[Touch-packages] [Bug 2111845] Re: autopkgtests failing with fuse3 3.17

2025-06-11 Thread Ryan Lee
** Tags added: sec-6525 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2111845 Title: autopkgtests failing with fuse3 3.17 Status in AppArmor: New Status in snapd: N

[Touch-packages] [Bug 2110212] Re: Ubuntu 25.04 plucky: lsusb --tree command doesn't works

2025-06-06 Thread Ryan Lee
** Summary changed: - Ubuntu 25.05 plucky: lsusb --tree command doesn't works + Ubuntu 25.04 plucky: lsusb --tree command doesn't works -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpa

[Touch-packages] [Bug 2110212] Re: Ubuntu 25.05 plucky: lsusb --tree command doesn't works

2025-06-05 Thread Ryan Lee
Can you please attach the apparmor denial entries to this bug report? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2110212 Title: Ubuntu 25.05 plucky: lsusb --tree comm

[Touch-packages] [Bug 2106675] Re: apparmor prevents access to saved Remmina sessions

2025-06-02 Thread Ryan Lee
We have received multiple reports of remmina breakage caused by an incomplete AppArmor profile, and we are planning to pull the profile from Plucky entirely. Please see https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2107723 and https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/211023

[Touch-packages] [Bug 2098993] Re: Last updates to apparmor broke all AppImages, which depend on fusermount

2025-06-02 Thread Ryan Lee
This might be a separate fusermount bug - could you please file a new issue against AppArmor and include any AppArmor denial logs that might have been generated? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubun

[Touch-packages] [Bug 2110236] Re: [SRU] fixes for AppArmor in Plucky

2025-05-28 Thread Ryan Lee
Updated debdiff to fix the issue identified; we are no longer attempting to match the version number of this Plucky upload to the package version in Questing. ** Patch added: "apparmor_4.1.0~beta5-0ubuntu14.1.debdiff" https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2110236/+attachment/

[Touch-packages] [Bug 2111807] Re: Plucky broke fstab sshfs mounts, which depend on fusermount

2025-05-28 Thread Ryan Lee
** Description changed: [ Impact ] sshfs mounts specified in /etc/fstab would fail to mount when a mount of all filesystems specified in the fstab was attempted with mount -a. This - was due to a missing noexec mount flag specification in the mount rules. + was due to a missing noexec mou

[Touch-packages] [Bug 2111604] Re: lsblk: failed to get sysfs name: Permission denied

2025-05-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu Questing) Status: New => Fix Released ** Changed in: apparmor (Ubuntu Plucky) Status: New => Confirmed ** Changed in: apparmor (Ubuntu Questing) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification becaus

[Touch-packages] [Bug 2111807] Re: Plucky broke fstab sshfs mounts, which depend on fusermount

2025-05-28 Thread Ryan Lee
** Description changed: - My sshfs mounts from /etc/fstab stopped working after upgrading to - Plucky. This is the line from my fstab: + [ Impact ] + + sshfs mounts specified in /etc/fstab would fail to mount when a mount of + all filesystems specified in the fstab was attempted with mount -a. Th

[Touch-packages] [Bug 2110236] Re: [SRU] fixes for AppArmor in Plucky

2025-05-28 Thread Ryan Lee
** Description changed: [ Impact ] This SRU contains fixes for a number of bugs: - * The unprivileged_userns profile did not have access to the root directory (LP: #2110616) - * lsblk could not list DASD devices on IBM System Z (LP: #2107402) - * Various commands segfaulted when run fro

[Touch-packages] [Bug 2111845] Re: autopkgtests failing with fuse3 3.17

2025-05-27 Thread Ryan Lee
Could you please link to an autopkgtest failure log that would help us investigate? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2111845 Title: autopkgtests failing wit

[Touch-packages] [Bug 2098993] Re: Last updates to apparmor broke all AppImages, which depend on fusermount

2025-05-27 Thread Ryan Lee
Can you please attach AppArmor denial logs for those mounts? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2098993 Title: Last updates to apparmor broke all AppImages, w

