test included to ensure that the documented behavior matches the actual behavior. [ Test Plan ] C

[Touch-packages] [Bug 2107596] Re: Apparmor is missing rule for openvpn to set DNS domain

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + + The openvpn profile lacked permissions to manage DNS settings for pushed + DHCP settings (LP: #2107596) + + [ Test Plan ] + + * This test description assumes no access to existing machines that use OpenVPN. Additional testing of

[Touch-packages] [Bug 2110628] [NEW] apparmor profiles need mr permissions on their own binaries for execution from a confined context

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] Various commands segfaulted when run from a confined context due to missing permissions on the binary execution path, and their corresponding profiles need rules to give m+r permissions for the binaries themselves. [ Test Plan ] * Add the following to a new file

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-14 Thread Ryan Lee
** Description changed: + [ Impact ] + + iotop-c failed to launch at all due to permission denials in nl_init and + missing capabilities in the iotop-c profile. + + [ Test Plan ] + + * Launch iotop-c under sudo (make sure to invoke iotop-c directly instead of iotop, which might be symlinked t

[Touch-packages] [Bug 2110626] [NEW] apparmor fusermount3 profile disallows noatime flag, breaking fuse-overlayfs

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] fusermount3 lacked permissions to mount with noatime, which is needed to use fuse_overlayfs. [ Test Plan ] After installation of the new AppArmor version, the machine might need to be rebooted. If a reboot between installation and test plan execution is needed fo

[Touch-packages] [Bug 2109029] Re: AppArmor OpenVPN profile blocks mDNS lookups

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + Configuration of an OpenVPN client with a "remote some_hostname.local" rule on Plucky fails because the OpenVPN profile does not allow access to /run/avahi-daemon/socket for mDNS lookups. + + [ Test Plan ] + + Test plan for th

[Touch-packages] [Bug 2110624] [NEW] apparmor fusermount3 profile blocks mounts to /cvmfs/ subdirectories

2025-05-14 Thread Ryan Lee
Public bug reported: SRU Justification: [ Impact ] fusermount3 lacked permissions to mount to /cvmfs subdirectories, breaking usage of the CernVM FS. [ Test Plan ] * The following instructions are adapted from https://cvmfs.readthedocs.io/en/stable/cpt-quickstart.html - Install the cvmfs

[Touch-packages] [Bug 2107723] Re: Using KDE Plasma widget "Web Browser" kill Plasma desktop due to QtWebEngine and AppArmor restrictions

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + + The plasmashell profile was missing the new path to QtWebEngineProcess, + causing the entire desktop environment to crash upon attempted usage of + the Web Browser widget. + + [ Test Plan ] + + This test needs to be executed on a

[Touch-packages] [Bug 2110616] [NEW] apparmor unprivileged_userns profile missing access to /

2025-05-14 Thread Ryan Lee
or automatically during an batch unattended upgrade) would result in end users not getting this fix. [ Other Info ] This bug was originally reported at https://gitlab.com/apparmor/apparmor/-/issues/505. ** Affects: apparmor (Ubuntu) Importance: Undecided Assignee: Ryan Lee (rlee287

[Touch-packages] [Bug 2107455] Re: segfault of lsblk s390x in containers due to apparmor

2025-05-14 Thread Ryan Lee
** Description changed: SRU Justification: [ Impact ] - * lsblk on an s390x system that uses DASD disks shows no output. - - * journactl shows lsblk is blocked by apparmor: -2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 -audit(1744729346.034:270): appar

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-13 Thread Ryan Lee
** Description changed: SRU Justification: [ Impact ]  * lsblk on an s390x system that uses DASD disks shows no output.  * journactl shows lsblk is blocked by apparmor:    2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400    audit(1744729346.034:270): appar

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-13 Thread Ryan Lee
** Description changed: SRU Justification: [ Impact ] - * lsblk on an s390x system that uses DASD disks shows no output. - - * journactl shows lsblk is blocked by apparmor: -2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 -audit(1744729346.034:270): appa

[Touch-packages] [Bug 2107455] Re: segfault of lsblk s390x in containers due to apparmor

2025-05-13 Thread Ryan Lee
The root cause of this issue is not related to the unprivileged_userns, and this was instead an instance of a more general problem we found involving profiles on applications and rules required for exec transitions from confined. I'll replace the test plan with one corresponding to the root cause i

