Suggested fix upstream
https://gitlab.com/apparmor/apparmor/-/merge_requests/1608
** Also affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Changed in: apparmor (Ubuntu)
Status: New => In Progress
** Changed in: apparmor (Ubuntu)
Assignee: (unassigned) => Georgia Garcia (georgiag)
** Changed in: apparmor (Ubuntu)
Importance: Undecided => Critical
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/2105986
Title:
Apparmor parser 2.12 doesn't find kernel feature that is a substring
of another that appears first in search algorithm
Status in AppArmor:
New
Status in snapd:
New
Status in apparmor package in Ubuntu:
In Progress
Bug description:
Kernel version:
```
Linux ubuntu-25-04 6.14.0-13-generic #13-Ubuntu SMP PREEMPT_DYNAMIC Wed Mar
26 22:00:40 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
```
With a simple profile with the network feature:
```
profile "foo" {
network,
}
```
The parser doesn't find the feature:
```
# gdb --args /usr/sbin/apparmor_parser --verbose --skip-cache
--skip-kernel-load foo.aa -o foo.bin
(gdb) b set_supported_features
Breakpoint 1 at 0x22d1c: file parser_main.c, line 627.
(gdb) r
Breakpoint 1, set_supported_features () at parser_main.c:627
627 if (!features && aa_features_new_from_kernel(&features) ==
-1) {
(gdb) n
632 perms_create = 1;
(gdb)
633 kernel_supports_policydb = aa_features_supports(features,
"file");
(gdb)
634 kernel_supports_network = aa_features_supports(features,
"network");
(gdb)
635 kernel_supports_unix = aa_features_supports(features,
(gdb) print kernel_supports_network
$1 = 0
```
It looks like during `walk_one`, it encounters first the `network_v9`
feature that causes a premature exit in the searching loop, which
makes the algorithm fail:
```
(gdb) print *features
$3 = {ref_count = 1,
string = "io_uring {mask {sqpoll override_creds\n}\n}\nquery {label
{multi_transaction {yes\n}\ndata {yes\n}\nperms {allow deny audit
quiet\n}\n}\n}\ndbus {mask {acquire send receive\n}\n}\nsignal {mask {hup int
quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont
stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt
lost\n}\n}\nptrace {mask {read trace\n}\n}\ncaps {extended {yes\n}\nmask {chown
dac_override dac_read_search fowner fsetid kill setgid setuid setpcap
linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock
ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin
sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write
audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend
audit_read perfmon bpf checkpoint_restore\n}\n}\nrlimit {mask {cpu fsize data
stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio
rttime\n}\n}\ncapability {0xf
fffff\n}\nnamespaces {userns_create {pciu&\n}\nmask
{userns_create\n}\npivot_root {no\n}\nprofile {yes\n}\n}\nmount {move_mount
{detached\n}\nmask {mount umount pivot_root\n}\n}\nnetwork_v9 {af_unix
{yes\n}\naf_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25
inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda
pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154
caif alg nfc vsock kcm qipcrtr smc xdp mctp\n}\n}\nnetwork_v8 {af_inet
{yes\n}\naf_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25
inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda
pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154
caif alg nfc vsock kcm qipcrtr smc xdp mctp\n}\n}\nnetwork {af_unix
{yes\n}\naf_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25
inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda
pppox wanpipe llc ib mpls can
tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm
qipcrtr smc xdp mctp\n}\n}\nipc {posix_mqueue {create read write open delete
setattr getattr\n}\n}\nfile {mask {create read write exec append mmap_exec link
lock\n}\n}\ndomain {version {1.2\n}\nkill.signal {yes\n}\ndisconnected.ipc
{yes\n}\ndisconnected.path {yes\n}\ninterruptible {yes\n}\nattach_conditions
{xattr {yes\n}\n}\ncomputed_longest_left {yes\n}\npost_nnp_subset
{yes\n}\nfix_binfmt_elf_mmap {yes\n}\nstack {yes\n}\nchange_profile
{yes\n}\nchange_onexec {yes\n}\nunconfined_allowed_children
{yes\n}\nchange_hatv {yes\n}\nchange_hat {yes\n}\n}\npolicy {notify {user
{file\n}\n}\nunconfined_restrictions {io_uring {1\n}\nuserns
{1\n}\nchange_profile {yes\n}\n}\nstate32 {0x000001\n}\npermstable32 {allow
deny subtree cond kill complain prompt audit quiet hide xindex tag
label\n}\npermstable32_version {0x000003\n}\noutofband {0x000001\n}\nset_load
{yes\n}\nversions {v9 {yes\n}\nv8 {yes\n}\nv7 {yes\n}\nv6 {yes\n}\
nv5 {yes\n}\n}\n}\n", '\000' <repeats 5323 times>}
```
```
Breakpoint 2, walk_one (str=0x7fffffffd9c8, component=0x7fffffffd9e0,
is_top_level=true) at features.c:346
346 i++;
(gdb) print cur
$4 = 0x55555572b063 "network_v9 {af_unix {yes\n}\naf_mask {unspec unix inet
ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key
netlink packet ash econet atmsvc rds s
na irda pppox wanpipe llc ib mpls"...
```
```
(gdb) print component->str
$8 = 0x5555556ab53d "network"
```
```
(gdb)
323 while(!isnul(*cur) && i < component->len) {
(gdb)
354 if (i != component->len) {
(gdb)
356 } else if (!isbrace_space_or_nul(*cur))
(gdb)
357 return false;
(gdb) print *cur
$9 = 95 '_'
```
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/2105986/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