[Touch-packages] [Bug 2111753] Re: Add profile for GNU guix

2025-05-27 Thread Ryan Lee
Can you provide more details, such as log entries, about how GNU guix fails without an AppArmor profile? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2111753 Title: Add

[Touch-packages] [Bug 2110066] Re: Online Accounts error when adding a Google account with non-snap Firefox

2025-05-22 Thread Ryan Lee
Could you share the contents of /etc/apparmor.d/firefox from your system? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2110066 Title: Online Accounts error when adding

[Touch-packages] [Bug 2111205] Re: fusermount3 profile blocks libfuse module in flatpak

2025-05-20 Thread Ryan Lee
** Tags added: sec-6337 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2111205 Title: fusermount3 profile blocks libfuse module in flatpak Status in apparmor package in

[Touch-packages] [Bug 2110236] Re: [SRU] fixes for AppArmor in Plucky

2025-05-15 Thread Ryan Lee
Updated debdiff with changelog updated based on feedback. ** Description changed: [ Impact ] This SRU contains fixes for a number of bugs: - * The unprivileged_userns profile did not have access to the root directory (https://gitlab.com/apparmor/apparmor/-/issues/505) + * The unprivileg

[Touch-packages] [Bug 2110688] [NEW] apparmor parser incorrectly treats norelatime mount flag as a no-op

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] The parser did not handle the norelatime mount flag correctly, essentially treating its addition to a list of mount flags as a no-op. A test should also be included to ensure that the behavior is fixed and not broken again. [ Test Plan ] This bug is caught by an

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + + The remmina profile is missing a bunch of rules that would be needed in + order to allow usage of all its functionality. As such, we will need to + pull the remmina profile from Plucky to avoid breaking its usages. + + [ Test Plan

[Touch-packages] [Bug 2110630] [NEW] apparmor.d man page contains incorrect information about mount flag combinations

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] The apparmor.d man page contained incorrect information about the combination of mount options=(list) options in (list), so this documentation should be fixed, and a test included to ensure that the documented behavior matches the actual behavior. [ Test Plan ] C

[Touch-packages] [Bug 2107596] Re: Apparmor is missing rule for openvpn to set DNS domain

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + + The openvpn profile lacked permissions to manage DNS settings for pushed + DHCP settings (LP: #2107596) + + [ Test Plan ] + + * This test description assumes no access to existing machines that use OpenVPN. Additional testing of

[Touch-packages] [Bug 2110628] [NEW] apparmor profiles need mr permissions on their own binaries for execution from a confined context

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] Various commands segfaulted when run from a confined context due to missing permissions on the binary execution path, and their corresponding profiles need rules to give m+r permissions for the binaries themselves. [ Test Plan ] * Add the following to a new file

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-14 Thread Ryan Lee
** Description changed: + [ Impact ] + + iotop-c failed to launch at all due to permission denials in nl_init and + missing capabilities in the iotop-c profile. + + [ Test Plan ] + + * Launch iotop-c under sudo (make sure to invoke iotop-c directly instead of iotop, which might be symlinked t

[Touch-packages] [Bug 2110626] [NEW] apparmor fusermount3 profile disallows noatime flag, breaking fuse-overlayfs

2025-05-14 Thread Ryan Lee
Public bug reported: [ Impact ] fusermount3 lacked permissions to mount with noatime, which is needed to use fuse_overlayfs. [ Test Plan ] After installation of the new AppArmor version, the machine might need to be rebooted. If a reboot between installation and test plan execution is needed fo

[Touch-packages] [Bug 2109029] Re: AppArmor OpenVPN profile blocks mDNS lookups

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + Configuration of an OpenVPN client with a "remote some_hostname.local" rule on Plucky fails because the OpenVPN profile does not allow access to /run/avahi-daemon/socket for mDNS lookups. + + [ Test Plan ] + + Test plan for th

[Touch-packages] [Bug 2110624] [NEW] apparmor fusermount3 profile blocks mounts to /cvmfs/ subdirectories