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-13 Thread Ryan Lee
It's not quite correct, because the underlying bug isn't due to the unprivileged_userns profile but is instead due to the lsblk profile, but I can fix that part of the text myself. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed

[Touch-packages] [Bug 2109707] Re: apparmor openvpn pritunl problem

2025-05-08 Thread Ryan Lee
** Tags added: sec-6302 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2109707 Title: apparmor openvpn pritunl problem Status in apparmor package in Ubuntu: New Bug d

[Touch-packages] [Bug 2110236] Re: [SRU] fixes for AppArmor in Plucky

2025-05-08 Thread Ryan Lee
The proposed uploaded for Plucky is also available at https://launchpad.net/~rlee287/+archive/ubuntu/apparmor- staging/+packages in a PPA. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launch

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-08 Thread Ryan Lee
** Changed in: util-linux (Ubuntu Plucky) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107402 Title: lsblk on IBM z Systems blocked by ap

[Touch-packages] [Bug 2110236] [NEW] [SRU] fixes for AppArmor in Plucky

2025-05-08 Thread Ryan Lee
Public bug reported: [ Impact ] This SRU contains fixes for a number of bugs: * The unprivileged_userns profile did not have access to the root directory (https://gitlab.com/apparmor/apparmor/-/issues/505) * lsblk could not list DASD devices on IBM System Z (LP: #2107402) * Various commands s

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-06 Thread Ryan Lee
** Tags added: sec-6287 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107727 Title: iotop-c: Call of nl_init fails due to insufficient rights Status in apparmor packag

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-06 Thread Ryan Lee
I was able to reproduce and confirm this bug, which will need fixing in the apparmor package. In the meantime, you can add the rule "network netlink raw," to /etc/apparmor.d/local/iotop-c and reboot, as a workaround. -- You received this bug notification because you are a member of Ubuntu Touch

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-06 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed ** Changed in: iotop-c (Ubuntu) Status: Confirmed => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.n

[Touch-packages] [Bug 2109707] Re: apparmor openvpn pritunl problem

2025-04-30 Thread Ryan Lee
Can you please attach logs with AppArmor denial information as well as additional information (beyond "not working anymore") that could help us reproduce the failures locally? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ap

[Touch-packages] [Bug 2109029] [NEW] AppArmor OpenVPN profile blocks mDNS lookups

2025-04-24 Thread Ryan Lee
Public bug reported: Configuration of an OpenVPN client with a "remote some_hostname.local" rule on Plucky fails because the OpenVPN profile does not allow access to /run/avahi-daemon/socket for mDNS lookups. ** Affects: apparmor (Ubuntu) Importance: Undecided Status: New -- You r

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-04-24 Thread Ryan Lee
Upon further investigation, it turns out that the remmina profile is missing other rules as well and needs to be expanded to handle e.g. keyed SSH connections. As such, we have decided to pull the remmina profile from Plucky. -- You received this bug notification because you are a member of Ubunt

[Touch-packages] [Bug 2107402] Re: lsblk blocked by apparmor in 25.04

2025-04-15 Thread Ryan Lee
This is a problem with the lsblk profile shipped by AppArmor and not a problem with the util-linux package. I am not super familiar with IBM z Systems, but I think the path that would need to be added is /sys/devices/css0/**. @fheimes could you confirm whether this path always includes "css0" as op

[Touch-packages] [Bug 2107402] Re: lsblk blocked by apparmor in 25.04

2025-04-15 Thread Ryan Lee
** Changed in: util-linux (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107402 Title: lsblk blocked by apparmor in 25.04 Status

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-04-11 Thread Ryan Lee
Updating statuses (again) to reflect that there should no longer be an active wpa_supplicant profile on Plucky, and to request that people still running into issues attach the contents of their /etc/apparmor.d/wpa_supplicant, which should no longer exist. ** Changed in: wpa (Ubuntu) Status:

[Touch-packages] [Bug 2106311] Re: File picker does not work in browsers in Ubuntu 25.04 beta for SSSD users

2025-04-10 Thread Ryan Lee
** Tags added: sec-6112 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2106311 Title: File picker does not work in browsers in Ubuntu 25.04 beta for SSSD users Status

