** Description changed: SRU Justification: [ Impact ] - * lsblk on an s390x system that uses DASD disks shows no output. - - * journactl shows lsblk is blocked by apparmor: - 2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 - audit(1744729346.034:270): apparmor="DENIED" operation="open" - class="file" profile="lsblk" name="/sys/devices/css0/ - 0.0.0000/0.0.0101/block/dasda/hidden" pid=2070 comm="lsblk" - requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 + * lsblk on an s390x system that uses DASD disks shows no output. - * The reason is that the unprivileged_userns profile does not - have access to /. - - * In case of running lsblk in a container the lsblk command - will even segfault, instead of returning just nothing. - - [ Fix ] + * journactl shows lsblk is blocked by apparmor: + 2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 + audit(1744729346.034:270): apparmor="DENIED" operation="open" + class="file" profile="lsblk" name="/sys/devices/css0/ + 0.0.0000/0.0.0101/block/dasda/hidden" pid=2070 comm="lsblk" + requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 - * unprivileged_userns profile: Allow full file system access - https://gitlab.com/apparmor/apparmor/-/commit/8138bc60d18a7939af766c322586c4268e2940e3 + * The reason is that the lsblk profile does not allow access + to /sys/devices/css0. [ Test Plan ] - * Install Ubuntu Server 25.04 on IBM Z in LPAR, z/VM or KVM - using DASD ECKD disks. - - * Please notice that testing this at install time using the installer - shell is not sufficient, since the profile is not active at that time. + * Install Ubuntu Server 25.04 on IBM Z in LPAR, z/VM or KVM + using DASD ECKD disks. - * Ensure util-linux and the s390-tools are installed - (which is by default). - - * Do an lsdasd, it should list DASD ECKD disks, similar to: - $ lsdasd - Bus-ID Status Name Device Type BlkSz Size Blocks - ================================================================================ - 0.0.0200 active dasda 94:0 ECKD 4096 7042MB 1802880 - 0.0.0300 active dasdb 94:4 ECKD 4096 7042MB 1802880 - 0.0.0400 active dasdc 94:8 ECKD 4096 21128MB 5409000 + * Please notice that testing this at install time using the installer + shell is not sufficient, since the profile is not active at that time. - * Now execute lsblk (and watch the journal) + * Ensure util-linux and the s390-tools are installed + (which is by default). - - on a system that is not patched, - one will see no output in the Terminal - (or in case of running in a container a segfault), - and messages like this in the journal: - 2025-04-15T15:02:26.048075+00:00 hwe0006 kernel: audit: type=1400 - audit(1744729346.034:270): apparmor="DENIED" operation="open" - class="file" profile="lsblk" name="/sys/devices/css0/ - 0.0.0000/0.0.0200/block/dasda/hidden" pid=2070 comm="lsblk" - requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 - ... + * Do an lsdasd, it should list DASD ECKD disks, similar to: + $ lsdasd + Bus-ID Status Name Device Type BlkSz Size Blocks + ================================================================================ + 0.0.0200 active dasda 94:0 ECKD 4096 7042MB 1802880 + 0.0.0300 active dasdb 94:4 ECKD 4096 7042MB 1802880 + 0.0.0400 active dasdc 94:8 ECKD 4096 21128MB 5409000 - - on a patched system, lsblk should provide a proper output - similar to this: - $ lsblk - NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS - loop0 7:0 0 65.4M 1 loop - loop1 7:1 0 65.4M 1 loop /snap/core22/1909 - loop2 7:2 0 39.9M 1 loop - loop3 7:3 0 98.7M 1 loop /snap/lxd/32454 - loop4 7:4 0 39.9M 1 loop /snap/snapd/23776 - loop5 7:5 0 65.4M 1 loop - loop6 7:6 0 100M 1 loop /snap/lxd/33109 - loop7 7:7 0 46.2M 1 loop /snap/snapd/24506 - loop8 7:8 0 65.4M 1 loop /snap/core22/1965 - dasda 94:0 0 20.6G 0 disk - └─dasda1 94:1 0 20.6G 0 part - └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / - dasdb 94:4 0 6.9G 0 disk - ├─dasdb1 94:5 0 1G 0 part /boot - └─dasdb2 94:6 0 5.9G 0 part - └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / - dasdc 94:8 0 20.6G 0 disk - └─dasdc1 94:9 0 20.6G 0 part - └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / - - * (After having done 'aa-disable lsblk' lsblk would also work - would also ork without the profile changes.) + * Now execute lsblk (and watch the journal) - * As a regression test execute lsblk also on a FCP/SCSP - system, to verify that nothing has changes - (since this was not affected). + - on a system that is not patched, + one will see no output in the Terminal + (or in case of running in a container a segfault), + and messages like this in the journal: + 2025-04-15T15:02:26.048075+00:00 hwe0006 kernel: audit: type=1400 + audit(1744729346.034:270): apparmor="DENIED" operation="open" + class="file" profile="lsblk" name="/sys/devices/css0/ + 0.0.0000/0.0.0200/block/dasda/hidden" pid=2070 comm="lsblk" + requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 + ... + + - on a patched system, lsblk should provide a proper output + similar to this: + $ lsblk + NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS + loop0 7:0 0 65.4M 1 loop + loop1 7:1 0 65.4M 1 loop /snap/core22/1909 + loop2 7:2 0 39.9M 1 loop + loop3 7:3 0 98.7M 1 loop /snap/lxd/32454 + loop4 7:4 0 39.9M 1 loop /snap/snapd/23776 + loop5 7:5 0 65.4M 1 loop + loop6 7:6 0 100M 1 loop /snap/lxd/33109 + loop7 7:7 0 46.2M 1 loop /snap/snapd/24506 + loop8 7:8 0 65.4M 1 loop /snap/core22/1965 + dasda 94:0 0 20.6G 0 disk + └─dasda1 94:1 0 20.6G 0 part + └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / + dasdb 94:4 0 6.9G 0 disk + ├─dasdb1 94:5 0 1G 0 part /boot + └─dasdb2 94:6 0 5.9G 0 part + └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / + dasdc 94:8 0 20.6G 0 disk + └─dasdc1 94:9 0 20.6G 0 part + └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / + + * (After having done 'aa-disable lsblk' lsblk would also work + would also work without the profile changes.) + + * As a regression test, execute lsblk also on a FCP/SCSP + system, to verify that nothing has changed + (since this was not affected). [ Where problems could occur ] - * The changes in profiles/apparmor.d/unprivileged_userns - are relatively small, just: - - allow file rwlkm /**, - + allow file rwlkm /{,**}, - but expand the prvilidges a bit. - - * Check if apparmor is enabled and the profile active: - sudo aa-status --enabled - sudo aa-status --show=all | grep unprivileged_userns - - * This should not have an impact on other (disk type) devices - like SCSI/FCP, but better check (see test plan, last bullet). + * This SRU loosens confinement on the lsblk profile. However, if a user + manually modified the installed profiles, then the package upgrade would + cause conflicts, and rejection of the incoming changes (either by hand + during an interactive upgrade or automatically during an batch unattended + upgrade) would result in end users not getting the packaged fix. + + * Check if apparmor is enabled and the profile active: + sudo aa-status --enabled + sudo aa-status --show=all | grep lsblk + + * This should not have an impact on other (disk type) devices + like SCSI/FCP, but better check (see test plan, last bullet). [ Other Info ] - * The modification is already included in questing. - - * The patch was tested also successfully tested in plucky on s390x. - - * Since the issue and the tests are very similar in LP#2107455 - and LP#2107402. Hence this SRU justification was added - to both of these two LP bugs. + * The modification is already included in questing. + + * The patch was tested also successfully tested in plucky on s390x. __________ Fresh install of 25.04 on s390x. Same happens also on upgrade from 24.10 to 25.04 lsblk returns no output journactl shows it is blocked by apparmor This works fine for SCSI devices, it fails only for DASD. ``` 2025-04-15T15:02:26.048055+00:00 s5lp1-gen03 kernel: kauditd_printk_skb: 6 callbacks suppressed 2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:270): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0000/0.0.0101/block/dasda/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048077+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:271): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0000/0.0.0101/block/dasda/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048078+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:272): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0003/0.0.0104/block/dasdd/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048079+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:273): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0003/0.0.0104/block/dasdd/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048080+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:274): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0001/0.0.0102/block/dasdb/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048080+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:275): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0001/0.0.0102/block/dasdb/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048081+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:276): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0002/0.0.0103/block/dasdc/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048081+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:277): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0002/0.0.0103/block/dasdc/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` Attaching also strace
-- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107402 Title: lsblk on IBM z Systems blocked by apparmor in 25.04 Status in Release Notes for Ubuntu: Fix Released Status in Ubuntu on IBM z Systems: In Progress Status in apparmor package in Ubuntu: Fix Released Status in util-linux package in Ubuntu: Invalid Status in apparmor source package in Plucky: In Progress Status in util-linux source package in Plucky: Invalid Status in apparmor source package in Questing: Fix Released Status in util-linux source package in Questing: Invalid Bug description: SRU Justification: [ Impact ] * lsblk on an s390x system that uses DASD disks shows no output. * journactl shows lsblk is blocked by apparmor: 2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:270): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/ 0.0.0000/0.0.0101/block/dasda/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 * The reason is that the lsblk profile does not allow access to /sys/devices/css0. [ Test Plan ] * Install Ubuntu Server 25.04 on IBM Z in LPAR, z/VM or KVM using DASD ECKD disks. * Please notice that testing this at install time using the installer shell is not sufficient, since the profile is not active at that time. * Ensure util-linux and the s390-tools are installed (which is by default). * Do an lsdasd, it should list DASD ECKD disks, similar to: $ lsdasd Bus-ID Status Name Device Type BlkSz Size Blocks ================================================================================ 0.0.0200 active dasda 94:0 ECKD 4096 7042MB 1802880 0.0.0300 active dasdb 94:4 ECKD 4096 7042MB 1802880 0.0.0400 active dasdc 94:8 ECKD 4096 21128MB 5409000 * Now execute lsblk (and watch the journal) - on a system that is not patched, one will see no output in the Terminal (or in case of running in a container a segfault), and messages like this in the journal: 2025-04-15T15:02:26.048075+00:00 hwe0006 kernel: audit: type=1400 audit(1744729346.034:270): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/ 0.0.0000/0.0.0200/block/dasda/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ... - on a patched system, lsblk should provide a proper output similar to this: $ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS loop0 7:0 0 65.4M 1 loop loop1 7:1 0 65.4M 1 loop /snap/core22/1909 loop2 7:2 0 39.9M 1 loop loop3 7:3 0 98.7M 1 loop /snap/lxd/32454 loop4 7:4 0 39.9M 1 loop /snap/snapd/23776 loop5 7:5 0 65.4M 1 loop loop6 7:6 0 100M 1 loop /snap/lxd/33109 loop7 7:7 0 46.2M 1 loop /snap/snapd/24506 loop8 7:8 0 65.4M 1 loop /snap/core22/1965 dasda 94:0 0 20.6G 0 disk └─dasda1 94:1 0 20.6G 0 part └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / dasdb 94:4 0 6.9G 0 disk ├─dasdb1 94:5 0 1G 0 part /boot └─dasdb2 94:6 0 5.9G 0 part └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / dasdc 94:8 0 20.6G 0 disk └─dasdc1 94:9 0 20.6G 0 part └─hwe0006--vg-hwe0006--lv 253:0 0 47.1G 0 lvm / * (After having done 'aa-disable lsblk' lsblk would also work would also work without the profile changes.) * As a regression test, execute lsblk also on a FCP/SCSP system, to verify that nothing has changed (since this was not affected). [ Where problems could occur ] * This SRU loosens confinement on the lsblk profile. However, if a user manually modified the installed profiles, then the package upgrade would cause conflicts, and rejection of the incoming changes (either by hand during an interactive upgrade or automatically during an batch unattended upgrade) would result in end users not getting the packaged fix. * Check if apparmor is enabled and the profile active: sudo aa-status --enabled sudo aa-status --show=all | grep lsblk * This should not have an impact on other (disk type) devices like SCSI/FCP, but better check (see test plan, last bullet). [ Other Info ] * The modification is already included in questing. * The patch was tested also successfully tested in plucky on s390x. __________ Fresh install of 25.04 on s390x. Same happens also on upgrade from 24.10 to 25.04 lsblk returns no output journactl shows it is blocked by apparmor This works fine for SCSI devices, it fails only for DASD. ``` 2025-04-15T15:02:26.048055+00:00 s5lp1-gen03 kernel: kauditd_printk_skb: 6 callbacks suppressed 2025-04-15T15:02:26.048075+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:270): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0000/0.0.0101/block/dasda/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048077+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:271): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0000/0.0.0101/block/dasda/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048078+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:272): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0003/0.0.0104/block/dasdd/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048079+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:273): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0003/0.0.0104/block/dasdd/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048080+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:274): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0001/0.0.0102/block/dasdb/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048080+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:275): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0001/0.0.0102/block/dasdb/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048081+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:276): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0002/0.0.0103/block/dasdc/hidden" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 2025-04-15T15:02:26.048081+00:00 s5lp1-gen03 kernel: audit: type=1400 audit(1744729346.034:277): apparmor="DENIED" operation="open" class="file" profile="lsblk" name="/sys/devices/css0/0.0.0002/0.0.0103/block/dasdc/dev" pid=2070 comm="lsblk" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` Attaching also strace To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-release-notes/+bug/2107402/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