2025-05-14 Thread Ryan Lee
Public bug reported: SRU Justification: [ Impact ] fusermount3 lacked permissions to mount to /cvmfs subdirectories, breaking usage of the CernVM FS. [ Test Plan ] * The following instructions are adapted from https://cvmfs.readthedocs.io/en/stable/cpt-quickstart.html - Install the cvmfs

[Touch-packages] [Bug 2107723] Re: Using KDE Plasma widget "Web Browser" kill Plasma desktop due to QtWebEngine and AppArmor restrictions

2025-05-14 Thread Ryan Lee
** Description changed: + SRU Justification: + + [ Impact ] + + The plasmashell profile was missing the new path to QtWebEngineProcess, + causing the entire desktop environment to crash upon attempted usage of + the Web Browser widget. + + [ Test Plan ] + + This test needs to be executed on a

[Touch-packages] [Bug 2110616] [NEW] apparmor unprivileged_userns profile missing access to /

2025-05-14 Thread Ryan Lee
or automatically during an batch unattended upgrade) would result in end users not getting this fix. [ Other Info ] This bug was originally reported at https://gitlab.com/apparmor/apparmor/-/issues/505. ** Affects: apparmor (Ubuntu) Importance: Undecided Assignee: Ryan Lee (rlee287

[Touch-packages] [Bug 2107455] Re: segfault of lsblk s390x in containers due to apparmor

2025-05-14 Thread Ryan Lee
** Description changed: SRU Justification: [ Impact ] - * lsblk on an s390x system that uses DASD disks shows no output. - - * journactl shows lsblk is blocked by apparmor: -2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 -audit(1744729346.034:270): appar

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-13 Thread Ryan Lee
** Description changed: SRU Justification: [ Impact ]  * lsblk on an s390x system that uses DASD disks shows no output.  * journactl shows lsblk is blocked by apparmor:    2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400    audit(1744729346.034:270): appar

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-13 Thread Ryan Lee
** Description changed: SRU Justification: [ Impact ] - * lsblk on an s390x system that uses DASD disks shows no output. - - * journactl shows lsblk is blocked by apparmor: -2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 -audit(1744729346.034:270): appa

[Touch-packages] [Bug 2107455] Re: segfault of lsblk s390x in containers due to apparmor

2025-05-13 Thread Ryan Lee
The root cause of this issue is not related to the unprivileged_userns, and this was instead an instance of a more general problem we found involving profiles on applications and rules required for exec transitions from confined. I'll replace the test plan with one corresponding to the root cause i

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-13 Thread Ryan Lee
It's not quite correct, because the underlying bug isn't due to the unprivileged_userns profile but is instead due to the lsblk profile, but I can fix that part of the text myself. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed

[Touch-packages] [Bug 2109707] Re: apparmor openvpn pritunl problem

2025-05-08 Thread Ryan Lee
** Tags added: sec-6302 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2109707 Title: apparmor openvpn pritunl problem Status in apparmor package in Ubuntu: New Bug d

[Touch-packages] [Bug 2110236] Re: [SRU] fixes for AppArmor in Plucky

2025-05-08 Thread Ryan Lee
The proposed uploaded for Plucky is also available at https://launchpad.net/~rlee287/+archive/ubuntu/apparmor- staging/+packages in a PPA. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launch

[Touch-packages] [Bug 2107402] Re: lsblk on IBM z Systems blocked by apparmor in 25.04

2025-05-08 Thread Ryan Lee
** Changed in: util-linux (Ubuntu Plucky) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107402 Title: lsblk on IBM z Systems blocked by ap

[Touch-packages] [Bug 2110236] [NEW] [SRU] fixes for AppArmor in Plucky

2025-05-08 Thread Ryan Lee
Public bug reported: [ Impact ] This SRU contains fixes for a number of bugs: * The unprivileged_userns profile did not have access to the root directory (https://gitlab.com/apparmor/apparmor/-/issues/505) * lsblk could not list DASD devices on IBM System Z (LP: #2107402) * Various commands s

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-06 Thread Ryan Lee
** Tags added: sec-6287 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107727 Title: iotop-c: Call of nl_init fails due to insufficient rights Status in apparmor packag