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-04-07 Thread Ryan Lee
Can you please share 1) the version of the AppArmor package you now have installed, 2) the contents of /etc/apparmor.d/remmina, and 3) the AppArmor denial log from the syslog (which should have something like "dbus-daemon[3722]: apparmor="DENIED""? -- You received this bug notification because yo

[Touch-packages] [Bug 2105840] Re: apparmor shell script string comparison error

2025-04-04 Thread Ryan Lee
Also found by LP: #2102680. Fixes are in Plucky but will need to be backported to Noble and Oracular -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2105840 Title: apparmo

[Touch-packages] [Bug 2106174] [NEW] aa-notify's userns_special_profiles default missing unprivileged_userns

2025-04-03 Thread Ryan Lee
cided Assignee: Ryan Lee (rlee287) Status: New ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.

[Touch-packages] [Bug 2106177] [NEW] aa-notify's default configuration breaks the userns restriction by suggesting capabilities addition to unprivileged_userns

2025-04-03 Thread Ryan Lee
Public bug reported: The default configuration of aa-notify does not have any filtering on the notifications that it pops up, resulting in notifications that suggest adding capabilities to unprivileged_userns, circumventing and breaking the AppArmor userns restrictions. Since Plucky is very close

[Touch-packages] [Bug 2092232] Re: unable to deploy Plucky Puffin due to AppArmor lsblk denials

2025-04-03 Thread Ryan Lee
** Summary changed: - not able to deploy Plucky Puffin + unable to deploy Plucky Puffin due to AppArmor lsblk denials -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2092232

[Touch-packages] [Bug 2102680] Re: Installation of AppArmor on a 6.14 kernel produces error message "Illegal number: yes"

2025-04-02 Thread Ryan Lee
** Also affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Changed in: apparmor Status: New => Invalid ** Changed in: apparmor (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages

[Touch-packages] [Bug 2092232] Re: not able to deploy Plucky Puffin

2025-04-02 Thread Ryan Lee
The profile fix will be added as a patch to the version packaged in Plucky, and should be uploaded into the queue by my EOD tomorrow. ** Tags added: sec-6054 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2099990] Re: lsusb fails due to apparmor

2025-04-01 Thread Ryan Lee
Both paths involved should be in the latest lsusb profile - can you double check the AppArmor package version you have installed and also include the contents of your /etc/apparmor.d/lsusb? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is su

[Touch-packages] [Bug 2103889] Re: gnome-remote-desktop-daemon: fusermount3: mount failed: Permission denied

2025-03-30 Thread Ryan Lee
The corresponding umount rule also needs to be fixed, but otherwise the diff LGTM ** Tags added: sec-6014 ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) ** Changed in: apparmor (Ubuntu) Status: New => In Progress -- You received this bug notifi

[Touch-packages] [Bug 2103460] Re: QRT AppArmorUnixDomainConnect test failures on Plucky 6.14 kernel

2025-03-28 Thread Ryan Lee
AIL == FAIL: test_sock_dgram (__main__.ApparmorUnixDomainConnect.test_sock_dgram) Test mediation of file based SOCK_DGRAM connect -- Traceback (most recent call last): File "/home/ryan-lee/qrt-test-

[Touch-packages] [Bug 2104194] [NEW] aa-genprof and aa-logprof have hotkey conflict with execution ignore and inherit

2025-03-25 Thread Ryan Lee
Public bug reported: As reported by https://gitlab.com/apparmor/apparmor/-/issues/302, execution log ignore and inherit shared the same hotkey (i) in aa- genprof and aa-logprof, so there is no way to ignore the execution. ** Affects: apparmor (Ubuntu) Importance: Undecided Status: N

[Touch-packages] [Bug 2104193] [NEW] aa-enforce converts child profile "profile firefox//sh {" into "profile firefox {" producing "Multiple definitions" error

2025-03-25 Thread Ryan Lee
Public bug reported: As reported in https://gitlab.com/apparmor/apparmor/-/issues/493, the child profile component of a profile name is not handled correctly by aa-enforce, resulting in it being stripped. ** Affects: apparmor (Ubuntu) Importance: Undecided Assignee: Ryan Lee (rlee287

[Touch-packages] [Bug 2103524] Re: lsblk apparmor profile denies block device lookup on Azure

2025-03-19 Thread Ryan Lee
** Tags added: sec-5988 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2103524 Title: lsblk apparmor profile denies block device lookup on Azure Status in apparmor packa

