Xenial as is on ntp restart: [2618636.253807] audit: type=1400 audit(1519220834.240:5311): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-x_<var-snap-lxd-common-lxd>" profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" pid=24452 comm="ntpd" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=1000000 [2618636.253817] audit: type=1400 audit(1519220834.240:5312): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-x_<var-snap-lxd-common-lxd>" profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" pid=24452 comm="ntpd" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=1000000
With updates from proposed # sudo apt install apparmor Reading package lists... Done Building dependency tree Reading state information... Done The following package was automatically installed and is no longer required: libfreetype6 Use 'sudo apt autoremove' to remove it. Suggested packages: apparmor-profiles apparmor-profiles-extra apparmor-docs apparmor-utils The following packages will be upgraded: apparmor 1 upgraded, 0 newly installed, 0 to remove and 29 not upgraded. Need to get 450 kB of archives. After this operation, 1024 B of additional disk space will be used. Get:1 http://archive.ubuntu.com/ubuntu xenial-proposed/main amd64 apparmor amd64 2.10.95-0ubuntu2.9 [450 kB] Fetched 450 kB in 0s (2291 kB/s) Preconfiguring packages ... (Reading database ... 25611 files and directories currently installed.) Preparing to unpack .../apparmor_2.10.95-0ubuntu2.9_amd64.deb ... Unpacking apparmor (2.10.95-0ubuntu2.9) over (2.10.95-0ubuntu2.8) ... Processing triggers for systemd (229-4ubuntu21.1) ... Processing triggers for ureadahead (0.100.0-19) ... Processing triggers for man-db (2.7.5-1) ... Setting up apparmor (2.10.95-0ubuntu2.9) ... Installing new version of config file /etc/apparmor.d/abstractions/base ... update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd # No issues anymore when restarting the service. Also found no other apparmor related issues restarting a few services that I had on there. ** Tags removed: verification-needed verification-needed-xenial ** Tags added: verification-done verification-done-xenial -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1670408 Title: apparmor base abstraction needs backport of rev 3658 to fix several denies (tor, ntp, ...) Status in apparmor package in Ubuntu: Fix Released Status in ntp package in Ubuntu: Confirmed Status in tor package in Ubuntu: Confirmed Status in apparmor source package in Xenial: Fix Committed Bug description: [Impact] * The base abstraction in xenial misses some ways programs can push logs to journald * Backport the fix form Artful to: 1. get rid of the Denies making logs less readable 2. get users to see the actual log entries will help to unbreak many other cases [Test Case] * Install one of the affected packages (in a xenial container is enough) * For the case of ntp just install and then run systemctl restart ntp * in Dmesg you'll see apparmor Denies like apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/ntpd" name="/run/systemd/journal/stdout" * Each case is different, in this (ntp) case also some log entries are missed due to the block * After installing the fixed package there is no Deny anymore and programs are able to correctly log. [Regression Potential] * The change is in ubuntu as-is since artful and we are only opening up, but not limiting the access - so there should be nothing that is denied after the update that was not before. Vice versa there could be changes due to things now working correcrly, but I'd not see that as a regression. [Other Info] * affects many packages ntp, tor - I even heard examples of mysql. But the fix is in apparmor through base abstraction --- Using tor 0.2.9.9-1ubuntu1 with Linux 4.10.0-9-generic on Zesty, tor fails to start after installing the tor package. "systemctl status tor@default" reports: Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Main process exited, code=killed, status=11/SEGV Mar 06 16:04:00 zesty systemd[1]: Failed to start Anonymizing overlay network for TCP. Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Unit entered failed state. Mar 06 16:04:00 zesty systemd[1]: tor@default.service: Failed with result 'signal'. There are two AppArmor denials in the kernel log: Mar 6 15:53:12 zesty-test kernel: [ 102.699647] audit: type=1400 audit(1488815592.268:35): apparmor="DENIED" operation="file_inherit" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/run/systemd/journal/stdout" pid=3520 comm="tor" requested_mask="wr" denied_mask="wr" fsuid=100000 ouid=100000 Mar 6 15:53:12 zesty-test kernel: [ 102.702418] audit: type=1400 audit(1488815592.272:37): apparmor="DENIED" operation="file_mmap" namespace="root//lxd-zesty_<var-lib-lxd>" profile="system_tor" name="/usr/bin/tor" pid=3520 comm="tor" requested_mask="m" denied_mask="m" fsuid=100000 ouid=100000 Workaround: add the following two lines to /etc/apparmor.d/system_tor: /usr/bin/tor m, /run/systemd/journal/stdout rw, I couldn't remember how to that that profile reloaded, so I rebooted, and after the reboot tor does start up successfully. "systemctl tor@default" reports it as running. I haven't checked to see if only one or other rule is actually required. Importance -> High since this bug makes the package unusable in its default configuration on Zesty. Since the AppArmor profile comes from Debian's 0.2.9.9-1, this should probably be fixed in Debian. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1670408/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