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-06 Thread Ryan Lee
I was able to reproduce and confirm this bug, which will need fixing in the apparmor package. In the meantime, you can add the rule "network netlink raw," to /etc/apparmor.d/local/iotop-c and reboot, as a workaround. -- You received this bug notification because you are a member of Ubuntu Touch

[Touch-packages] [Bug 2107727] Re: iotop-c: Call of nl_init fails due to insufficient rights

2025-05-06 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed ** Changed in: iotop-c (Ubuntu) Status: Confirmed => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.n

[Touch-packages] [Bug 2109707] Re: apparmor openvpn pritunl problem

2025-04-30 Thread Ryan Lee
Can you please attach logs with AppArmor denial information as well as additional information (beyond "not working anymore") that could help us reproduce the failures locally? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ap

[Touch-packages] [Bug 2109029] [NEW] AppArmor OpenVPN profile blocks mDNS lookups

2025-04-24 Thread Ryan Lee
Public bug reported: Configuration of an OpenVPN client with a "remote some_hostname.local" rule on Plucky fails because the OpenVPN profile does not allow access to /run/avahi-daemon/socket for mDNS lookups. ** Affects: apparmor (Ubuntu) Importance: Undecided Status: New -- You r

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-04-24 Thread Ryan Lee
Upon further investigation, it turns out that the remmina profile is missing other rules as well and needs to be expanded to handle e.g. keyed SSH connections. As such, we have decided to pull the remmina profile from Plucky. -- You received this bug notification because you are a member of Ubunt

[Touch-packages] [Bug 2107402] Re: lsblk blocked by apparmor in 25.04

2025-04-15 Thread Ryan Lee
This is a problem with the lsblk profile shipped by AppArmor and not a problem with the util-linux package. I am not super familiar with IBM z Systems, but I think the path that would need to be added is /sys/devices/css0/**. @fheimes could you confirm whether this path always includes "css0" as op

[Touch-packages] [Bug 2107402] Re: lsblk blocked by apparmor in 25.04

2025-04-15 Thread Ryan Lee
** Changed in: util-linux (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107402 Title: lsblk blocked by apparmor in 25.04 Status

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-04-11 Thread Ryan Lee
Updating statuses (again) to reflect that there should no longer be an active wpa_supplicant profile on Plucky, and to request that people still running into issues attach the contents of their /etc/apparmor.d/wpa_supplicant, which should no longer exist. ** Changed in: wpa (Ubuntu) Status:

[Touch-packages] [Bug 2106311] Re: File picker does not work in browsers in Ubuntu 25.04 beta for SSSD users

2025-04-10 Thread Ryan Lee
** Tags added: sec-6112 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2106311 Title: File picker does not work in browsers in Ubuntu 25.04 beta for SSSD users Status

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-04-07 Thread Ryan Lee
Can you please share 1) the version of the AppArmor package you now have installed, 2) the contents of /etc/apparmor.d/remmina, and 3) the AppArmor denial log from the syslog (which should have something like "dbus-daemon[3722]: apparmor="DENIED""? -- You received this bug notification because yo

[Touch-packages] [Bug 2105840] Re: apparmor shell script string comparison error

2025-04-04 Thread Ryan Lee
Also found by LP: #2102680. Fixes are in Plucky but will need to be backported to Noble and Oracular -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2105840 Title: apparmo

[Touch-packages] [Bug 2106174] [NEW] aa-notify's userns_special_profiles default missing unprivileged_userns

2025-04-03 Thread Ryan Lee
cided Assignee: Ryan Lee (rlee287) Status: New ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.