[Touch-packages] [Bug 2098930] Re: openvpn profile doesn't allow access to files on home dir

2025-03-12 Thread Ryan Lee
After a discussion with Alex Murray and John Johansen, we decided on the following OpenVPN policy adjustments: - allowing writes to files in the /etc/openvpn, and not just reads - allowing reads to most of the home directories - allowing writes to most of the home directories, with an owner restri

[Touch-packages] [Bug 2102056] Re: openvpn on Plucky fails to connect

2025-03-12 Thread Ryan Lee
*** This bug is a duplicate of bug 2101909 *** https://bugs.launchpad.net/bugs/2101909 ** This bug has been marked a duplicate of bug 2101909 AppArmor OpenVPN profile blocks access to NetworkManager-OpenVPN imported certs -- You received this bug notification because you are a member of

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-03-11 Thread Ryan Lee
Also, I see that you added remmina to LP: #2046844, but the log that you pasted into the bug report above does not have anything to do with user namespaces. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. h

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-03-11 Thread Ryan Lee
Is that the only AppArmor log message being generated, or are there more? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2102033 Title: remmina blocked by apparmor in Plu

[Touch-packages] [Bug 2101869] Re: apparmor utils tools cannot parse fusermount3 profile

2025-03-11 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2101869 Title: apparmor utils tools cannot parse fusermoun

[Touch-packages] [Bug 2101909] [NEW] AppArmor OpenVPN profile blocks access to NetworkManager-OpenVPN imported certs

2025-03-10 Thread Ryan Lee
Public bug reported: The openvpn profile shipped in the AppArmor package in Plucky (4.1.0~beta5-0ubuntu6 as of time of writing) does not allow access to the ~/.cert/nm-openvpn, which is needed to allow OpenVPN to use certificate files imported by NetworkManager. This was reported by "@zorn-v" upst

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2025-03-10 Thread Ryan Lee
** Changed in: apparmor Status: New => Fix Released ** Changed in: apparmor (Ubuntu) Status: Fix Committed => Fix Released ** Changed in: apparmor (Ubuntu Oracular) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubunt

[Touch-packages] [Bug 2101180] Re: Multiple DENIED apparmor messages when using rsyslog with the imfile module

2025-03-08 Thread Ryan Lee
Does the imfile module still work correctly despite the denial logs, or is it unable to perform monitoring as expected? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to rsyslog in Ubuntu. https://bugs.launchpad.net/bugs/2101180

[Touch-packages] [Bug 2099811] Re: Os-prober segmentation fault one message for each partition on same PC

2025-03-07 Thread Ryan Lee
We'll be packaging up os-prober profiles in the main AppArmor package so that they're installed by default and so that we can update them more easily if necessary. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ub

[Touch-packages] [Bug 2099811] Re: Os-prober segmentation fault one message for each partition on same PC

2025-03-06 Thread Ryan Lee
For the record: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476184 has a rationale for why os-prober introduced mount namespaces in the first place. If we remove the unsharing of the mount namespace, can we also make sure that os-prober won't fall over if its unmount calls fail? ** Bug watch

[Touch-packages] [Bug 2100295] Re: Apparmor settings for fusermount3 break flatpak

2025-03-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Committed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2099990] Re: lsusb fails due to apparmor

2025-03-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Fix Committed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2100295] Re: Apparmor settings for fusermount3 break flatpak

2025-03-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2100295 Title: Apparmor settings for fusermount3 break fla

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
The broken profile located in /etc/apparmor.d/wpa_supplicant should have been removed by the upgrade to 4.1.0~beta5-0ubuntu5. Was it still there on your system after the upgrade? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
Hi Heinrich, Could you also confirm how you constructed the above AppArmor profile for wpa_supplicant? Did you create it based on the broken wpa_supplicant profile shipped in the earlier AppArmor package, or did you create it some other way? -- You received this bug notification because you are

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
Switching this to "Fix Released" now that the 0ubuntu5 release is out that disables the profile - feel free to switch back if you're still encountering issues even on that release. ** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification bec

[Touch-packages] [Bug 2098993] Re: Last updates to apparmor broke all AppImages, which depend on fusermount

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Fix Committed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2098906] Re: apparmor breaks sbuild with unshare on plucky

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2098906 Title: apparmor breaks sbuild with unsha

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2098838 Title: apparmor appears to deny wpasuppl

