I've completed my verification of the apparmor 2.10.95-0ubuntu2.5~14.04.1 SRU. Testing very went well and I did not uncover any issues. I completed the entire Test Case as documented in the bug description. The AppArmor test plan was completed on the 14.04 release and HWE kernels as well as all of the regression tests from QRT. The manual testing of evince was also performed on the release and HWE kernels. Additionally, I ran test-apparmor.py on the i386 release and HWE kernels (all other tests were ran on amd64).
On the HWE kernel, I was able to test apparmor with the snapd in trusty- proposed. The pwgen-tyhicks, hello-world, and lxd snaps all seemed to be working correctly. I created a 16.04 LXD container and verified that confinement was working as intended. I also verified that confinement was working properly with hello-world.sh. As for the 12.04 -> 14.04 upgrade testing, it also went very well. I installed most major 12.04 packages containing an AppArmor profile, in addition to what's present in a default desktop install, and performed an upgrade: $ sudo apt-get install slapd mysql-server clamav tcpdump ntp ... $ sudo aa-status ... 26 profiles are in enforce mode. /sbin/dhclient /usr/bin/evince /usr/bin/evince-previewer /usr/bin/evince-previewer//launchpad_integration /usr/bin/evince-previewer//sanitized_helper /usr/bin/evince-thumbnailer /usr/bin/evince-thumbnailer//sanitized_helper /usr/bin/evince//launchpad_integration /usr/bin/evince//sanitized_helper /usr/bin/freshclam /usr/lib/NetworkManager/nm-dhcp-client.action /usr/lib/connman/scripts/dhclient-script /usr/lib/cups/backend/cups-pdf /usr/lib/lightdm/lightdm-guest-session /usr/lib/lightdm/lightdm-guest-session//chromium /usr/lib/telepathy/mission-control-5 /usr/lib/telepathy/telepathy-* /usr/lib/telepathy/telepathy-*//pxgsettings /usr/lib/telepathy/telepathy-*//sanitized_helper /usr/lib/telepathy/telepathy-ofono /usr/sbin/cups-browsed /usr/sbin/cupsd /usr/sbin/mysqld /usr/sbin/ntpd /usr/sbin/slapd /usr/sbin/tcpdump ... There were a couple denials logged but they didn't affect the upgrade: $ grep DENIED /var/log/syslog Dec 16 18:00:41 sec-precise-amd64 kernel: [ 8267.110822] type=1400 audit(1481911241.875:29): apparmor="DENIED" operation="open" parent=6862 profile="/usr/sbin/slapd" name="/etc/pkcs11/modules/" pid=6873 comm="slapd" requested_mask="r" denied_mask="r" fsuid=118 ouid=0 Dec 16 18:32:21 sec-precise-amd64 kernel: [ 1766.776830] type=1400 audit(1481913141.561:35): apparmor="DENIED" operation="open" parent=1 profile="/usr/sbin/mysqld" name="/proc/sys/vm/overcommit_memory" pid=29835 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=116 ouid=0 I then performed the same 12.04 -> 14.04 upgrade test except that I didn't use the new apparmor from trusty-proposed and it turns out that I see the same two AppArmor denials: $ grep DENIED /var/log/syslog Dec 16 21:03:18 sec-precise-amd64 kernel: [ 739.903410] type=1400 audit(1481922198.702:34): apparmor="DENIED" operation="open" parent=1 profile="/usr/sbin/mysqld" name="/proc/sys/vm/overcommit_memory" pid=1679 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=116 ouid=0 Dec 16 21:03:18 sec-precise-amd64 kernel: [ 740.079754] type=1400 audit(1481922198.878:35): apparmor="DENIED" operation="open" parent=1747 profile="/usr/sbin/slapd" name="/etc/pkcs11/modules/" pid=1760 comm="slapd" requested_mask="r" denied_mask="r" fsuid=118 ouid=0 In other words, the apparmor package from trusty-proposed does not regress the 12.04 -> 14.04 upgrade process. I feel like the apparmor 2.10.95-0ubuntu2.5~14.04.1 SRU has went through very thorough testing and that it is good to go. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1641243 Title: Provide full AppArmor confinement for snaps on 14.04 Status in apparmor package in Ubuntu: Invalid Status in dbus package in Ubuntu: Invalid Status in apparmor source package in Trusty: Fix Committed Status in dbus source package in Trusty: Fix Committed Bug description: = apparmor SRU = [Rationale] For backporting snapd to 14.04 LTS, we need to provide proper AppArmor confinement for snaps when running under the 16.04 hardware enablement kernel. The apparmor userspace package in 14.04 is missing support key mediation features such as UNIX domain socket rules, AppArmor policy namespaces, and AppArmor profile stacking. UNIX domain socket mediation is needed by nearly all snaps. AppArmor policy namespaces and profile stacking are needed by the lxd snap. Unfortunately, it was not feasible to backport