[Touch-packages] [Bug 2106177] [NEW] aa-notify's default configuration breaks the userns restriction by suggesting capabilities addition to unprivileged_userns

2025-04-03 Thread Ryan Lee
Public bug reported: The default configuration of aa-notify does not have any filtering on the notifications that it pops up, resulting in notifications that suggest adding capabilities to unprivileged_userns, circumventing and breaking the AppArmor userns restrictions. Since Plucky is very close

[Touch-packages] [Bug 2092232] Re: unable to deploy Plucky Puffin due to AppArmor lsblk denials

2025-04-03 Thread Ryan Lee
** Summary changed: - not able to deploy Plucky Puffin + unable to deploy Plucky Puffin due to AppArmor lsblk denials -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2092232

[Touch-packages] [Bug 2102680] Re: Installation of AppArmor on a 6.14 kernel produces error message "Illegal number: yes"

2025-04-02 Thread Ryan Lee
** Also affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Changed in: apparmor Status: New => Invalid ** Changed in: apparmor (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages

[Touch-packages] [Bug 2092232] Re: not able to deploy Plucky Puffin

2025-04-02 Thread Ryan Lee
The profile fix will be added as a patch to the version packaged in Plucky, and should be uploaded into the queue by my EOD tomorrow. ** Tags added: sec-6054 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2099990] Re: lsusb fails due to apparmor

2025-04-01 Thread Ryan Lee
Both paths involved should be in the latest lsusb profile - can you double check the AppArmor package version you have installed and also include the contents of your /etc/apparmor.d/lsusb? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is su

[Touch-packages] [Bug 2103889] Re: gnome-remote-desktop-daemon: fusermount3: mount failed: Permission denied

2025-03-30 Thread Ryan Lee
The corresponding umount rule also needs to be fixed, but otherwise the diff LGTM ** Tags added: sec-6014 ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) ** Changed in: apparmor (Ubuntu) Status: New => In Progress -- You received this bug notifi

[Touch-packages] [Bug 2103460] Re: QRT AppArmorUnixDomainConnect test failures on Plucky 6.14 kernel

2025-03-28 Thread Ryan Lee
AIL == FAIL: test_sock_dgram (__main__.ApparmorUnixDomainConnect.test_sock_dgram) Test mediation of file based SOCK_DGRAM connect -- Traceback (most recent call last): File "/home/ryan-lee/qrt-test-

[Touch-packages] [Bug 2104194] [NEW] aa-genprof and aa-logprof have hotkey conflict with execution ignore and inherit

2025-03-25 Thread Ryan Lee
Public bug reported: As reported by https://gitlab.com/apparmor/apparmor/-/issues/302, execution log ignore and inherit shared the same hotkey (i) in aa- genprof and aa-logprof, so there is no way to ignore the execution. ** Affects: apparmor (Ubuntu) Importance: Undecided Status: N

[Touch-packages] [Bug 2104193] [NEW] aa-enforce converts child profile "profile firefox//sh {" into "profile firefox {" producing "Multiple definitions" error

2025-03-25 Thread Ryan Lee
Public bug reported: As reported in https://gitlab.com/apparmor/apparmor/-/issues/493, the child profile component of a profile name is not handled correctly by aa-enforce, resulting in it being stripped. ** Affects: apparmor (Ubuntu) Importance: Undecided Assignee: Ryan Lee (rlee287

Re: [Touch-packages] [Bug 2097634] Re: Please merge openldap 2.6.9+dfsg-1 from Debian unstable for plucky

2025-03-21 Thread Ryan Tandy
On Fri, Mar 21, 2025 at 10:52:52PM -, Bryce Harrington wrote: >openldap | 2.6.9+dfsg-2ubuntu1 | plucky Thank you! -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openldap in Ubuntu. https://bugs.launchpad.net/bug

[Touch-packages] [Bug 2103524] Re: lsblk apparmor profile denies block device lookup on Azure

2025-03-19 Thread Ryan Lee
** Tags added: sec-5988 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2103524 Title: lsblk apparmor profile denies block device lookup on Azure Status in apparmor packa

[Touch-packages] [Bug 2098930] Re: openvpn profile doesn't allow access to files on home dir

2025-03-12 Thread Ryan Lee
After a discussion with Alex Murray and John Johansen, we decided on the following OpenVPN policy adjustments: - allowing writes to files in the /etc/openvpn, and not just reads - allowing reads to most of the home directories - allowing writes to most of the home directories, with an owner restri