[Touch-packages] [Bug 2098906] Re: apparmor breaks sbuild with unshare on plucky

2025-02-28 Thread Ryan Lee
This breakage is due to the latest AppArmor packaging enabling a unshare-userns-restrict profile by default. In most cases, this allows more usage of unshare than before (while limiting the attack surface exposed by capabilities in unprivileged user namespaces), but sbuild is one of the cases where

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
Seems like the new wpa_supplicant protocol will need rules allowing read access to /sys/devices/pci*:*/*:*:*.*/ieee80211/phy*/** and to allow dgram socket creation, but there may be other accesses we might have missed that would be needed to unbreak the profile. For now, we'll proceed by disabling

[Touch-packages] [Bug 2095597] Re: apparmor: removal of Python standard libraries in Python 3.13

2025-01-23 Thread Ryan Lee
As noted in the original Debian bug, this issue is tracked upstream at https://gitlab.com/apparmor/apparmor/-/issues/447. ** Changed in: apparmor (Ubuntu) Status: New => Confirmed ** Bug watch added: gitlab.com/apparmor/apparmor/-/issues #447 https://gitlab.com/apparmor/apparmor/-/issue

[Touch-packages] [Bug 2095118] [NEW] Desktop login screen sometimes flickers, accompanied by rfkill dmesg logspam

2025-01-16 Thread Ryan Lee
Public bug reported: Sometimes, when booting into a Plucky VM (provisioned via virt-manager), the login screen flickers constantly, rendering the GUI unusable. Occasionally, the flickering pauses long enough for me to type in the first few characters of my password, before the flickering starts ag

[Touch-packages] [Bug 2083129] Re: [Lenovo Ubuntu 22.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip

2025-01-06 Thread xiaochun Lee
@Lukas Märdian (slyon), you mentioned delay start NetworkManager.service, and give us an example as below. $ cat /etc/systemd/system/NetworkManager.service.d/override.conf [Service] ExecStartPre=/usr/bin/sleep 3 But, you know the directory /etc/systemd/system/NetworkManager.service.d/ isn't there

[Touch-packages] [Bug 2083129] Re: [Lenovo Ubuntu 22.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip

2024-12-17 Thread xiaochun Lee
Sorry, the test SUT need to assemble, we might wait until the system are available. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to network-manager in Ubuntu. https://bugs.launchpad.net/bugs/2083129 Title: [Lenovo Ubuntu 22

[Touch-packages] [Bug 2083129] Re: [Lenovo Ubuntu 22.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip

2024-12-11 Thread xiaochun Lee
Hi, Ubuntu Sorry to push you again, is there any updates on this issue? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to network-manager in Ubuntu. https://bugs.launchpad.net/bugs/2083129 Title: [Lenovo Ubuntu 22.04.4 Bug]

[Touch-packages] [Bug 2083129] Re: [Lenovo Ubuntu 22.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip

2024-12-09 Thread xiaochun Lee
We did tested a way to recreated those config files under /run/NetworkManager/system-connections/. After system bootup, we run /usr/lib/systemd/system-generators/netplan manually and it would created those config files base on the .yaml file. so it seems like you want do 3 seconds sleep for Network

[Touch-packages] [Bug 2083129] Re: [Lenovo Ubuntu 22.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip

2024-12-09 Thread xiaochun Lee
The reproduce steps is pretty easy, just put I attached file "00-installer-config (copy).yaml" in comment#1 to /etc/netplan/ and reboot OS. But you need more NIC interfaces in your system. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is sub

[Touch-packages] [Bug 2083129] Re: [Lenovo Ubuntu 24.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip

2024-12-08 Thread xiaochun Lee
@Lukas and Jeff Regarding this issue, would you please share us the workable work around if you can not fix it in the next few days. Since we are going to meet deadline in our internal project, we need to based on your comment or documents to go limitation. Many thanks! -- You received this bu

[Touch-packages] [Bug 2083129] Re: [Lenovo Ubuntu 24.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip

2024-10-16 Thread xiaochun Lee
** Summary changed: - netplan static IP address assignment use NetworkManager as renderer would be lost static ip + [Lenovo Ubuntu 24.04.4 Bug] netplan static IP address assignment use NetworkManager as renderer would be lost static ip -- You received this bug notification because you are a