the individual features to the 14.04 apparmor package as they're quite complex and have a large number of dependency patches. Additionally, the AppArmor policy abstractions from Ubuntu 16.04 are needed to provide proper snap confinement. Because of these two reasons, the decision to bring 16.04's apparmor package to 14.04 was (very carefully) made. [Test Case] https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor This update will go through the Test Plan as well as manual testing to verify that snap confinement on 14.04 does work. Manual tests include installing snapd in 14.04 and running simple snaps such as pwgen- tyhicks and hello-world, as well as a much more complex snap such as lxd. The following regression tests from lp:qa-regression-testing (these packages ship an AppArmor profile) can be used to verify that their respective packages do not regress: test-apache2-mpm-event.py test-apache2-mpm-itk.py test-apache2-mpm-perchild.py test-apache2-mpm-prefork.py test-apache2-mpm-worker.py test-bind9.py test-clamav.py test-cups.py test-dhcp.py test-mysql.py test-ntp.py test-openldap.py test-rsyslog.py test-squid.py test-strongswan.py test-tcpdump.py I have pushed changes to lp:qa-regression-testing which pulls in the parser and regression tests from the apparmor 2.8.95~2430-0ubuntu5.3 package currently shipping in Trusty, in addition to the tests in the 2.10.95 based package. Additionally, manually testing evince, which is confined by an AppArmor profile, should be done. The manual test should check basic functionality as well as for proper confinement (`ps auxZ` output). Finally, we need to test that 12.04 -> 14.04 upgrades continue to work. Specifically, the apparmor packages in trusty-proposed and the 12.04 kernel need to be tested together. [Regression Potential] High. We must be extremely careful to not regress existing, confined applications in Ubuntu 14.04. We are lucky that the upstream AppArmor project has extensive regression tests and that the Ubuntu Security team adds even more testing via the AppArmor Test Plan. Care was taken to minimally change how the AppArmor policies are loaded during the boot process. I also verified that the abstractions shipped in apparmor and the profiles shipped in apparmor-profiles are the same across this SRU update. = dbus SRU = [Rationale] For backporting snapd to 14.04 LTS, we need to provide proper D-Bus mediation for snaps when running under the 16.04 hardware enablement kernel. The dbus package in 14.04 is missing support for blocking unrequested reply messages. This functionality was added to the D-Bus AppArmor mediation patches after 14.04 was released but before the patches were merged upstream in dbus. The idea is to prevent a malicious snap from attacking another snap, over D-Bus, with unrequested reply messages and also to prevent two connections from subverting the snap confinement by communicating via unrequested reply messages. [Test Case] The upstream AppArmor userspace project has thorough tests for D-Bus mediation, including unrequested replies. Its tests/regression/apparmor/dbus_*.sh tests should be ran before and after updating to the dbus SRU. Before updating, the dbus_unrequested_reply.sh should fail and should pass after updating. To run the dbus_*.sh tests: $ sudo apt-get install -y bzr libdbus-1-dev $ bzr branch lp:apparmor # apt-get source apparmor to test the current apparmor $ cd apparmor/tests/regression/apparmor/ $ make USE_SYSTEM=1 \ dbus_{eavesdrop,message,service,unrequested_reply} uservars.inc $ for t in dbus_{eavesdrop,message,service,unrequested_reply}.sh; \ do sudo VERBOSE=1 bash $t || break; done The exit code should be 0 and all output lines should start with "ok:". In addition, the test-dbus.py tests from lp:qa-regression-testing should be ran to verify basic D-Bus functionality. This update will go through the Test Plan as well as manual testing to verify that snap confinement on 14.04 does work. Manual tests include installing snapd in 14.04 and running simple snaps such as pwgen- tyhicks and hello-world, as well as a much more complex snap such as lxd. [Regression Potential] Low. There's no use for unrequested D-Bus reply messages and silently dropping them for AppArmor confined applications should have no unintended side effects. The unrequested reply protections have been present in releases after 14.04 and have not caused any issues. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1641243/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