[Touch-packages] [Bug 2102056] Re: openvpn on Plucky fails to connect

2025-03-12 Thread Ryan Lee
*** This bug is a duplicate of bug 2101909 *** https://bugs.launchpad.net/bugs/2101909 ** This bug has been marked a duplicate of bug 2101909 AppArmor OpenVPN profile blocks access to NetworkManager-OpenVPN imported certs -- You received this bug notification because you are a member of

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-03-11 Thread Ryan Lee
Also, I see that you added remmina to LP: #2046844, but the log that you pasted into the bug report above does not have anything to do with user namespaces. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. h

[Touch-packages] [Bug 2102033] Re: remmina blocked by apparmor in Plucky

2025-03-11 Thread Ryan Lee
Is that the only AppArmor log message being generated, or are there more? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2102033 Title: remmina blocked by apparmor in Plu

[Touch-packages] [Bug 2101869] Re: apparmor utils tools cannot parse fusermount3 profile

2025-03-11 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2101869 Title: apparmor utils tools cannot parse fusermoun

[Touch-packages] [Bug 2101909] [NEW] AppArmor OpenVPN profile blocks access to NetworkManager-OpenVPN imported certs

2025-03-10 Thread Ryan Lee
Public bug reported: The openvpn profile shipped in the AppArmor package in Plucky (4.1.0~beta5-0ubuntu6 as of time of writing) does not allow access to the ~/.cert/nm-openvpn, which is needed to allow OpenVPN to use certificate files imported by NetworkManager. This was reported by "@zorn-v" upst

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2025-03-10 Thread Ryan Lee
** Changed in: apparmor Status: New => Fix Released ** Changed in: apparmor (Ubuntu) Status: Fix Committed => Fix Released ** Changed in: apparmor (Ubuntu Oracular) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubunt

[Touch-packages] [Bug 2101180] Re: Multiple DENIED apparmor messages when using rsyslog with the imfile module

2025-03-08 Thread Ryan Lee
Does the imfile module still work correctly despite the denial logs, or is it unable to perform monitoring as expected? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to rsyslog in Ubuntu. https://bugs.launchpad.net/bugs/2101180

[Touch-packages] [Bug 2099811] Re: Os-prober segmentation fault one message for each partition on same PC

2025-03-07 Thread Ryan Lee
We'll be packaging up os-prober profiles in the main AppArmor package so that they're installed by default and so that we can update them more easily if necessary. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ub

[Touch-packages] [Bug 2099811] Re: Os-prober segmentation fault one message for each partition on same PC

2025-03-06 Thread Ryan Lee
For the record: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476184 has a rationale for why os-prober introduced mount namespaces in the first place. If we remove the unsharing of the mount namespace, can we also make sure that os-prober won't fall over if its unmount calls fail? ** Bug watch

[Touch-packages] [Bug 2100295] Re: Apparmor settings for fusermount3 break flatpak

2025-03-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Committed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2099990] Re: lsusb fails due to apparmor

2025-03-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Fix Committed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2100295] Re: Apparmor settings for fusermount3 break flatpak

2025-03-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2100295 Title: Apparmor settings for fusermount3 break fla

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
The broken profile located in /etc/apparmor.d/wpa_supplicant should have been removed by the upgrade to 4.1.0~beta5-0ubuntu5. Was it still there on your system after the upgrade? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
Hi Heinrich, Could you also confirm how you constructed the above AppArmor profile for wpa_supplicant? Did you create it based on the broken wpa_supplicant profile shipped in the earlier AppArmor package, or did you create it some other way? -- You received this bug notification because you are

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
Switching this to "Fix Released" now that the 0ubuntu5 release is out that disables the profile - feel free to switch back if you're still encountering issues even on that release. ** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification bec

[Touch-packages] [Bug 2098993] Re: Last updates to apparmor broke all AppImages, which depend on fusermount

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Fix Committed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2098906] Re: apparmor breaks sbuild with unshare on plucky

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2098906 Title: apparmor breaks sbuild with unsha

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2098838 Title: apparmor appears to deny wpasuppl

[Touch-packages] [Bug 2098906] Re: apparmor breaks sbuild with unshare on plucky

2025-02-28 Thread Ryan Lee
This breakage is due to the latest AppArmor packaging enabling a unshare-userns-restrict profile by default. In most cases, this allows more usage of unshare than before (while limiting the attack surface exposed by capabilities in unprivileged user namespaces), but sbuild is one of the cases where

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Status: New => Confirmed ** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu.