[Touch-packages] [Bug 2004592] Re: aalogparse.h cannot be included from C++ code

2024-10-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) ** Changed in: apparmor (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
After rechecking https://git.launchpad.net/ubuntu/+source/apparmor/tree/debian/patches/ubuntu Alex Murray found that this second patch in comment #4 was already applied in the last upload of the apparmor package, so we don't have to apply the patch again. -- You received this bug notification bec

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
While we're at it, John Johansen also decided to include this patch, which fixes a critical bug in which the rule priority directives could destroy permissions for some classes. ** Patch added: "Patch for commit 204c0c5a3a34ac2eb47b863aae20bace48e0ad3c downloaded from Gitlab" https://bugs.lau

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
Gitlab MR has been merged, with commit c86c87e8868c72e5ab2084b5bf783cd5ca800a9b fixing the ABI break. Patch is attached. ** Description changed: Commit 3c825eb001d33bb6f2480c4f78df03aee4c40396 in the Gitlab upstream adds a field called `execpath` to the `aa_log_record` struct. This field wa

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
** Patch added: "Patch of commit c86c87e8868c72e5ab2084b5bf783cd5ca800a9b downloaded from GitLab" https://bugs.launchpad.net/apparmor/+bug/2083435/+attachment/5823945/+files/c86c87e8868c72e5ab2084b5bf783cd5ca800a9b.patch ** Description changed: Commit 3c825eb001d33bb6f2480c4f78df03aee4c403

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
** Tags added: oracular -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2083435 Title: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record Status in AppArmor:

[Touch-packages] [Bug 2077892] [NEW] Two different values for /run/lock

2024-08-26 Thread Lee Maguire
Public bug reported: There are conflicting values for /run/lock (1755 and 0755) in /usr/lib/tmpfiles.d Log line: systemd-tmpfiles[139060]: /usr/lib/tmpfiles.d/legacy.conf:13: Duplicate line for path "/run/lock", ignoring. /usr/lib/tmpfiles.d$ grep "d /run/lock " * debian.conf:d /run/lock17

[Touch-packages] [Bug 2051068] Re: GUI crashed after installed proposed package libegl-mesa0

2024-03-06 Thread Lee Sheng Hung
** Information type changed from Public Security to Private Security ** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mesa in Ubuntu. https://bugs.launchpad.net/bugs/

[Touch-packages] [Bug 2056383] [NEW] Audio turned to dummy output from 5.15.0-1049-intel-iotg to 5.15.0-1050

2024-03-06 Thread Lee Sheng Hung
Public bug reported: [Summary] After updated kernel 5.15.0-1049-intel-iotg to 5.15.0-1050 Sound output device turned to dummy output. [Steps to reproduce] 1. Install OS image to DUT. 2. Update package from repository(include proposed) 3. Upgrade package from repository(include proposed) 4. After

[Touch-packages] [Bug 2051068] Re: GUI crashed after installed proposed package libegl-mesa0

2024-03-05 Thread Lee Sheng Hung
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mesa in Ubuntu. https://bugs.launchpad.net/bugs/2051068 Title: GUI crashed after installed proposed package libegl-m

[Touch-packages] [Bug 2051068] Re: GUI crashed after installed proposed package libegl-mesa0

2024-01-30 Thread Lee Sheng Hung
Sorry for the late reply. Proposed package 23.2.1-1ubuntu3.1~22.04.2 amd64 [installed,automatic], GUI displayed normally, thank you for the help! -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mesa in Ubuntu. https://bugs.lau

[Touch-packages] [Bug 2051068] Re: GUI crashed after installed proposed package libegl-mesa0

2024-01-24 Thread Lee Sheng Hung
** Description changed: [Impact] OEM-6.1 kernel is missing support for minimum page size of 64k on DG2 (gfx12.5). Mesa 23.2 started using that, so it broke initializing the gpu on boot, causing a blank screen with no GDM running (with wayland, and fallback to X failed too). [Fix]

[Touch-packages] [Bug 2051068] Re: GUI crashed after installed proposed package libegl-mesa0

2024-01-24 Thread Lee Sheng Hung
** Attachment added: "kern.log" https://bugs.launchpad.net/ubuntu/+source/mesa/+bug/2051068/+attachment/5741895/+files/kern.log -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mesa in Ubuntu. https://bugs.launchpad.net/bug

[Touch-packages] [Bug 2051068] [NEW] GUI crashed after installed proposed package libegl-mesa0