[Touch-packages] [Bug 2098838] Re: apparmor appears to deny wpasupplicant on plucky, breaking wifi

2025-02-28 Thread Ryan Lee
Seems like the new wpa_supplicant protocol will need rules allowing read access to /sys/devices/pci*:*/*:*:*.*/ieee80211/phy*/** and to allow dgram socket creation, but there may be other accesses we might have missed that would be needed to unbreak the profile. For now, we'll proceed by disabling

[Touch-packages] [Bug 2097634] [NEW] Please merge openldap 2.6.9+dfsg-1 from Debian unstable for plucky

2025-02-10 Thread Ryan Tandy
Public bug reported: Debian: 2.6.9+dfsg-1 Ubuntu: 2.6.9+dfsg-1~exp2ubuntu1 Please merge openldap from Debian unstable for plucky. These documentation additions are important for any users whose config (server or client) might be affected by the switch to OpenSSL: * d/slapd.preinst: Back up con

[Touch-packages] [Bug 2095597] Re: apparmor: removal of Python standard libraries in Python 3.13

2025-01-23 Thread Ryan Lee
As noted in the original Debian bug, this issue is tracked upstream at https://gitlab.com/apparmor/apparmor/-/issues/447. ** Changed in: apparmor (Ubuntu) Status: New => Confirmed ** Bug watch added: gitlab.com/apparmor/apparmor/-/issues #447 https://gitlab.com/apparmor/apparmor/-/issue

[Touch-packages] [Bug 2095118] [NEW] Desktop login screen sometimes flickers, accompanied by rfkill dmesg logspam

2025-01-16 Thread Ryan Lee
Public bug reported: Sometimes, when booting into a Plucky VM (provisioned via virt-manager), the login screen flickers constantly, rendering the GUI unusable. Occasionally, the flickering pauses long enough for me to type in the first few characters of my password, before the flickering starts ag

Re: [Touch-packages] [Bug 2085260] Re: Merge openldap from Debian unstable for plucky

2025-01-10 Thread Ryan Tandy
ew upstream version, also consider adding an entry to the Jammy Release Notes: https://discourse.ubuntu.com/c/release/38 ### New Debian Changes ### openldap (2.5.18+dfsg-3) unstable; urgency=medium * Fix FTBFS on 32-bit architectures. (ITS#10253) (Closes: #1078822) -- Ryan Tandy

[Touch-packages] [Bug 2089136] Re: python2.7 (2.7.18-1~20.04.5) breaks pip tar downloads

2024-11-20 Thread Ryan Harper
*** This bug is a duplicate of bug 2089071 *** https://bugs.launchpad.net/bugs/2089071 ** Also affects: python-defaults (Ubuntu Focal) Importance: Undecided Status: New ** Also affects: python2.7 (Ubuntu Focal) Importance: Undecided Status: New -- You received this bug n

[Touch-packages] [Bug 2089071] Re: tarfile.py regression: "ReadError: invalid header"

2024-11-20 Thread Ryan Harper
** Also affects: python2.7 (Ubuntu Focal) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to python2.7 in Ubuntu. https://bugs.launchpad.net/bugs/2089071 Title: tarfile.py regression

[Touch-packages] [Bug 1958019]

2024-10-27 Thread ryan
Hi, there seems to be a regression for the Thinkpad Z13 Gen 2 which uses the Realtek ALC287 with the CS35L41 speaker amp, and has an existing quirk to load the CS35L41 side codec. I'm using Alpine, and the distribution 6.6 LTS kernel works fine, but the -edge kernel (6.11.5 currently) doesn't even