2024-01-23 Thread Lee Sheng Hung
Public bug reported: [Summary] After installed proposed package libegl-mesa0, reboot system. GUI crashed but still able to access system by ssh. [Steps to reproduce] 1. Boot into OS 2. sudo apt update 3. sudo apt upgrade 4. After upgrade process finished, reboot system. 5. GUI crashed. [Expecte

[Touch-packages] [Bug 2037965] Re: [Demo][Experimental] My brightness hotkey doesn't work on some PC

2023-10-02 Thread Shih-Yuan Lee
** Patch added: "systemd_249.11-0ubuntu3.12.debdiff" https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2037965/+attachment/5705848/+files/systemd_249.11-0ubuntu3.12.debdiff ** Package changed: systemd (Ubuntu) => null-and-void ** Summary changed: - [Demo][Experimental] My brightness hot

[Touch-packages] [Bug 2037965] [NEW] null

2023-10-02 Thread Shih-Yuan Lee
Public bug reported: null ** Affects: null-and-void Importance: Undecided Status: New ** Summary changed: - My brightness hotkey doesn't work on some PC + [Demo][Experimental] My brightness hotkey doesn't work on some PC -- You received this bug notification because you are a me

[Touch-packages] [Bug 2023771] Re: package linux-firmware 20220329.git681281e4-0ubuntu3.13 failed to install/upgrade: installed linux-firmware package post-installation script subprocess returned erro

2023-07-05 Thread Lee Rosen
I also got this error when I tried to upgrade. Upon trying 'apt reinstall linux-firmware' I get the following: # apt reinstall linux-firmware The following packages will be REINSTALLED: linux-firmware 0 packages upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 3 not upgraded. Need t

[Touch-packages] [Bug 2020601] [NEW] package x11-common 1:7.7+23 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2023-05-23 Thread Lee Young
Public bug reported: I ran `sudo apt-get remove xrdp` and this error happened. ProblemType: Package DistroRelease: Debian 12 Package: x11-common 1:7.7+23 ProcVersionSignature: Ubuntu 4.10.0-42.46~16.04.1-generic 4.10.17 Uname: Linux 4.10.0-42-generic x86_64 .tmp.unity_support_test.1: ApportVers

[Touch-packages] [Bug 1741775] Re: bad symlink "/etc/resolvconf/resolv.conf.d/original"

2023-03-09 Thread Lee Maguire
I see this issue on a fresh install of Ubuntu 22.04, where "/etc/resolv.conf" exists as a symlink before resolvconf is installed, creating a dangling symlink in "/etc/resolvconf/resolv.conf.d/original". I believe the line in resolvconf.postinst that creates the file cp -a /etc/resolv.conf /etc

[Touch-packages] [Bug 604212] Re: infobox does not show

2023-01-08 Thread Lee Bigelow
Still happens here with xubuntu 22.04.1 Can get it to work by setting env variable TERM to something other than an xterm. Eg, this works: TERM=ansi whiptail --infobox "hello" 10 10; sleep 2 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is

[Touch-packages] [Bug 1988119] Re: Update to systemd 237-3ubuntu10.54 broke dns

2022-08-30 Thread Lee Van Steerthem
Not sure if this is the best place to help people out understanding if nodes are impacted. We already saw 2 different types of impact on our Azure AKS clusters. - Pod not able to Terminate - New images being pulled from ACR (or any container registry Sometimes it was very clear that we saw the

[Touch-packages] [Bug 1969460] Re: software-properties-gtk crashed with TypeError in on_driver_selection_changed(): Expected a string or a pair of strings

2022-06-14 Thread Shih-Yuan Lee
** Changed in: oem-priority Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to software-properties in Ubuntu. https://bugs.launchpad.net/bugs/1969460 Title: software-properties-gtk

[Touch-packages] [Bug 1969460] Re: software-properties-gtk crashed with TypeError in on_driver_selection_changed(): Expected a string or a pair of strings

2022-06-01 Thread Shih-Yuan Lee
I checked software-properties/0.99.22.2 in jammy-proposed and it does fix the problem. ** Changed in: oem-priority Importance: Undecided => High ** Changed in: oem-priority Assignee: (unassigned) => Shih-Yuan Lee (fourdollars) ** Changed in: oem-priority Status: New

  1   2   3   4   5   6   7   >