[Touch-packages] [Bug 2004592] Re: aalogparse.h cannot be included from C++ code

2024-10-04 Thread Ryan Lee
** Changed in: apparmor (Ubuntu) Assignee: (unassigned) => Ryan Lee (rlee287) ** Changed in: apparmor (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
After rechecking https://git.launchpad.net/ubuntu/+source/apparmor/tree/debian/patches/ubuntu Alex Murray found that this second patch in comment #4 was already applied in the last upload of the apparmor package, so we don't have to apply the patch again. -- You received this bug notification bec

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
While we're at it, John Johansen also decided to include this patch, which fixes a critical bug in which the rule priority directives could destroy permissions for some classes. ** Patch added: "Patch for commit 204c0c5a3a34ac2eb47b863aae20bace48e0ad3c downloaded from Gitlab" https://bugs.lau

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
Gitlab MR has been merged, with commit c86c87e8868c72e5ab2084b5bf783cd5ca800a9b fixing the ABI break. Patch is attached. ** Description changed: Commit 3c825eb001d33bb6f2480c4f78df03aee4c40396 in the Gitlab upstream adds a field called `execpath` to the `aa_log_record` struct. This field wa

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
** Patch added: "Patch of commit c86c87e8868c72e5ab2084b5bf783cd5ca800a9b downloaded from GitLab" https://bugs.launchpad.net/apparmor/+bug/2083435/+attachment/5823945/+files/c86c87e8868c72e5ab2084b5bf783cd5ca800a9b.patch ** Description changed: Commit 3c825eb001d33bb6f2480c4f78df03aee4c403

[Touch-packages] [Bug 2083435] Re: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record

2024-10-01 Thread Ryan Lee
** Tags added: oracular -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2083435 Title: AppArmor 4.1.0-beta1 contains an ABI break for aa_log_record Status in AppArmor:

[Touch-packages] [Bug 2080069] Re: lxc-dev does not provide liblxc.a any more

2024-09-09 Thread Ryan Harper
I generated the smaller diff with: $ diff -u <(awk '{print $6}' lxc-dev_5.0.3-2ubuntu7_amd64.deb.contents ) <(awk '{print $6}' lxc-dev_5.0.3-2ubuntu8_amd64.deb.contents) > file- list.diff so one can just see which files were added/removed vs the date/timestamp change on files that are in both ar

[Touch-packages] [Bug 2080069] Re: lxc-dev does not provide liblxc.a any more

2024-09-09 Thread Ryan Harper
dpkg --contents lxc-dev_5.0.3-2ubuntu8_amd64.deb output ** Attachment added: "dpkg --contents lxc-dev_5.0.3-2ubuntu8_amd64.deb output" https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/2080069/+attachment/5814927/+files/lxc-dev_5.0.3-2ubuntu8_amd64.deb.contents -- You received this bug noti

[Touch-packages] [Bug 2080069] Re: lxc-dev does not provide liblxc.a any more

2024-09-09 Thread Ryan Harper
** Patch added: "Diff of dpkg --contents file column only between 7 and 8" https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/2080069/+attachment/5814925/+files/file-list.diff -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed t

[Touch-packages] [Bug 2080069] Re: lxc-dev does not provide liblxc.a any more

2024-09-09 Thread Ryan Harper
dpkg --contents on lxc-dev_5.0.3-2ubuntu7_amd64.deb ** Attachment added: "output from dpkg --contents on lxc-dev_5.0.3-2ubuntu7_amd64.deb" https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/2080069/+attachment/5814926/+files/lxc-dev_5.0.3-2ubuntu7_amd64.deb.contents -- You received this bug

[Touch-packages] [Bug 2080069] [NEW] lxc-dev does not provide liblxc.a any more

2024-09-09 Thread Ryan Harper
Public bug reported: 1) # lsb_release -rd No LSB modules are available. Description:Ubuntu 24.04 LTS Release:24.04 2) # apt-cache policy lxc-dev lxc-dev: Installed: 1:5.0.3-2ubuntu7 Candidate: 1:5.0.3-2ubuntu7 Version table: *** 1:5.0.3-2ubuntu7 500 500 http://archive.u

  1   2   3   4   5   6   7   8   9   >